Function at 0x40f130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45114f
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x460164]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x460164]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
lea edi, [esi + 8]
mov eax, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x40], ebx
mov dword [esi + 4], 1
call fcn.00403c60
lea eax, [esp + 0x14]
push eax
mov ecx, 0x4551e0
call fcn.00401a60
mov dword [esp + 0x268], 0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
test eax, eax
jne 0x40f1f1
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push str.BrowserIE
push str.TrackClientData
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [esp + 0x268], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40f6de
mov edx, dword [0x461acc]
mov eax, dword [edx + 0xc]
mov ecx, 0x461acc
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x268], 1
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
mov eax, dword [ebx]
push eax
je 0x40f710
push 0x455b58
push str.BrowserIE
push str.TrackClientData
call edi
push 0
call fcn.00408cd0
add esp, 4
test eax, eax
je 0x40f721
mov edx, dword [0x461acc]
mov eax, dword [edx + 0xc]
mov ecx, 0x461acc
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, str.Start_Page
mov byte [esp + 0x26c], 2
call fcn.00401a60
lea edx, [esp + 0x1c]
push edx
mov ecx, str.SoftwareMicrosoftInternet_ExplorerMain
mov byte [esp + 0x26c], 3
call fcn.00401a60
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
lea eax, [esp + 0x20]
mov edx, SysReAllocStringLen
mov byte [esp + 0x26c], 4
call fcn.00426700
mov byte [esp + 0x26c], 3
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f2dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x268], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f304
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x270], 5
push eax
mov dword [esp + 0x24], 0xffffffff
call fcn.00406bc0
add esp, 0xc
mov edx, 0x455b58
lea edi, [esp + 0x14]
call fcn.00401c10
mov edi, dword [esp + 0x18]
test edi, edi
jl 0x40f43c
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40f364
mov ecx, dword [esp + 0x38]
sub ecx, eax
sar ecx, 3
cmp edi, ecx
jb 0x40f36d
call fcn.00435b3c
mov eax, dword [esp + 0x34]
lea esi, [edi*8]
mov eax, dword [esi + eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x4c], esp
mov dword [esp + 0x1c], esp
call fcn.00401dd0
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov byte [esp + 0x26c], 6
mov eax, dword [esp + 0x38]
test eax, eax
je 0x40f3ac
mov ecx, dword [esp + 0x3c]
sub ecx, eax
sar ecx, 3
cmp edi, ecx
jb 0x40f3b5
call fcn.00435b3c
mov eax, dword [esp + 0x38]
mov eax, dword [esi + eax + 4]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.00401dd0
add eax, 0x10
lea edx, [esp + 0x24]
mov dword [edi], eax
push edx
mov byte [esp + 0x274], 5
call fcn.00409d80
lea edi, [esp + 0x28]
mov byte [esp + 0x268], 7
call fcn.00403c60
mov byte [esp + 0x268], 5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f418
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.0043595f
add esp, 8
test eax, eax
jne 0x40f43c
mov edx, 0x4551e0
lea edi, [esp + 0x14]
call fcn.00401c10
mov eax, dword [ebx]
push eax
mov eax, dword [esp + 0x18]
push eax
push str.IE_HomePageChange
push str.TrackClientData
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea esi, [esp + 0x30]
call fcn.00403760
mov byte [esp + 0x268], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f485
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x24]
push 0x104
lea ecx, [esp + 0x50]
push 0
push ecx
call fcn.00439d50
add esp, 0xc
lea edx, [esp + 0x44]
push edx
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x50]
call fcn.00401a60
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov byte [esp + 0x26c], 8
call fcn.0040f740
push eax
push 0x4551e8
lea edi, [esp + 0x1c]
call fcn.00402050
mov byte [esp + 0x270], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f518
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push str.IE_BookmarkCount
push str.TrackClientData
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x454c34
xor ebx, ebx
lea eax, [esp + 0x18]
call fcn.00401e40
mov edx, dword [0x461acc]
mov eax, dword [edx + 0xc]
mov ecx, 0x461acc
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x268], 9
mov edx, dword [0x461acc]
mov eax, dword [edx + 0xc]
mov ecx, 0x461acc
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x268], 0xa
mov edx, dword [0x461acc]
mov eax, dword [edx + 0xc]
mov ecx, 0x461acc
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x24]
push ecx
mov bl, 0xb
lea ecx, [esp + 0x24]
lea edi, [esp + 0x20]
mov byte [esp + 0x26c], bl
call fcn.0040dbf0
lea edx, [esp + 0x20]
push edx
call fcn.0040d6e0
push eax
lea eax, [esp + 0x30]
push eax
mov esi, edi
call fcn.0040a3d0
lea eax, [esp + 0x2c]
lea edi, [esp + 0x14]
mov byte [esp + 0x268], 0xc
call fcn.00403c60
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov edx, dword [esp + 0x14]
push eax
push edx
push str.IE_ChromeSE
push str.TrackClientData
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [esp + 0x268], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f61f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x268], 0xa
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f647
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x268], 9
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f66f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x268], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f697
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x268], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f6bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x268], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f6ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.00435245
mov esp, ebp
pop ebp
ret 4
push 0x455bec
push str.BrowserIE
push str.TrackClientData
call edi
mov eax, dword [ebx]
push eax
push 0x455bec
push str.IE_HomePageChange
push str.TrackClientData
call edi
jmp 0x40f489