Function at 0x438600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x465100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
test eax, eax
jns 0x43862e
mov ecx, dword [0x49cfc0]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x49cf90]
push esi
mov esi, 0x49dfe0
lea eax, [ecx + eax*2]
cmp edx, esi
jb 0x43865b
mov ecx, edx
sub ecx, esi
sar ecx, 1
cmp ecx, 0x4008
jae 0x43865b
mov dword [ebp - 0x1c], 0
mov esi, edx
mov edx, dword [ebp - 0x1c]
movzx ecx, word [eax]
test cx, cx
je 0x4388b7
push ebx
push edi
lea esp, [esp]
mov edi, esi
sub edi, 0x49dfe0
and edi, 0xfffffffe
cmp edi, 0x4008
jge 0x4388b5
movzx ecx, cx
add eax, 2
mov dword [ebp - 0x18], eax
test ecx, 0xe000
je 0x43888b
mov edi, 0xe000
cmp cx, di
jbe 0x43888b
movzx eax, word [eax]
add dword [ebp - 0x18], 2
mov edi, eax
mov ebx, eax
shr eax, 8
and ebx, 0xff
mov dword [ebp - 8], eax
or eax, 0x8000
mov edx, ebx
mov dword [ebp - 0xc], eax
or edx, 0x8000
mov eax, 0xe002
and edi, 0x7fff
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
cmp cx, ax
jne 0x438817
mov edi, 2
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x438718
mov ecx, 0x5a04
cmp ax, cx
je 0x438718
mov eax, dword [ebp - 8]
cmp eax, 0x23
je 0x438718
mov dword [ebp - 0x20], 0
cmp eax, 0x2e
jne 0x43871f
mov dword [ebp - 0x20], 1
cmp dword [0x49cf44], 0
je 0x43872d
mov edi, 4
test bl, bl
jns 0x438786
mov eax, dword [0x49cf90]
mov edx, ebx
and edx, 0x40
push edx
push esi
and ebx, 0x3f
lea ecx, [eax + ebx*2]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call fcn.00437ad0
cmp word [esi], 0
jne 0x438769
mov edx, dword [ebp - 8]
push edx
push esi
call fcn.00438600
cmp word [esi], 0
je 0x43877b
cmp dword [ebp - 8], 0x1a
jne 0x43877b
push str.MicrosoftInternet_ExplorerQuick_Launch
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call fcn.00437c70
jmp 0x438879
cmp ebx, 0x25
jne 0x438799
push 0x2004
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x438763
cmp ebx, 0x24
jne 0x4387ac
push 0x2004
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x438763
test edi, edi
je 0x438763
mov eax, dword [0x4ae810]
dec edi
test eax, eax
je 0x4387d2
cmp dword [ebp - 0x20], 0
je 0x4387d2
mov ecx, dword [ebp + edi*4 - 0x14]
push esi
push 0
push 0
push ecx
push 0
call eax
test eax, eax
je 0x438763
mov eax, dword [ebp + edi*4 - 0x14]
lea edx, [ebp - 0x24]
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x438806
mov ecx, dword [ebp - 0x24]
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [ebp - 0x24]
push edx
mov ebx, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x438763
xor eax, eax
mov word [esi], ax
test edi, edi
jne 0x4387b0
push esi
call fcn.00437c70
jmp 0x438879
mov edx, 0xe001
cmp cx, dx
jne 0x438863
cmp edi, 0x1d
jne 0x438839
push 0
push 0x4545b0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x438853
mov eax, edi
imul eax, eax, 0x4008
push 0x2004
add eax, section..ndata
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
add edi, 0xffffffeb
cmp edi, 7
jae 0x438879
push esi
call fcn.00437c70
jmp 0x438879
mov edx, 0xe003
cmp cx, dx
jne 0x438879
or eax, 0xffffffff
sub eax, edi
push eax
push esi
call fcn.00438600
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x1c]
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x18]
jmp 0x4388a9
mov edi, 0xe000
cmp cx, di
jne 0x4388a3
mov cx, word [eax]
mov word [esi], cx
add esi, 2
add eax, 2
jmp 0x4388a9
mov word [esi], cx
add esi, 2
movzx ecx, word [eax]
test cx, cx
jne 0x438670
pop edi
pop ebx
xor eax, eax
mov word [esi], ax
pop esi
test edx, edx
je 0x4388e2
push 0x2004
push 0x49dfe0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b634
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x49dfe0
call fcn.0043b634
mov esp, ebp
pop ebp
ret 8