Function at 0x43fed8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2718
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, str.RecoverXDMPasswords
push ebx
push 0x66c4b8
call fcn.00449974
push esi
call fcn.00631510
add esp, 0xc
xor ecx, ecx
cmp eax, 1
lea eax, [ebp - 0x3ec]
jae 0x43ff55
push eax
push ecx
push ecx
push 0x28
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jns 0x43ff3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._s_Failed_to_find_appdata_folder__Error0x_.8x
jmp 0x440191
push str..xdman.credentials
mov esi, 0x3e8
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00631246
jmp 0x43ff62
push esi
mov esi, 0x3e8
push esi
push eax
call fcn.006311ec
add esp, 0xc
lea eax, [ebp - 0x3ec]
push eax
push ebx
push str._s_Final_XDM_pass_file_path_is__s
call fcn.00449974
and dword [ebp - 0x2718], 0
lea eax, [ebp - 0x3ec]
push 0x66ca20
push eax
lea eax, [ebp - 0x2718]
push eax
call fcn.00632119
add esp, 0x18
test eax, eax
jne 0x440184
cmp dword [ebp - 0x2718], eax
je 0x440184
push dword [ebp - 0x2718]
lea eax, [ebp - 0x2714]
push 0x1388
push eax
call fcn.00631f4f
add esp, 0xc
test eax, eax
je 0x440173
push edi
lea eax, [ebp - 0x2714]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x440019
lea eax, [ebp - 0x2714]
push eax
call fcn.00631510
pop ecx
cmp byte [ebp + eax - 0x2715], 0xa
jne 0x440019
lea eax, [ebp - 0x2714]
push eax
call fcn.00631510
dec eax
pop ecx
cmp eax, 0x1388
jae 0x4401a9
mov byte [ebp + eax - 0x2714], 0
lea eax, [ebp - 0x2714]
push eax
push eax
call fcn.00631510
pop ecx
push eax
push ebx
push str._n_n_s__Found_line___d___s
call fcn.00449974
xor eax, eax
mov byte [ebp - 0xbbc], al
mov byte [ebp - 0xfa4], al
mov byte [ebp - 0x138c], al
lea eax, [ebp - 0x7d4]
push esi
push eax
lea eax, [ebp - 0x2714]
push eax
call fcn.00445e29
add esp, 0x1c
test eax, eax
jne 0x44007c
lea eax, [ebp - 0x2714]
push eax
push ebx
push str._s:_DecodeBase64Data_failed_to_decode_input_data__s
call fcn.00449974
add esp, 0xc
jmp 0x440150
push ebx
push str._s_Successfully_decoded_base64_data
call fcn.00449974
lea eax, [ebp - 0x7d4]
push 0xa
push eax
call fcn.006270b0
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0x7d4]
push eax
test edi, edi
jne 0x4400ad
push ebx
push str._s:_Hostname_not_found_in_line__s
jmp 0x44006f
lea eax, [ebp - 0x138c]
mov byte [edi], 0
push esi
push eax
call fcn.006311ec
inc edi
push 0xa
push edi
call fcn.006270b0
add esp, 0x14
mov ebx, eax
push edi
test ebx, ebx
jne 0x4400dd
mov ebx, str.RecoverXDMPasswords
push ebx
push str._s:_Username_not_found_in_line__s
jmp 0x44006f
lea eax, [ebp - 0xfa4]
mov byte [ebx], 0
push esi
push eax
call fcn.006311ec
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0xbbc]
push esi
push eax
call fcn.006311ec
lea eax, [ebp - 0xbbc]
mov ebx, str.RecoverXDMPasswords
push eax
lea eax, [ebp - 0xfa4]
push eax
lea eax, [ebp - 0x138c]
push eax
push ebx
push str._s___Found_Xtreme_Downloader_account__Host_s__user_s__pass_s
call fcn.00449974
push 0xffffffffffffffff
mov edi, 0x66ae5d
lea eax, [ebp - 0xbbc]
push edi
push eax
lea eax, [ebp - 0xfa4]
push eax
lea eax, [ebp - 0x138c]
push eax
push edi
push 0x8e
push 5
call fcn.00412c85
add esp, 0x4c
push dword [ebp - 0x2718]
lea eax, [ebp - 0x2714]
push 0x1388
push eax
call fcn.00631f4f
add esp, 0xc
test eax, eax
jne 0x43ffd0
pop edi
push dword [ebp - 0x2718]
call fcn.00637603
xor eax, eax
pop ecx
inc eax
jmp 0x44019b
lea eax, [ebp - 0x3ec]
push eax
push ebx
push str._s_Unable_to_open_XDM_credentials_file_:__s
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3