Function at 0x41393c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
cmp ax, word [0x768498]
jne 0x413961
call fcn.00413cb1
jmp 0x413966
mov eax, 0x768498
push eax
lea ecx, [ebp - 0x34]
call fcn.004058f0
xor eax, eax
xor esi, esi
mov ebx, 0x7686a0
cmp ax, word [0x7686a0]
jne 0x4139a5
push esi
push 0x25
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x41398f
push 9
pop ecx
mov esi, str.LaunchWinApp.exe
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004058f0
mov eax, dword [ebp - 0x34]
push 8
pop esi
cmp dword [ebp - 0x20], esi
jae 0x4139bc
lea eax, [ebp - 0x34]
push eax
mov ebx, str.IE.FTP
mov edi, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
push ebx
push edi
push 0x541834
call fcn.00413760
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], esi
jae 0x4139de
lea eax, [ebp - 0x1c]
push eax
push str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
push edi
push 0x541160
call fcn.00413760
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], esi
jae 0x4139fa
lea eax, [ebp - 0x1c]
push eax
push str.AppX90nv6nhay5n6a98fnetv7tpk64pp35es
push edi
push 0x54183c
call fcn.00413760
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x20], esi
jae 0x413a16
lea eax, [ebp - 0x34]
push eax
push ebx
mov edi, str.SOFTWAREMicrosoftWindowsRoamingOpenWithUrlAssociations_
push edi
push 0x541834
call fcn.00413760
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], esi
jae 0x413a33
lea eax, [ebp - 0x1c]
push eax
push str.AppXq0fevzme2pys62n3e0fbqa7peapykr8v
push edi
push 0x541160
call fcn.00413760
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], esi
jae 0x413a4f
lea eax, [ebp - 0x1c]
push eax
push str.AppX90nv6nhay5n6a98fnetv7tpk64pp35es
push edi
push 0x54183c
call fcn.00413760
mov ebx, str.AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
push ebx
push esi
push str..htm
call fcn.0041384f
push ebx
push esi
push str..html
call fcn.0041384f
mov ebx, str.IE.AssocFile.HTM
push ebx
push esi
push str..shtm
call fcn.0041384f
push ebx
push esi
push str..shtml
call fcn.0041384f
mov ebx, str.IE.AssocFile.MHT
push ebx
push esi
push str..mht
call fcn.0041384f
push ebx
push esi
push str..mhtml
call fcn.0041384f
push ebx
push esi
push str..mhtm
call fcn.0041384f
mov edi, str.IE.AssocFile.XHT
mov ebx, str..xht
push edi
push esi
push ebx
call fcn.0041384f
push edi
push esi
mov edi, str..xhtml
push edi
call fcn.0041384f
push str.AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9
mov esi, str.SOFTWAREMicrosoftWindowsRoamingOpenWithFileExts_
push esi
push str..htm
call fcn.0041384f
push str.AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9
push esi
push str..html
call fcn.0041384f
push str.IE.AssocFile.HTM
push esi
push str..shtm
call fcn.0041384f
push str.IE.AssocFile.HTM
push esi
push str..shtml
call fcn.0041384f
push str.IE.AssocFile.MHT
push esi
push str..mht
call fcn.0041384f
push str.IE.AssocFile.MHT
push esi
push str..mhtml
call fcn.0041384f
push str.IE.AssocFile.MHT
push esi
push str..mhtm
call fcn.0041384f
push str.IE.AssocFile.XHT
push esi
push ebx
call fcn.0041384f
push str.IE.AssocFile.XHT
push esi
push edi
call fcn.0041384f
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040536f
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.0040536f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret