Function at 0x420cf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x597130
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x60f520]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [ebp + 0xc]
movzx esi, ax
sub esi, 0x4650
jns 0x420d45
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x50], 0
call fcn.00422a80
mov ecx, dword [eax + 8]
sub ecx, dword [eax + 4]
lea edi, [eax + 4]
test ecx, 0xffffffe0
jne 0x420d82
mov ecx, eax
call fcn.00467e00
push edi
lea ecx, [esp + 0x3c]
call fcn.00468fc0
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
sub eax, edi
sar eax, 5
cmp esi, eax
jl 0x420dbf
lea ecx, [esp + 0x38]
xor esi, esi
call fcn.00422ad0
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x420ddb
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
shl esi, 5
mov byte [esp + 0x50], 1
lea ebx, [esi + edi]
or edi, 0xffffffff
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0xc]
mov dword [esp + 0x24], ebx
cmp dword [eax - 0xc], 0
jne 0x420e58
push 0x3889
lea ecx, [esp + 0x24]
call fcn.0040c2d0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 2
call fcn.0040b7d0
mov byte [esp + 0x50], 1
mov ecx, edi
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x420e46
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x1c]
push dword [eax - 0xc]
push eax
call fcn.00411f30
jmp 0x420e62
push ecx
lea ecx, [esp + 0x20]
call fcn.0040b7d0
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x420e7e
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
mov eax, 0x4d2
mov byte [esp + 0x50], 3
cmp word [ebp + 8], ax
jne 0x420eae
push dword [ebp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0040b7d0
mov esi, dword [esp + 0x18]
jmp 0x420f07
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x420ed4
push 0x104
lea ecx, [esp + 0x1c]
call fcn.0040c110
mov esi, dword [esp + 0x18]
push 0
push 0x10
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [esi - 8]
push esi
call fcn.00551cd2
add esp, 8
test eax, eax
js 0x421100
cmp eax, dword [esi - 8]
jg 0x421100
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x420f23
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x50], 4
lea eax, [esp + 0x20]
mov ebx, dword [esp + 0x1c]
push ebx
push esi
push 0x5bc4f0
push eax
call fcn.00422de0
add esp, 0x10
call fcn.0040bce0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x420f6a
push 0x80004005
call fcn.0040c390
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
push dword [esp + 0x24]
lea edx, [esp + 0x24]
mov byte [esp + 0x54], 5
lea ecx, [esp + 0x2c]
call fcn.004240d0
add esp, 4
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 6
call fcn.0040b7d0
mov byte [esp + 0x50], 5
mov ecx, edi
mov edx, dword [esp + 0x28]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x420fc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x14]
mov eax, dword [edi]
push dword [eax - 0xc]
push eax
call fcn.00411f30
call fcn.00409c60
lea ecx, [eax + 0x350]
lea eax, [esp + 0x14]
push eax
call fcn.0040b7d0
call fcn.00422a80
push edi
lea eax, [esp + 0x18]
push eax
call fcn.00468c50
mov edi, dword [esp + 0x14]
mov dword [esp + 0x24], eax
test eax, eax
je 0x42105f
push 1
call fcn.00422b20
mov ecx, eax
call fcn.00484d30
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
call dword [eax + 0x13c]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x30]
push eax
push ecx
lea ecx, [edi - 0x10]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x30], esp
mov dword [esp + 0x34], esp
call fcn.0040c3c0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
mov byte [esp + 0x58], 7
call fcn.00422b20
mov ecx, eax
mov byte [esp + 0x58], 5
call fcn.00484b80
lea edx, [edi - 0x10]
mov byte [esp + 0x50], 4
or edi, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x421080
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x50], 3
mov ecx, edi
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4210a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [esp + 0x50], 1
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4210c0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [esp + 0x50], 0
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4210dc
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x38]
call fcn.00422ad0
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.0040c390
int3