Function at 0x402d3f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
lea eax, [ebp - 0x414]
push esi
push edi
push 0x200
xor esi, esi
push esi
push eax
call fcn.00413120
mov edi, dword [ebp + 0xc]
add esp, 0xc
add edi, 8
cmp word [edi], si
jne 0x402d73
xor eax, eax
jmp 0x402fb7
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x214]
push edi
push eax
call ebx
push 0x25
pop eax
cmp word [ebp - 0x214], ax
jne 0x402fae
push eax
lea eax, [ebp - 0x212]
push eax
call fcn.0041327a
pop ecx
pop ecx
test eax, eax
je 0x402fae
xor ecx, ecx
mov dword [ebp - 8], esi
mov word [ebp - 0x214], cx
mov word [eax], cx
add eax, 2
mov cx, word [ebp - 0x212]
mov dword [ebp - 0xc], eax
movzx eax, cx
mov dword [ebp - 4], esi
cmp eax, 0x44
je 0x402f23
cmp eax, 0x4d
je 0x402f05
cmp eax, 0x50
je 0x402ee7
cmp eax, 0x53
je 0x402ebd
cmp eax, 0x57
je 0x402e8c
cmp cx, 0x74
jne 0x402f7a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x212]
push str.temp
push eax
call ebx
test eax, eax
jne 0x402e2e
lea eax, [ebp - 0x414]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str._temp_
push edi
call ebx
test eax, eax
jne 0x402f45
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x318], esi
je 0x402f45
lea eax, [ebp - 0x61c]
push eax
push esi
push dword [ebp + 0x10]
call fcn.004022c6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x414]
add esp, 0xc
push 0x42d4b4
push eax
call esi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
xor esi, esi
inc esi
jmp 0x402f45
push str.WinDir
lea eax, [ebp - 0x212]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402f45
push 0x100
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x402f45
push 0x42d430
lea eax, [ebp - 0x212]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402f45
push 0x100
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x402f45
push str.ProgramFiles
lea eax, [ebp - 0x212]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402f45
lea eax, [ebp - 4]
push eax
push 0x26
jmp 0x402f3f
push str.MyDocuments
lea eax, [ebp - 0x212]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402f45
lea eax, [ebp - 4]
push eax
push 5
jmp 0x402f3f
push str.Desktop
lea eax, [ebp - 0x212]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402f45
lea eax, [ebp - 4]
push eax
push 0x10
push esi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x402f7a
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp word [ebp - 0x414], 0
je 0x402f91
lea eax, [ebp - 0x414]
push eax
call fcn.00402256
pop ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x414]
push eax
push 0x42d4b8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x402fb4
push edi
push dword [ebp + 8]
call ebx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret