Function at 0x406d32
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x406d50
mov ecx, dword [0x46d9fc]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x475a58]
push ebx
push esi
push edi
lea ebx, [eax + ecx]
mov ecx, dword [ebp + 8]
mov eax, 0x4559a0
sub ecx, eax
mov edi, eax
cmp ecx, 0x8000
jae 0x406d77
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov dl, byte [ebx]
test dl, dl
je 0x406f55
mov ecx, edi
sub ecx, eax
cmp ecx, 0x4000
jge 0x406f55
inc ebx
cmp dl, 0xfc
mov dword [ebp + 0xc], ebx
jbe 0x406f39
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov ebx, ecx
and esi, 0x7f
and ebx, 0x7f
shl esi, 7
or esi, ebx
mov ebx, 0x8000
mov dword [ebp - 0x14], eax
or eax, ebx
mov dword [ebp - 0x1c], ecx
push 2
or ecx, ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop eax
add ebx, eax
cmp dl, 0xfe
mov dword [ebp - 0x18], ecx
jne 0x406ee5
and dword [ebp - 4], 0
and dword [ebp + 0xc], 0
and byte [edi], 0
cmp dword [ebp - 0x14], 4
jne 0x406df5
mov dword [ebp - 4], str.MicrosoftInternet_ExplorerQuick_Launch
mov dword [ebp + 0xc], eax
mov esi, dword [ebp - 0x1c]
cmp esi, 0x2b
jne 0x406e12
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00406c07
cmp esi, 0x26
jne 0x406e3c
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00406c07
cmp byte [edi], 0
jne 0x406e7a
push str.C:Program_Files
push edi
call fcn.00406d14
cmp esi, 0x25
jne 0x406e4d
push 0x4000
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp esi, 0x24
jne 0x406e5e
push 0x4000
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x406e7a
cmp dword [0x475aa4], 0
mov dword [ebp + 0xc], 4
jne 0x406e7a
mov dword [ebp + 0xc], 2
mov eax, dword [ebp + 0xc]
dec dword [ebp + 0xc]
test eax, eax
je 0x406ece
mov eax, dword [ebp + 0xc]
lea esi, [ebp + eax*4 - 0x1c]
lea eax, [ebp - 8]
push eax
push dword [esi]
push dword [0x475a24]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x406ebe
push edi
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.0040652f
cmp dword [ebp - 0xc], 0
jne 0x406ece
jmp 0x406ec1
and byte [edi], 0
mov eax, dword [ebp + 0xc]
dec dword [ebp + 0xc]
sub esi, 4
test eax, eax
jne 0x406e8b
cmp byte [edi], 0
je 0x406f16
cmp dword [ebp - 4], 0
je 0x406f16
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x406f16
cmp dl, 0xfd
jne 0x406f26
cmp esi, 0x1b
jne 0x406efd
push dword [0x475a24]
push edi
call fcn.00406c71
jmp 0x406f0e
mov eax, esi
shl eax, 0xe
add eax, section..ndata
push eax
push edi
call fcn.00406d14
add esi, 0xffffffeb
cmp esi, 6
jae 0x406f1c
push edi
call fcn.00406f74
push edi
call fcn.00406d25
add edi, eax
jmp 0x406f46
cmp dl, 0xff
jne 0x406f46
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00406d32
jmp 0x406f1c
jne 0x406f43
mov al, byte [ebx]
mov byte [edi], al
inc edi
inc ebx
jmp 0x406f46
mov byte [edi], dl
inc edi
mov dl, byte [ebx]
mov eax, 0x4559a0
test dl, dl
jne 0x406d81
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x406f70
push 0x4000
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
leave
ret 8