Function at 0x408800
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x4d3040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebp + 8]
push 0
push 3
mov dword [ebp - 0x444], ebx
call fcn.00413a5f
mov ecx, dword [ebx + 4]
add esp, 8
mov esi, eax
cmp dword [ecx - 0xc], 0
jne 0x40889f
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00484a20
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.XinZhiZao_
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408880
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebx + 4]
call fcn.00407810
mov eax, dword [ebx + 4]
cmp dword [eax - 4], 1
jle 0x4088b3
push dword [eax - 0xc]
lea ecx, [ebx + 4]
call fcn.00407a30
sub esp, 0x10
mov ecx, esp
push dword [ebx + 4]
call fcn.00409a20
call fcn.00408370
add esp, 0x10
test al, al
jne 0x408ba1
mov eax, dword [ebx + 8]
cmp dword [eax - 0xc], 0
jne 0x4088ed
push 0x10
push 0x4ac680
push 0x4ac688
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test esi, esi
je 0x408900
cmp dword [esi], 1
je 0x408915
mov dword [0x4d67ec], 0x80000
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820f4
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [esi + 4]
mov dword [ebp - 0x44c], ebx
cmp dword [ebx + 4], 0xffffffff
je 0x408a59
mov eax, dword [ebx]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x408a59
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x408a59
mov ecx, dword [eax]
test ecx, ecx
je 0x40895e
push ecx
call fcn.004886fc
mov eax, dword [ebp - 0x448]
add esp, 4
cmp dword [eax + 0x40], 0
mov dword [eax], 0
je 0x408a3c
lea edi, [eax + 4]
test edi, edi
je 0x408a3c
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x408a3c
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x408a3c
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x408a1b
mov eax, dword [ebx]
cmp eax, 4
je 0x4089a6
cmp eax, 5
jne 0x4089b4
push dword [ebx + 0xc]
push dword [edi + 0x28]
call ecx
mov ecx, dword [edi + 0x24]
add esp, 8
cmp dword [ebx], 6
jne 0x4089c4
push dword [ebx + 4]
push dword [edi + 0x28]
call ecx
add esp, 8
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
test eax, eax
je 0x4089f9
push 0
push 0
push 0
call eax
mov dword [ebx + 0x3c], eax
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebx + 0x28]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
push dword [ebx + 0x24]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov eax, dword [edi + 0x24]
push ebx
push dword [edi + 0x28]
call eax
add esp, 0x18
push dword [edi + 0x1c]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov ebx, dword [ebp - 0x44c]
add esp, 8
mov eax, dword [ebp - 0x448]
mov dword [edi + 0x1c], 0
push eax
mov dword [eax + 0x40], 0
call fcn.004886fc
mov eax, dword [ebp - 0x444]
add esp, 4
mov dword [eax + 0x7c], 0
mov eax, dword [ebx]
mov dword [ebx + 4], 0xffffffff
mov dword [ebp - 0x444], eax
test eax, eax
je 0x40901f
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x408b96
mov ecx, dword [eax]
test ecx, ecx
je 0x408a96
push ecx
call fcn.004886fc
mov eax, dword [ebp - 0x448]
add esp, 4
cmp dword [eax + 0x40], 0
mov dword [eax], 0
je 0x408b74
lea edi, [eax + 4]
test edi, edi
je 0x408b74
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x408b74
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x408b74
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x408b53
mov eax, dword [ebx]
cmp eax, 4
je 0x408ade
cmp eax, 5
jne 0x408aec
push dword [ebx + 0xc]
push dword [edi + 0x28]
call ecx
mov ecx, dword [edi + 0x24]
add esp, 8
cmp dword [ebx], 6
jne 0x408afc
push dword [ebx + 4]
push dword [edi + 0x28]
call ecx
add esp, 8
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
test eax, eax
je 0x408b31
push 0
push 0
push 0
call eax
mov dword [ebx + 0x3c], eax
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebx + 0x28]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
push dword [ebx + 0x24]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov eax, dword [edi + 0x24]
push ebx
push dword [edi + 0x28]
call eax
add esp, 0x18
push dword [edi + 0x1c]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov ebx, dword [ebp - 0x44c]
add esp, 8
mov eax, dword [ebp - 0x448]
mov dword [edi + 0x1c], 0
push eax
mov dword [eax + 0x40], 0
call fcn.004886fc
mov edi, dword [ebp - 0x444]
add esp, 4
mov dword [edi + 0x7c], 0
jmp 0x408fea
mov edi, dword [ebp - 0x444]
jmp 0x408fea
test esi, esi
je 0x408900
push 0x226
lea eax, [ebp - 0x43a]
push 0
push eax
call fcn.00484a20
add esp, 0xc
cmp dword [esi], 1
je 0x408bcb
mov eax, 0x80000
jmp 0x408c39
mov ebx, dword [esi + 4]
mov ecx, dword [ebp - 0x444]
lea edi, [ebx + 0x244]
mov ecx, dword [ecx + 4]
mov edx, edi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x408be0
lea ecx, [ebx + 0x244]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408c00
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x408c37
cmp eax, 0x2f
je 0x408c37
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x408c24
mov eax, dword [0x4ac5e8]
mov dword [edi], eax
xor eax, eax
mov dword [0x4d67ec], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x440], ebx
cmp dword [esi], 1
mov word [ebp - 0x43c], ax
mov dword [ebp - 0x214], eax
je 0x408c61
mov eax, 0x80000
jmp 0x408c78
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x440]
push eax
push 0xffffffffffffffff
call fcn.00412f9e
mov ebx, dword [ebp - 0x440]
xor edi, edi
mov dword [0x4d67ec], eax
test ebx, ebx
jle 0x408cf9
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x440], 0
cmp dword [esi], 1
mov word [ebp - 0x43c], ax
mov dword [ebp - 0x214], eax
je 0x408cba
mov dword [0x4d67ec], 0x80000
jmp 0x408cf4
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x440]
push eax
push edi
call fcn.00412f9e
mov dword [0x4d67ec], eax
test eax, eax
jne 0x408cf4
cmp dword [esi], 1
jne 0x408d53
mov ecx, dword [esi + 4]
push 2
push eax
lea eax, [ebp - 0x43c]
push eax
push edi
call fcn.00413686
mov dword [0x4d67ec], eax
test eax, eax
jne 0x408d5d
inc edi
cmp edi, ebx
jl 0x408c90
mov ebx, dword [ebp - 0x444]
mov ecx, ebx
call fcn.00407990
mov eax, dword [ebx + 4]
cmp dword [eax - 4], 1
jle 0x408d1a
push dword [eax - 0xc]
lea ecx, [ebx + 4]
call fcn.00407a30
push dword [ebx + 4]
push str._sXinZhiZao.exe
push ebx
call fcn.00409a00
add esp, 0xc
cmp dword [esi], 1
je 0x409084
mov dword [0x4d67ec], 0x80000
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004820f4
mov esp, ebp
pop ebp
ret 8
mov dword [0x4d67ec], 0x80000
cmp dword [esi], 1
jne 0x4088f6
mov ebx, dword [esi + 4]
mov dword [ebp - 0x44c], ebx
cmp dword [ebx + 4], 0xffffffff
je 0x408eaa
mov eax, dword [ebx]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x408eaa
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x408eaa
mov ecx, dword [eax]
test ecx, ecx
je 0x408daf
push ecx
call fcn.004886fc
mov eax, dword [ebp - 0x444]
add esp, 4
cmp dword [eax + 0x40], 0
mov dword [eax], 0
je 0x408e8d
lea edi, [eax + 4]
test edi, edi
je 0x408e8d
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x408e8d
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x408e8d
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x408e6c
mov eax, dword [ebx]
cmp eax, 4
je 0x408df7
cmp eax, 5
jne 0x408e05
push dword [ebx + 0xc]
push dword [edi + 0x28]
call ecx
mov ecx, dword [edi + 0x24]
add esp, 8
cmp dword [ebx], 6
jne 0x408e15
push dword [ebx + 4]
push dword [edi + 0x28]
call ecx
add esp, 8
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
test eax, eax
je 0x408e4a
push 0
push 0
push 0
call eax
mov dword [ebx + 0x3c], eax
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebx + 0x28]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
push dword [ebx + 0x24]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov eax, dword [edi + 0x24]
push ebx
push dword [edi + 0x28]
call eax
add esp, 0x18
push dword [edi + 0x1c]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov ebx, dword [ebp - 0x44c]
add esp, 8
mov eax, dword [ebp - 0x444]
mov dword [edi + 0x1c], 0
push eax
mov dword [eax + 0x40], 0
call fcn.004886fc
mov eax, dword [ebp - 0x448]
add esp, 4
mov dword [eax + 0x7c], 0
mov eax, dword [ebx]
mov dword [ebx + 4], 0xffffffff
mov dword [ebp - 0x448], eax
test eax, eax
je 0x40901f
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x408fe4
mov ecx, dword [eax]
test ecx, ecx
je 0x408ee7
push ecx
call fcn.004886fc
mov eax, dword [ebp - 0x444]
add esp, 4
cmp dword [eax + 0x40], 0
mov dword [eax], 0
je 0x408fc5
lea edi, [eax + 4]
test edi, edi
je 0x408fc5
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x408fc5
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x408fc5
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x408fa4
mov eax, dword [ebx]
cmp eax, 4
je 0x408f2f
cmp eax, 5
jne 0x408f3d
push dword [ebx + 0xc]
push dword [edi + 0x28]
call ecx
mov ecx, dword [edi + 0x24]
add esp, 8
cmp dword [ebx], 6
jne 0x408f4d
push dword [ebx + 4]
push dword [edi + 0x28]
call ecx
add esp, 8
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
test eax, eax
je 0x408f82
push 0
push 0
push 0
call eax
mov dword [ebx + 0x3c], eax
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebx + 0x28]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
push dword [ebx + 0x24]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov eax, dword [edi + 0x24]
push ebx
push dword [edi + 0x28]
call eax
add esp, 0x18
push dword [edi + 0x1c]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov ebx, dword [ebp - 0x44c]
add esp, 8
mov eax, dword [ebp - 0x444]
mov dword [edi + 0x1c], 0
push eax
mov dword [eax + 0x40], 0
call fcn.004886fc
mov edi, dword [ebp - 0x448]
add esp, 4
mov dword [edi + 0x7c], 0
jmp 0x408fea
mov edi, dword [ebp - 0x448]
mov eax, dword [edi]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x409016
cmp byte [eax + 0x10], 0
je 0x40900b
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x444]
push 0x20
push eax
call fcn.00482334
add esp, 8
push edi
call fcn.004886fc
add esp, 4
mov eax, dword [ebx + 0x23c]
mov dword [0x4d67ec], 0
mov dword [ebx], 0
test eax, eax
je 0x409042
push eax
call fcn.00482102
add esp, 4
mov eax, dword [ebx + 0x240]
mov dword [ebx + 0x23c], 0
test eax, eax
je 0x40905f
push eax
call fcn.00482102
add esp, 4
push 0x44c
push ebx
mov dword [ebx + 0x240], 0
call fcn.00482334
push 8
push esi
call fcn.00482334
add esp, 0x10
jmp 0x408900
mov ebx, dword [esi + 4]
mov dword [ebp - 0x44c], ebx
cmp dword [ebx + 4], 0xffffffff
je 0x4091c8
mov eax, dword [ebx]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x4091c8
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x4091c8
mov ecx, dword [eax]
test ecx, ecx
je 0x4090cd
push ecx
call fcn.004886fc
mov eax, dword [ebp - 0x444]
add esp, 4
cmp dword [eax + 0x40], 0
mov dword [eax], 0
je 0x4091ab
lea edi, [eax + 4]
test edi, edi
je 0x4091ab
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x4091ab
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x4091ab
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x40918a
mov eax, dword [ebx]
cmp eax, 4
je 0x409115
cmp eax, 5
jne 0x409123
push dword [ebx + 0xc]
push dword [edi + 0x28]
call ecx
mov ecx, dword [edi + 0x24]
add esp, 8
cmp dword [ebx], 6
jne 0x409133
push dword [ebx + 4]
push dword [edi + 0x28]
call ecx
add esp, 8
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
test eax, eax
je 0x409168
push 0
push 0
push 0
call eax
mov dword [ebx + 0x3c], eax
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebx + 0x28]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
push dword [ebx + 0x24]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov eax, dword [edi + 0x24]
push ebx
push dword [edi + 0x28]
call eax
add esp, 0x18
push dword [edi + 0x1c]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov ebx, dword [ebp - 0x44c]
add esp, 8
mov eax, dword [ebp - 0x444]
mov dword [edi + 0x1c], 0
push eax
mov dword [eax + 0x40], 0
call fcn.004886fc
mov eax, dword [ebp - 0x448]
add esp, 4
mov dword [eax + 0x7c], 0
mov eax, dword [ebx]
mov dword [ebx + 4], 0xffffffff
mov dword [ebp - 0x448], eax
test eax, eax
je 0x40933d
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x409302
mov ecx, dword [eax]
test ecx, ecx
je 0x409205
push ecx
call fcn.004886fc
mov eax, dword [ebp - 0x444]
add esp, 4
cmp dword [eax + 0x40], 0
mov dword [eax], 0
je 0x4092e3
lea edi, [eax + 4]
test edi, edi
je 0x4092e3
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x4092e3
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x4092e3
mov ebx, dword [edx + 0x14]
test ebx, ebx
je 0x4092c2
mov eax, dword [ebx]
cmp eax, 4
je 0x40924d
cmp eax, 5
jne 0x40925b
push dword [ebx + 0xc]
push dword [edi + 0x28]
call ecx
mov ecx, dword [edi + 0x24]
add esp, 8
cmp dword [ebx], 6
jne 0x40926b
push dword [ebx + 4]
push dword [edi + 0x28]
call ecx
add esp, 8
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
test eax, eax
je 0x4092a0
push 0
push 0
push 0
call eax
mov dword [ebx + 0x3c], eax
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebx + 0x28]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
push dword [ebx + 0x24]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov eax, dword [edi + 0x24]
push ebx
push dword [edi + 0x28]
call eax
add esp, 0x18
push dword [edi + 0x1c]
mov eax, dword [edi + 0x24]
push dword [edi + 0x28]
call eax
mov ebx, dword [ebp - 0x44c]
add esp, 8
mov eax, dword [ebp - 0x444]
mov dword [edi + 0x1c], 0
push eax
mov dword [eax + 0x40], 0
call fcn.004886fc
mov edi, dword [ebp - 0x448]
add esp, 4
mov dword [edi + 0x7c], 0
jmp 0x409308
mov edi, dword [ebp - 0x448]
mov eax, dword [edi]
mov dword [ebp - 0x444], eax
test eax, eax
je 0x409334
cmp byte [eax + 0x10], 0
je 0x409329
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x444]
push 0x20
push eax
call fcn.00482334
add esp, 8
push edi
call fcn.004886fc
add esp, 4
mov eax, dword [ebx + 0x23c]
mov dword [ebx], 0
mov dword [0x4d67ec], 0
test eax, eax
je 0x409360
push eax
call fcn.00482102
add esp, 4
mov eax, dword [ebx + 0x240]
mov dword [ebx + 0x23c], 0
test eax, eax
je 0x40937d
push eax
call fcn.00482102
add esp, 4
push 0x44c
push ebx
mov dword [ebx + 0x240], 0
call fcn.00482334
push 8
push esi
call fcn.00482334
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.004820f4
mov esp, ebp
pop ebp
ret 8