Function at 0x405bb4
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x1c
test eax, eax
jns 0x405bd0
mov ecx, dword [0x7a2420]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x7a2c78]
mov edx, 0x7a1be0
push ebx
mov ebx, dword [esp + 0x24]
add ecx, eax
push edi
mov edi, edx
cmp ebx, edx
jb 0x405bfc
mov eax, ebx
sub eax, edx
cmp eax, 0x800
jae 0x405bfc
mov edi, ebx
xor ebx, ebx
mov dword [esp + 0x28], ebx
cmp byte [ecx], 0
je 0x405e1f
push ebp
push esi
mov eax, edi
mov ebp, ecx
sub eax, edx
mov dword [esp + 0x18], ebp
cmp eax, 0x400
jge 0x405e19
mov dl, byte [ecx]
cmp dl, 4
jae 0x405df5
movsx ebx, byte [ebp + 2]
movsx ecx, byte [ecx + 1]
mov esi, ebx
and esi, 0x7f
mov dword [esp + 0x14], ebx
mov eax, ecx
shl esi, 7
and eax, 0x7f
mov dword [esp + 0x20], ecx
or esi, eax
mov dword [esp + 0x28], ebx
mov eax, ecx
or eax, 0x8000
mov dword [esp + 0x1c], eax
mov eax, ebx
or eax, 0x8000
mov dword [esp + 0x24], eax
cmp dl, 2
jne 0x405da1
cmp byte [0x7a2d3c], 0
jne 0x405c8e
mov eax, 0x45a
cmp word [0x7a2d3e], ax
jae 0x405c8e
cmp ebx, 0x23
je 0x405c8e
cmp ebx, 0x2e
je 0x405c8e
xor edx, edx
jmp 0x405c91
xor edx, edx
inc edx
cmp dword [0x7a2d04], 0
push 2
pop ebp
push 4
pop eax
cmovne ebp, eax
mov dword [esp + 0x34], edx
test cl, cl
jns 0x405cde
mov eax, ecx
and ecx, 0x3f
add ecx, dword [0x7a2c78]
and eax, 0x40
push eax
push edi
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004065e3
cmp byte [edi], 0
jne 0x405d84
push ebx
push edi
call fcn.00405bb4
jmp 0x405d7f
cmp ecx, 0x25
jne 0x405cf4
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405d7f
cmp ecx, 0x24
jne 0x405d07
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x405d7f
mov eax, dword [esp + ebp*4 + 0x18]
dec ebp
mov ecx, dword [0x7a2430]
and eax, 0xffffffbf
mov esi, eax
mov dword [esp + 0x10], eax
and esi, 0x8000
test ecx, ecx
je 0x405d3b
test edx, edx
je 0x405d3b
push edi
push 0
push 0
push eax
push dword [0x7a2438]
call ecx
test eax, eax
je 0x405d7b
push 7
call fcn.00406552
mov ecx, eax
mov eax, dword [esp + 0x10]
push esi
movzx eax, al
push eax
push dword [0x7a2438]
call ecx
mov ebx, eax
test ebx, ebx
je 0x405d70
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push ebx
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405d7b
mov edx, dword [esp + 0x34]
mov byte [edi], 0
test ebp, ebp
jne 0x405d07
mov ebx, dword [esp + 0x14]
cmp byte [edi], 0
je 0x405d95
cmp ebx, 0x1a
jne 0x405d95
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.0040695a
mov ebp, dword [esp + 0x18]
jmp 0x405de8
cmp dl, 3
jne 0x405dda
cmp esi, 0x1d
jne 0x405db9
push dword [0x7a2438]
push edi
call fcn.00406275
jmp 0x405de8
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00406777
lea eax, [esi - 0x15]
cmp eax, 7
jae 0x405de8
push edi
call fcn.0040695a
jmp 0x405de8
cmp dl, 1
jne 0x405de8
not esi
push esi
push edi
call fcn.00405bb4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
push 3
jmp 0x405dff
jne 0x405e02
mov al, byte [ecx + 1]
mov byte [edi], al
inc edi
push 2
pop eax
jmp 0x405e08
mov byte [edi], dl
xor eax, eax
inc edi
inc eax
lea ecx, [eax + ebp]
mov edx, 0x7a1be0
cmp byte [ecx], 0
jne 0x405c07
mov ebx, dword [esp + 0x30]
pop esi
pop ebp
mov byte [edi], 0
test ebx, ebx
je 0x405e2f
push edx
push ebx
call fcn.00406777
jmp 0x405e31
mov eax, edx
pop edi
pop ebx
add esp, 0x1c
ret 8