Function at 0x406416
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
push esi
jge 0x406434
mov ecx, dword [0x4308a8]
lea eax, [ebp*4 + 4]
sub ecx, eax
mov ebp, dword [ecx]
mov eax, dword [0x4310f8]
mov ecx, dword [esp + 0x20]
add ebp, eax
mov eax, 0x42fc60
sub ecx, eax
cmp ecx, 0x800
mov esi, eax
jae 0x406459
mov esi, dword [esp + 0x20]
and dword [esp + 0x20], 0
mov dl, byte [ebp]
test dl, dl
je 0x406623
push ebx
push edi
mov ecx, esi
sub ecx, eax
cmp ecx, 0x400
jge 0x406621
inc ebp
cmp dl, 0xfc
jbe 0x406603
movsx eax, byte [ebp + 1]
movsx ecx, byte [ebp]
mov edi, eax
and edi, 0x7f
mov ebx, ecx
and ebx, 0x7f
shl edi, 7
or edi, ebx
mov ebx, 0x8000
mov dword [esp + 0x14], ecx
or ecx, ebx
mov dword [esp + 0x1c], eax
or eax, ebx
inc ebp
inc ebp
cmp dl, 0xfe
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jne 0x4065ad
xor edi, edi
cmp dword [esp + 0x1c], 4
mov dword [esp + 0x2c], edi
mov byte [esi], 0
jne 0x4064d6
push 2
mov dword [esp + 0x30], str.MicrosoftInternet_ExplorerQuick_Launch
pop edi
mov ebx, dword [esp + 0x14]
cmp ebx, 0x2b
jne 0x4064f4
push esi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405d50
cmp ebx, 0x26
jne 0x40651f
push esi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405d50
cmp byte [esi], 0
jne 0x406590
push str.C:Program_Files
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 0x25
jne 0x406530
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp ebx, 0x24
jne 0x406541
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [esi], 0
jne 0x406590
cmp dword [0x431144], 0
push 4
pop edi
jne 0x406557
push 2
pop edi
jmp 0x406590
lea eax, [esp + 0x10]
push eax
push dword [esp + edi*4 + 0x14]
dec edi
push dword [0x4310c0]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40658d
push esi
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
mov ebx, eax
call fcn.00405b35
test ebx, ebx
jne 0x406594
jmp 0x406590
mov byte [esi], 0
test edi, edi
jne 0x406557
cmp byte [esi], 0
je 0x4065df
cmp dword [esp + 0x2c], 0
je 0x4065df
push dword [esp + 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x4065df
cmp dl, 0xfd
jne 0x4065f0
cmp edi, 0x1b
jne 0x4065c5
push dword [0x4310c0]
push esi
call fcn.00405dba
jmp 0x4065d7
mov eax, edi
shl eax, 0xa
add eax, section..ndata
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xffffffeb
cmp edi, 6
jae 0x4065e5
push esi
call fcn.00405e68
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
jmp 0x406611
cmp dl, 0xff
jne 0x406611
or eax, 0xffffffff
sub eax, edi
push eax
push esi
call fcn.00406416
jmp 0x4065e5
jne 0x40660e
mov al, byte [ebp]
mov byte [esi], al
inc esi
inc ebp
jmp 0x406611
mov byte [esi], dl
inc esi
mov dl, byte [ebp]
test dl, dl
mov eax, 0x42fc60
jne 0x406466
pop edi
pop ebx
cmp dword [esp + 0x20], 0
mov byte [esi], 0
pop esi
pop ebp
je 0x40663f
push 0x400
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add esp, 0x14
ret 8