Function at 0x406980
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4615d0
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x488480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
mov ebx, dword [ebp + 0xc]
push 0
push edi
push eax
push dword [0x4aaa54]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, eax
test esi, esi
je 0x406a76
call fcn.00404210
test eax, eax
je 0x406e68
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405a50
test al, al
jne 0x406a33
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406a17
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404510
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00405060
mov edx, dword [ebp - 0x11c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg case.0x406a89.23
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp case.0x406a89.23
lea eax, [edi - 0x16]
cmp eax, 0x18
ja case.0x406a89.23
movzx eax, byte [eax + 0x406ea0]
jmp dword [eax*4 + 0x406e88]
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x406e5e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405a50
test al, al
jne 0x406b01
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406ae5
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404510
push 3
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x11c]
call fcn.00407230
push str.Program_Files
push eax
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 4
push eax
call fcn.00405340
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x124]
call fcn.00403fe0
push dword [ebp - 0x120]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406b67
lea eax, [ebp - 0x120]
mov ecx, ebx
push eax
call fcn.00405060
mov esi, 1
lea ecx, [ebp - 0x120]
jmp 0x406e1b
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.00404210
test eax, eax
je 0x406e68
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 7
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405a50
test al, al
jne 0x406be3
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406bc7
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404510
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 8
push eax
mov ecx, ebx
call fcn.00405060
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00403fe0
mov esi, 1
jmp case.0x406a89.23
push 0
push 0x10
lea eax, [ebp - 0x118]
push eax
push dword [0x4aaa54]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, eax
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x406e68
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 9
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405a50
test al, al
jne 0x406c8c
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c70
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404510
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0xa
push eax
mov ecx, ebx
call fcn.00405060
jmp 0x406e20
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x406e72
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405a50
test al, al
jne 0x406d1c
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406d00
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404510
push 3
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x11c]
call fcn.00407230
push str.My_Documents
push eax
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0xd
push eax
call fcn.00405340
add esp, 0xc
mov byte [ebp - 4], 0xf
jmp 0x406b39
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x406e7c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405a50
test al, al
jne 0x406dcc
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406db0
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x11c]
call fcn.00404510
push str.Start_Menu
lea eax, [ebp - 0x11c]
mov dword [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.00405340
add esp, 0xc
push dword [ebp - 0x124]
mov byte [ebp - 4], 0x12
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x406e15
lea eax, [ebp - 0x124]
mov ecx, ebx
push eax
call fcn.00405060
mov esi, 1
lea ecx, [ebp - 0x124]
call fcn.00403fe0
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.00403fe0
push 1
push 0x466664
mov ecx, ebx
call fcn.00405850
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a0ec
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
nop
pop ecx
insd dword es:[edi], dx
inc eax
add byte [esp + ebp*2], dl
inc eax
add byte [edx + 0x6b], dh
inc eax
add byte [eax - 0x59ffbf96], dl
insb byte es:[edi], dx
inc eax
add byte [edx], dh
outsb dx, byte [esi]
inc eax
add byte [eax], al
add eax, 0x5050105
add eax, 84215045
add eax, 84018437
add eax, dword [84215045]
add eax, -859044859
int3