Function at 0x405e48
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
test eax, eax
jns 0x405e64
mov ecx, dword [0x44fccc]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x453d38]
mov edx, 0x44bca0
push ebx
push ebp
mov ebp, dword [esp + 0x28]
lea ebx, [eax + ecx]
push edi
mov edi, edx
cmp ebp, edx
jb 0x405e92
mov eax, ebp
sub eax, edx
cmp eax, 0x4000
jae 0x405e92
mov edi, ebp
xor ebp, ebp
mov dword [esp + 0x2c], ebp
mov cl, byte [ebx]
test cl, cl
je 0x406093
push esi
mov eax, edi
sub eax, edx
cmp eax, 0x2000
jge 0x40608e
inc ebx
cmp cl, 4
jae 0x406077
movsx ebp, byte [ebx + 1]
movsx edx, byte [ebx]
mov esi, ebp
and esi, 0x7f
mov dword [esp + 0x14], ebp
mov eax, edx
shl esi, 7
and eax, 0x7f
mov dword [esp + 0x20], edx
or esi, eax
mov dword [esp + 0x28], ebp
mov eax, edx
add ebx, 2
or eax, 0x8000
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov eax, ebp
or eax, 0x8000
mov dword [esp + 0x24], eax
cmp cl, 2
jne 0x406020
mov eax, dword [0x453d00]
test eax, eax
jns 0x405f1f
mov ecx, 0x5a04
cmp ax, cx
je 0x405f1f
cmp ebp, 0x23
je 0x405f1f
cmp ebp, 0x2e
je 0x405f1f
xor eax, eax
jmp 0x405f22
xor eax, eax
inc eax
cmp dword [0x453dc4], 0
push 2
pop ebx
push 4
mov dword [esp + 0x38], eax
pop eax
cmovne ebx, eax
test dl, dl
jns 0x405f6f
mov eax, edx
and edx, 0x3f
add edx, dword [0x453d38]
and eax, 0x40
push eax
push edi
push edx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00406b1c
cmp byte [edi], 0
jne 0x406003
push ebp
push edi
call fcn.00405e48
jmp 0x405ffe
cmp edx, 0x25
jne 0x405f82
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405ffe
cmp edx, 0x24
jne 0x405f95
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor ebx, ebx
test ebx, ebx
je 0x405ffe
mov ebp, dword [esp + 0x34]
mov eax, dword [0x453d04]
dec ebx
test eax, eax
je 0x405fc0
test ebp, ebp
je 0x405fc0
push edi
push 0
push 0
push dword [esp + ebx*4 + 0x28]
push dword [0x44fcf4]
call eax
test eax, eax
je 0x405ffa
lea eax, [esp + 0x10]
push eax
push dword [esp + ebx*4 + 0x20]
push dword [0x44fcf4]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x405ff3
push edi
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405ffa
mov byte [edi], 0
test ebx, ebx
jne 0x405f9d
mov ebp, dword [esp + 0x14]
cmp byte [edi], 0
je 0x406014
cmp ebp, 0x1a
jne 0x406014
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.00406e43
mov ebx, dword [esp + 0x18]
jmp 0x406067
cmp cl, 3
jne 0x406059
cmp esi, 0x1d
jne 0x406038
push dword [0x44fcf4]
push edi
call fcn.0040668a
jmp 0x406049
mov eax, esi
shl eax, 0xd
add eax, section..ndata
push eax
push edi
call fcn.00406cb4
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x406067
push edi
call fcn.00406e43
jmp 0x406067
cmp cl, 1
jne 0x406067
not esi
push esi
push edi
call fcn.00405e48
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
mov edx, 0x44bca0
jmp 0x406084
jne 0x406081
mov al, byte [ebx]
mov byte [edi], al
inc edi
inc ebx
jmp 0x406084
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
jne 0x405e9d
mov ebp, dword [esp + 0x30]
pop esi
mov byte [edi], 0
test ebp, ebp
je 0x4060a3
push edx
push ebp
call fcn.00406cb4
jmp 0x4060a5
mov eax, edx
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret 8