Function at 0x4195fc
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x15f8]
mov eax, 0x1678
call fcn.0042c290
mov eax, dword [0x4546e0]
xor eax, ebp
mov dword [ebp + 0x15f4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp + 0x1a6]
push ebx
push eax
mov word [ebp + 0x1a4], bx
call fcn.0042b8b0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push ebx
push 0x10
lea eax, [ebp + 0x1a4]
push eax
push ebx
call esi
push edi
lea eax, [ebp + 0xbce]
push ebx
push eax
mov word [ebp + 0xbcc], bx
call fcn.0042b8b0
add esp, 0xc
push 1
push 2
lea eax, [ebp + 0xbcc]
push eax
push ebx
call esi
push edi
lea eax, [ebp + 0x9c6]
push ebx
push eax
mov word [ebp + 0x9c4], bx
call fcn.0042b8b0
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp + 0x9c4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4471bc
push 2
lea eax, [ebp + 0x9c4]
push 0x5c
push eax
call fcn.0042e95d
pop ecx
pop ecx
push eax
call fcn.0042b9b3
push edi
lea eax, [ebp + 0x7be]
push ebx
push eax
mov word [ebp + 0x7bc], bx
call fcn.0042b8b0
lea eax, [ebp + 0x9c4]
push eax
lea eax, [ebp + 0x7bc]
push esi
push eax
call fcn.0042b9b3
push str.kwsmain.exe
lea eax, [ebp + 0x7bc]
push esi
push eax
call fcn.0042b939
push edi
lea eax, [ebp + 0x5b6]
push ebx
push eax
mov word [ebp + 0x5b4], bx
call fcn.0042b8b0
lea eax, [ebp + 0x9c4]
push eax
push esi
lea eax, [ebp + 0x5b4]
push eax
call fcn.0042b9b3
add esp, 0x48
push str.KWSUpd.exe
lea eax, [ebp + 0x5b4]
push esi
push eax
call fcn.0042b939
push edi
lea eax, [ebp + 0x3ae]
push ebx
push eax
mov word [ebp + 0x3ac], bx
call fcn.0042b8b0
lea eax, [ebp + 0x9c4]
push eax
lea eax, [ebp + 0x3ac]
push esi
push eax
call fcn.0042b9b3
push str.kwsinst.exe
lea eax, [ebp + 0x3ac]
push esi
push eax
call fcn.0042b939
add esp, 0x30
call fcn.0041a3b3
test eax, eax
push edi
push ebx
je 0x419877
lea eax, [ebp + 0xdd6]
push eax
mov word [ebp + 0xdd4], bx
call fcn.0042b8b0
add esp, 0xc
push esi
lea eax, [ebp + 0xdd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
lea eax, [ebp + 0xfde]
push ebx
push eax
mov word [ebp + 0xfdc], bx
call fcn.0042b8b0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0xdd4]
push eax
call fcn.004310d1
push str.UsersPublicDesktop
lea eax, [ebp + 0xfdc]
push esi
push eax
call fcn.0042b939
push edi
lea eax, [ebp + 0x11e6]
push ebx
push eax
mov word [ebp + 0x11e4], bx
call fcn.0042b8b0
add esp, 0x48
push edi
lea eax, [ebp + 0x13ee]
push ebx
push eax
mov word [ebp + 0x13ec], bx
call fcn.0042b8b0
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0x11e4]
push esi
push eax
call fcn.0042b9b3
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0x13ec]
push esi
push eax
call fcn.0042b9b3
push 0x44993c
lea eax, [ebp + 0x13ec]
push esi
push eax
call fcn.0042b939
push 0x449928
lea eax, [ebp + 0x11e4]
push esi
push eax
call fcn.0042b939
lea eax, [ebp + 0x13ec]
push eax
call fcn.0040b0fd
add esp, 0x40
jmp 0x4198fb
lea eax, [ebp + 0x11e6]
push eax
mov word [ebp + 0x11e4], bx
call fcn.0042b8b0
push edi
lea eax, [ebp + 0x13ee]
push ebx
push eax
mov word [ebp + 0x13ec], bx
call fcn.0042b8b0
lea eax, [ebp + 0x1a4]
push eax
lea eax, [ebp + 0x11e4]
push esi
push eax
call fcn.0042b9b3
lea eax, [ebp + 0x1a4]
push eax
lea eax, [ebp + 0x13ec]
push esi
push eax
call fcn.0042b9b3
push 0x449928
lea eax, [ebp + 0x11e4]
push esi
push eax
call fcn.0042b939
push 0x44993c
lea eax, [ebp + 0x13ec]
push esi
push eax
call fcn.0042b939
add esp, 0x48
lea eax, [ebp + 0x13ec]
push eax
call fcn.0040b0fd
pop ecx
test eax, eax
je 0x419913
lea eax, [ebp + 0x11e4]
push eax
lea eax, [ebp + 0x13ec]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dword [0x455b00], ebx
jne 0x419ac9
push edi
lea eax, [ebp + 0x11e6]
push ebx
push eax
mov word [ebp + 0x11e4], bx
call fcn.0042b8b0
push edi
lea eax, [ebp + 0x13ee]
push ebx
push eax
mov word [ebp + 0x13ec], bx
call fcn.0042b8b0
lea eax, [ebp + 0xbcc]
push eax
lea eax, [ebp + 0x11e4]
push esi
push eax
call fcn.0042b9b3
lea eax, [ebp + 0xbcc]
push eax
lea eax, [ebp + 0x13ec]
push esi
push eax
call fcn.0042b9b3
push 0x449904
lea eax, [ebp + 0x11e4]
push esi
push eax
call fcn.0042b939
push 0x449914
lea eax, [ebp + 0x13ec]
push esi
push eax
call fcn.0042b939
lea eax, [ebp + 0x11e4]
add esp, 0x48
push eax
call fcn.0040b2bf
pop ecx
lea eax, [ebp + 0x13ec]
push eax
lea ecx, [ebp - 0x80]
call fcn.004040fd
lea eax, [ebp - 0x80]
push eax
call fcn.00418b90
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00401f6b
push edi
lea eax, [ebp + 0xfde]
push ebx
push eax
mov word [ebp + 0xfdc], bx
call fcn.0042b8b0
lea eax, [ebp + 0xbcc]
push eax
lea eax, [ebp + 0xfdc]
push esi
push eax
call fcn.0042b9b3
push 0x4498bc
lea eax, [ebp + 0xfdc]
push esi
push eax
call fcn.0042b939
push ebx
lea eax, [ebp + 0x7bc]
push eax
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0x7bc]
push eax
call fcn.0041789e
push edi
push ebx
lea eax, [ebp - 0x62]
mov word [ebp - 0x64], bx
push eax
call fcn.0042b8b0
add esp, 0x40
lea eax, [ebp + 0xbcc]
push eax
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0042b9b3
push 0x449878
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0042b939
push ebx
lea eax, [ebp + 0x5b4]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x5b4]
push eax
call fcn.0041789e
push edi
lea eax, [ebp + 0xdd6]
push ebx
push eax
mov word [ebp + 0xdd4], bx
call fcn.0042b8b0
lea eax, [ebp + 0xbcc]
push eax
lea eax, [ebp + 0xdd4]
push esi
push eax
call fcn.0042b9b3
add esp, 0x40
push 0x449834
lea eax, [ebp + 0xdd4]
push esi
push eax
call fcn.0042b939
push str._u__uc
lea eax, [ebp + 0x3ac]
push eax
lea eax, [ebp + 0xdd4]
push eax
lea eax, [ebp + 0x3ac]
push eax
call fcn.0041789e
add esp, 0x1c
mov ecx, dword [ebp + 0x15f4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0042b92a
add ebp, 0x15f8
leave
ret