Function at 0x4021e6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push 0x78
push dword [0x44705c]
push dword [0x44718a]
push 0x10
push str.aEWdUuOfrXpdjUYy
call dword [sym.imp.shell32.dll_ExtractIconExW]
mov dword [0x4484a9], eax
push 0x1d
push 0x448805
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x4489a4], eax
mov eax, 0xeea
mov dword [0x44859f], eax
push dword [0x44859f]
pop edx
mov dword [ebp - 0xc], edx
mov edx, 0x159
and edx, 0xfff
mov dword [0x448765], edx
mov dword [0x448b21], 0x494
mov ecx, dword [0x448b21]
mov dword [0x448b00], ecx
mov dword [0x44896b], 0x412
push dword [0x44896b]
pop eax
push eax
pop dword [0x4484a4]
mov dword [0x4486fb], 0x12f
sub dword [0x4486fb], 0xa
mov edi, dword [0x4486fb]
mov dword [0x4488a6], edi
push 0x448886
push dword [ebp - 8]
lea edx, [0x71]
push edx
push dword [ebp - 4]
push 0x448abb
call fcn.00401458
mov dword [0x448bc7], 0x8e8a5a0f
push 0x6e
push dword [0x447044]
push dword [0x44718a]
push 0x7d
push str.nATnjKgLoxDAnDp
call dword [sym.imp.shell32.dll_ExtractIconExW]
mov dword [0x4483b1], eax
push 0xf
push dword [0x4470e1]
push dword [0x447136]
push 0x2d
push str.YgkSzRH
call dword [sym.imp.shell32.dll_ExtractIconExW]
mov dword [0x448907], eax
push 0x6a
push dword [0x4470e1]
push 0
push 0x55
push str.nATnjKgLoxDAnDp
call dword [sym.imp.shell32.dll_ExtractIconExW]
mov dword [0x4489e0], eax
mov eax, 0x46f
mov dword [ebp - 0x18], eax
add eax, dword [0x4470ea]
mov dword [ebp - 8], eax
push 0x20
push dword [ebp - 8]
push dword [ebp - 0x1c]
mov dword [0x4482ad], 0x69d
sub dword [0x4482ad], 0x6f
and dword [0x4482ad], 0xfff
mov edi, dword [0x4482ad]
mov dword [0x4484ad], edi
push esi
push ebx
call fcn.00401458
mov esi, 0xd2a
sub esi, dword [0x44714e]
shl esi, 6
mov dword [ebp - 0x10], esi
lea edx, [0x6e]
push edx
call fcn.00401004
push 0x51
push 0x4482c0
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov dword [0x4487f2], eax
add dword [0x448bc7], 0x71b5d201
push 1
push dword [0x4472db]
push dword [0x447325]
push 0x20
push str.EcczjEJvUQjOiJbN
call dword [sym.imp.shell32.dll_ExtractIconExW]
mov dword [0x4489e7], eax
lea edx, [0x50]
push edx
push 0x448798
push 0x448668
push 0x60
push 0x10
call fcn.00401458
push dword [ebp - 4]
call fcn.00401004
mov dword [0x448a36], 0xdf3
sub dword [0x448a36], 0x2d
mov esi, dword [0x448a36]
mov dword [0x4488dc], esi
mov dword [0x448913], 0xb72
mov edi, dword [0x448913]
push edi
pop dword [0x448a33]
mov dword [0x4484b5], 0xadc
mov ebx, 0x63
or dword [0x4484b5], 0x30
add dword [0x4484b5], 6
dec ebx
jne 0x402417
mov esi, dword [0x4484b5]
mov dword [0x44884e], esi
lea edx, [0x67]
push edx
call fcn.004015e0
mov dword [0x448537], 0x986
sub dword [0x448537], 0x14
mov edx, dword [0x448537]
mov dword [0x448495], edx
push esp
call fcn.004015e0
push 0xc
push 0
push dword [0x44718a]
push 1
push str.rITumDEkf
call dword [sym.imp.shell32.dll_ExtractIconExW]
mov dword [0x448626], eax
mov dword [0x448361], 0x8a2
and dword [0x448361], 0xfff
mov edx, dword [0x448361]
mov dword [0x448315], edx
mov dword [0x448225], 0x676
add dword [0x448225], 0xe
or dword [0x448225], 0xd0b
je 0x4024ca
and dword [0x448225], 0xffff
mov edx, dword [0x448225]
mov dword [0x4486ac], edx
mov dword [0x448670], 0xf73
mov ecx, dword [0x448670]
push ecx
pop dword [0x4485e0]
mov ebx, 0xde
ror ebx, 0x15
add ebx, dword [0x447054]
push ebx
pop dword [0x448215]
mov dword [0x448627], 0x1fc
dec dword [0x448627]
or dword [0x448627], 0x3cf
je 0x402528
and dword [0x448627], 0xffff
mov edi, dword [0x448627]
mov dword [0x4487fe], edi
mov edx, 0x1ff
mov dword [ebp - 0x1c], edx
mov dword [0x4484fd], edx
push 0
push str.XHIFosDNCd
call dword [sym.imp.advapi32.dll_CryptSetProviderA]
push eax
push eax
call dword [sym.imp.urlmon.dll_HlinkNavigateMoniker]
mov dword [0x448b47], 0xdaa
mov edx, 0x53
add dword [0x448b47], 1
sub edx, 1
jne 0x402566
mov edx, dword [0x448b47]
mov dword [0x4485fe], edx
mov dword [0x44844c], 0x1a6
mov ecx, 0xaa6
inc dword [0x44844c]
dec ecx
jne 0x402591
mov ecx, dword [0x44844c]
mov dword [0x4487db], ecx
mov ecx, 0x13e
mov esi, 0xd3
shl ecx, 2
or ecx, ecx
je 0x4025be
mov dword [ebp - 0x14], ecx
dec esi
jne 0x4025b4
mov dword [ebp - 0x18], ecx
mov dword [0x4488fd], 0xdf9
mov esi, 0xf50
and dword [0x4488fd], 0xffff
push dword [0x4488fd]
pop edi
sub esi, 1
jne 0x4025d7
mov dword [ebp - 0x1c], edi
push dword [ebp - 4]
call fcn.00401004
push dword [0x447358]
push str.enOTsXfndWLUfTJ
call dword [sym.imp.advapi32.dll_CryptSetProviderA]
push eax
push eax
call dword [sym.imp.urlmon.dll_HlinkNavigateMoniker]
mov dword [0x448b5a], 0x873
or dword [0x448b5a], 0xc36
mov edx, dword [0x448b5a]
mov dword [0x448583], edx
mov edi, 0x87c
add edi, 0x86d
push edi
pop dword [0x4483f5]
mov dword [0x4488b0], 0xdab
or dword [0x4488b0], 0xa5a
mov ecx, dword [0x4488b0]
mov dword [0x44834c], ecx
mov esi, 0x5a0
shl esi, 7
mov dword [0x4485c2], esi
mov ecx, 0xf1a
mov dword [0x4486c5], ecx
test dword [0x4486c5], 0xb1f
je 0x402693
sub dword [0x4486c5], 0x55
mov ecx, dword [0x4486c5]
mov dword [0x448696], ecx
mov edx, 0xec3
shr edx, 1
cmp edx, 0x2cb
je 0x4026b4
and edx, 0xff
push edx
pop dword [0x448a42]
add eax, 0x80392891
mov cl, byte [0x4471cd]
cmp cl, 0x43
jne 0x402787
and ebx, eax
dec edx
lea edx, [0x7c]
push edx
push 0x70
push dword [ebp - 8]
call fcn.004016d4
test esi, eax
dec ebx
inc ebx
lea edx, [0x62]
push edx
mov dword [0x44883c], 0x124
add dword [0x44883c], 0x79
mov edi, dword [0x44883c]
mov dword [0x44882b], edi
push edx
push ebp
mov dword [0x448509], 0x3a6
and dword [0x448509], 0xffff
mov edi, dword [0x448509]
mov dword [0x44886e], edi
push 0x448a20
lea edx, [0x7d]
push edx
call fcn.00401458
mov edx, 0x2c7
shl edx, 2
mov dword [0x4487e1], edx
mov edx, 0x1b0
shr edx, 3
or edx, edx
je 0x40275e
mov dword [0x4487c8], edx
mov ebx, dword [0x4487c8]
mov dword [0x4485ca], ebx
mov dword [0x44847b], 0xb86
or dword [0x44847b], 0x29
mov esi, dword [0x44847b]
mov dword [0x448684], esi
push eax
mov dword [0x44892a], 0x99b
dec dword [0x44892a]
test dword [0x44892a], 0x17b
jne 0x4027aa
inc dword [0x44892a]
mov edx, dword [0x44892a]
mov dword [0x448973], edx
mov dword [0x448597], 0xcf9
mov edi, 0x36e
add dword [0x448597], 0x75
inc dword [0x448597]
dec edi
jne 0x4027c5
mov esi, dword [0x448597]
mov dword [0x448875], esi
ret