Function at 0x405820
Capabilities:
Get common file path
Get file size
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58808c
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x5f3fcc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x480], eax
push 0
mov dword [ebp - 0x48c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x428]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x430], 0
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4058a0
sub ecx, edx
lea eax, [ebp - 0x428]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.00406400
mov dword [ebp - 4], 0
lea edx, [ebp - 0x440]
mov edi, dword [ebp - 0x42c]
cmp edi, 8
mov esi, dword [ebp - 0x440]
mov eax, dword [ebp - 0x430]
cmovae edx, esi
test eax, eax
je 0x405913
or ecx, 0xffffffff
dec eax
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea ecx, [edx + ecx*2]
je 0x40590d
nop
cmp ecx, edx
je 0x405913
sub ecx, 2
cmp word [ecx], 0x5c
jne 0x405900
sub ecx, edx
sar ecx, 1
jmp 0x405916
or ecx, 0xffffffff
test ecx, ecx
jns 0x40594f
cmp edi, 8
jb 0x405c8b
lea ecx, [edi*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x405948
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405ca9
push ecx
push esi
jmp 0x405c83
xor eax, eax
mov dword [ebp - 0x460], 0
cmp dword [ebp - 0x430], ecx
mov word [ebp - 0x470], ax
lea eax, [ebp - 0x440]
cmovb ecx, dword [ebp - 0x430]
cmp edi, 8
push ecx
cmovae eax, esi
mov dword [ebp - 0x45c], 7
push eax
lea ecx, [ebp - 0x470]
call fcn.00406400
lea ecx, [ebp - 0x440]
call fcn.004063a0
movups xmm0, xmmword [ebp - 0x470]
push str.msconfig.ini
lea edx, [ebp - 0x440]
movups xmmword [ebp - 0x440], xmm0
lea ecx, [ebp - 0x458]
movq xmm0, qword [ebp - 0x460]
movq qword [ebp - 0x430], xmm0
call fcn.00406590
add esp, 4
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 1
mov dword [ebp - 0x484], 0
call fcn.004213f0
push 0x5cf6c8
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 2
call fcn.00421380
push 1
push 0x1a
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 3
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x405a3d
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x480]
add eax, 0x250
push str._sMSUsbDisplay_
push eax
call fcn.00421840
add esp, 0xc
lea ecx, [ebp - 0x4a4]
call fcn.00421460
lea ecx, [ebp - 0x468]
call fcn.00421460
push 0x18
mov byte [ebp - 4], 4
call fcn.00422160
mov edi, eax
add esp, 4
mov dword [ebp - 0x488], edi
mov byte [ebp - 4], 5
test edi, edi
je 0x405aad
cmp dword [ebp - 0x444], 8
lea esi, [ebp - 0x458]
lea ecx, [edi + 8]
cmovae esi, dword [ebp - 0x458]
mov dword [edi], vtable.WinFile.0
mov dword [edi + 4], 0xffffffff
call fcn.004213f0
push ecx
push 3
push 0
push esi
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0040a8a0
jmp 0x405aaf
xor edi, edi
lea eax, [ebp - 0x494]
mov dword [ebp - 4], 1
push eax
push dword [edi + 4]
mov dword [ebp - 0x488], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [ebp - 0x494], 0
jbe 0x405bcc
xor esi, esi
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], esi
nop word [eax + eax]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x471]
mov eax, dword [edi]
push 1
push ecx
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 1
mov al, byte [ebp - 0x471]
cmp al, 0xd
je 0x405b24
cmp al, 0xa
je 0x405b24
cmp dword [ebp - 0x478], 0
jne 0x405af0
jmp 0x405b59
mov ecx, dword [ebp - 0x480]
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00405cc0
test eax, eax
jne 0x405b41
inc dword [ebp - 0x484]
mov al, byte [ebp - 0x471]
xor esi, esi
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x47c], esi
cmp al, 0x2c
je 0x405b94
cmp al, 0x3a
je 0x405b94
cmp al, 0x5f
je 0x405b94
cmp al, 0x30
jl 0x405b6d
cmp al, 0x39
jle 0x405b94
cmp al, 0x61
jl 0x405b75
cmp al, 0x7a
jle 0x405b94
cmp al, 0x41
jl 0x405b7d
cmp al, 0x5a
jle 0x405b94
cmp al, 0x3b
jne 0x405af0
mov dword [ebp - 0x478], 1
jmp 0x405af0
mov byte [ebp + esi - 0x118], al
inc esi
jmp 0x405ae1
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x405be2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0xffffffff
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov edx, dword [ebp - 0x444]
cmp edx, 8
jb 0x405c2a
mov ecx, dword [ebp - 0x458]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405c20
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405cae
push edx
push ecx
call fcn.00567d94
add esp, 8
mov edx, dword [ebp - 0x42c]
xor eax, eax
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 7
mov word [ebp - 0x458], ax
cmp edx, 8
jb 0x405c8b
mov ecx, dword [ebp - 0x440]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x405c81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405cb3
jmp 0x405c81
push edx
push ecx
call fcn.00567d94
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00567879
mov esp, ebp
pop ebp
ret
call fcn.0056d4c2
call fcn.0056d4c2
call fcn.0056d4c2
int3