Function at 0x425f2e
Capabilities:
Get common file path

Disassembly:
push 0x734
mov eax, 0x4955f1
call fcn.0042e911
mov esi, 0x208
lea eax, [ebp - 0x628]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00475710
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00475710
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00475710
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x628]
add esp, 0x24
push ebx
push 0x19
push eax
push ebx
call esi
push ebx
push 0x17
lea eax, [ebp - 0x218]
push eax
push ebx
call esi
push ebx
push 0x1a
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
test eax, eax
je 0x425fb5
lea eax, [ebp - 0x420]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.0047ccd0
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x704], 7
mov dword [ebp - 0x708], ebx
mov word [ebp - 0x718], ax
cmp word [ebp - 0x628], ax
je 0x425fe4
lea eax, [ebp - 0x628]
push eax
call fcn.00479233
pop ecx
push eax
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x718]
call fcn.0040252a
push 7
xor eax, eax
mov dword [ebp - 4], ebx
pop esi
mov dword [ebp - 0x6ec], esi
mov dword [ebp - 0x6f0], ebx
mov word [ebp - 0x700], ax
cmp word [ebp - 0x420], ax
jne 0x42601f
mov eax, ebx
jmp 0x42602c
lea eax, [ebp - 0x420]
push eax
call fcn.00479233
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x700]
call fcn.0040252a
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x71c], esi
mov dword [ebp - 0x720], ebx
mov word [ebp - 0x730], ax
cmp word [ebp - 0x218], ax
jne 0x426065
mov eax, ebx
jmp 0x426072
lea eax, [ebp - 0x218]
push eax
call fcn.00479233
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x730]
call fcn.0040252a
mov byte [ebp - 4], 2
call fcn.0042425c
mov ecx, eax
call fcn.004278a6
mov dword [ebp - 0x740], eax
test eax, eax
je 0x4265ae
mov esi, dword [eax]
jmp 0x4265a5
mov edi, dword [esi]
xor eax, eax
push str.ShortcutPos
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], ebx
mov word [ebp - 0x640], ax
call fcn.00479233
pop ecx
push eax
push str.ShortcutPos
lea ecx, [ebp - 0x640]
call fcn.0040252a
mov eax, dword [edi]
lea ecx, [ebp - 0x640]
push ecx
mov ecx, edi
mov byte [ebp - 4], 3
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 2
mov ebx, eax
call fcn.004023d7
and dword [ebp - 0x6a8], 0
xor eax, eax
push str.ShortcutName
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
call fcn.00479233
pop ecx
push eax
push str.ShortcutName
lea ecx, [ebp - 0x6b8]
call fcn.0040252a
mov eax, dword [edi]
lea ecx, [ebp - 0x6b8]
push ecx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 0x738], eax
mov byte [ebp - 4], 2
call fcn.004023d7
and dword [ebp - 0x6c0], 0
xor eax, eax
push str.SourceName
mov dword [ebp - 0x6bc], 7
mov word [ebp - 0x6d0], ax
call fcn.00479233
pop ecx
push eax
push str.SourceName
lea ecx, [ebp - 0x6d0]
call fcn.0040252a
mov eax, dword [edi]
lea ecx, [ebp - 0x6d0]
push ecx
mov ecx, edi
mov byte [ebp - 4], 5
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x73c], eax
mov byte [ebp - 4], 2
call fcn.004023d7
and dword [ebp - 0x6d8], 0
xor eax, eax
push str.FolderName
mov dword [ebp - 0x6d4], 7
mov word [ebp - 0x6e8], ax
call fcn.00479233
pop ecx
push eax
push str.FolderName
lea ecx, [ebp - 0x6e8]
call fcn.0040252a
mov eax, dword [edi]
lea ecx, [ebp - 0x6e8]
push ecx
mov ecx, edi
mov byte [ebp - 4], 6
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x734], eax
mov byte [ebp - 4], 2
call fcn.004023d7
and dword [ebp - 0x648], 0
xor eax, eax
push str.Describe
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
call fcn.00479233
pop ecx
push eax
push str.Describe
lea ecx, [ebp - 0x658]
call fcn.0040252a
mov eax, dword [edi]
lea ecx, [ebp - 0x658]
push ecx
mov ecx, edi
mov byte [ebp - 4], 7
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 2
mov edi, eax
call fcn.004023d7
test ebx, ebx
je 0x42659a
and dword [ebp - 0x660], 0
lea ecx, [ebp - 0x670]
xor eax, eax
mov dword [ebp - 0x65c], 7
push eax
push 0x4997e4
mov word [ebp - 0x670], ax
call fcn.0040252a
and dword [ebp - 0x678], 0
lea ecx, [ebp - 0x688]
xor eax, eax
mov byte [ebp - 4], 8
push eax
push 0x4997e4
mov dword [ebp - 0x674], 7
mov word [ebp - 0x688], ax
call fcn.0040252a
and dword [ebp - 0x690], 0
lea ecx, [ebp - 0x6a0]
xor eax, eax
mov byte [ebp - 4], 9
push eax
push 0x4997e4
mov dword [ebp - 0x68c], 7
mov word [ebp - 0x6a0], ax
call fcn.0040252a
cmp dword [ebx + 0x14], 8
mov byte [ebp - 4], 0xa
jb 0x426327
mov eax, dword [ebx]
jmp 0x426329
mov eax, ebx
push str.Desktop
push eax
call fcn.004792db
pop ecx
pop ecx
test eax, eax
jne 0x42634f
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x670]
call fcn.0040246e
cmp dword [ebx + 0x14], 8
jb 0x426359
mov eax, dword [ebx]
jmp 0x42635b
mov eax, ebx
push str.StartMenu
push eax
call fcn.004792db
pop ecx
pop ecx
test eax, eax
jne 0x42637e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x670]
call fcn.00402503
cmp dword [ebx + 0x14], 8
jb 0x426388
mov eax, dword [ebx]
jmp 0x42638a
mov eax, ebx
push str.Program
push eax
call fcn.004792db
pop ecx
pop ecx
test eax, eax
jne 0x4263ad
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x670]
call fcn.00402503
cmp dword [ebx + 0x14], 8
jb 0x4263b5
mov ebx, dword [ebx]
push str.StartUp
push ebx
call fcn.004792db
pop ecx
pop ecx
test eax, eax
jne 0x4263d8
lea eax, [ebp - 0x700]
push eax
lea ecx, [ebp - 0x670]
call fcn.00425f10
mov ebx, dword [ebp - 0x734]
test ebx, ebx
je 0x42640e
call fcn.0042425c
mov ecx, eax
call fcn.004277a5
push eax
lea ecx, [ebp - 0x688]
call fcn.00402503
cmp dword [ebx + 0x14], 8
jb 0x426402
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x688]
call fcn.004265de
test edi, edi
je 0x426426
cmp dword [edi + 0x14], 8
jb 0x42641a
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x6a0]
call fcn.00402503
mov ebx, dword [ebp - 0x738]
xor eax, eax
cmp dword [ebp - 0x660], eax
mov edi, dword [ebp - 0x73c]
setne al
xor ecx, ecx
test ebx, ebx
cmove eax, ecx
test edi, edi
cmove eax, ecx
test eax, eax
je 0x426568
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x640]
call fcn.00424856
push 0x49cb40
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0xb
call fcn.004265de
cmp dword [ebx + 0x14], 8
jb 0x42647f
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x640]
call fcn.004265de
push 0x49cb44
lea ecx, [ebp - 0x640]
call fcn.004265de
push 8
pop ebx
cmp dword [ebp - 0x62c], ebx
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.0046f48e
pop ecx
call fcn.0042425c
mov ecx, eax
call fcn.004277a5
push eax
lea ecx, [ebp - 0x658]
call fcn.00401f2f
mov byte [ebp - 4], 0xc
cmp dword [edi + 0x14], ebx
jb 0x4264db
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x658]
call fcn.004265de
cmp dword [ebp - 0x674], ebx
lea edi, [ebp - 0x688]
lea edx, [ebp - 0x6a0]
cmovae edi, dword [ebp - 0x688]
lea ecx, [ebp - 0x658]
cmp dword [ebp - 0x68c], ebx
lea eax, [ebp - 0x640]
push 0x4997e4
cmovae edx, dword [ebp - 0x6a0]
cmp dword [ebp - 0x644], ebx
push edi
cmovae ecx, dword [ebp - 0x658]
cmp dword [ebp - 0x62c], ebx
cmovae eax, dword [ebp - 0x640]
xor ebx, ebx
push ebx
push 1
push ebx
push edx
push ecx
push eax
call fcn.0046f879
add esp, 0x20
lea ecx, [ebp - 0x658]
push ebx
push 1
call fcn.004023d7
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.004023d7
jmp 0x42656a
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x6a0]
call fcn.004023d7
push ebx
push 1
lea ecx, [ebp - 0x688]
call fcn.004023d7
push ebx
push 1
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 2
call fcn.004023d7
jmp 0x42659c
xor ebx, ebx
mov eax, dword [ebp - 0x740]
add esi, 4
cmp esi, dword [eax + 4]
jne 0x4260aa
push ebx
push 1
lea ecx, [ebp - 0x730]
call fcn.004023d7
push ebx
push 1
lea ecx, [ebp - 0x700]
call fcn.004023d7
push ebx
push 1
lea ecx, [ebp - 0x718]
call fcn.004023d7
call fcn.0042e8bb
ret