Function at 0x4112ac
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x208]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [ebp - 0x21c]
cmp dword [edx + 0x438], 0
jne 0x41134c
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x41134c
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x41135c
xor eax, eax
jmp 0x411e7a
push 0
push 0x16
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x41142e
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jbe 0x41142e
push 0x4be64c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x41142e
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x208]
sub ecx, edx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
mov byte [ebp + eax - 0x208], 0
mov ecx, dword [ebp - 0x21c]
cmp dword [ecx + 0x438], 0
je 0x4113e2
jmp 0x41142e
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4113f7
jmp 0x41142e
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411418
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411428
xor eax, eax
jmp 0x411e7a
xor ecx, ecx
test ecx, ecx
jne 0x4113d1
push 0x4be658
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00409190
mov dword [ebp - 0x20c], 0
jmp 0x41145f
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x1a
jge 0x4114f0
mov ecx, dword [ebp - 0x20c]
add ecx, 0x41
mov byte [ebp - 0x208], cl
lea edx, [ebp - 0x208]
push edx
call fcn.0042afab
add esp, 4
test eax, eax
je 0x4114eb
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x41149f
jmp 0x4114eb
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4114b4
jmp 0x4114eb
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x4114d5
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x4114e5
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x41148e
jmp 0x411450
lea ecx, [ebp - 0x104]
push ecx
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00409190
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411519
jmp 0x411565
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x41152e
jmp 0x411565
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x41154f
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x41155f
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411508
lea ecx, [ebp - 0x104]
push ecx
push str._s_system32drivers_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a2c0
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411596
jmp 0x4115e2
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4115ab
jmp 0x4115e2
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x4115cc
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x4115dc
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411585
lea ecx, [ebp - 0x104]
push ecx
push str._s_system32_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a2c0
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411613
jmp 0x41165f
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411628
jmp 0x41165f
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411649
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411659
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411602
lea ecx, [ebp - 0x104]
push ecx
push str._s_system_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a2c0
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411690
jmp 0x4116dc
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4116a5
jmp 0x4116dc
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x4116c6
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x4116d6
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x41167f
lea ecx, [ebp - 0x104]
push ecx
push 0x4be690
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a2c0
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x41170d
jmp 0x411759
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411722
jmp 0x411759
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411743
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411753
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x4116fc
lea ecx, [ebp - 0x104]
push ecx
push str._sinf_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a2c0
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x41178a
jmp 0x4117d6
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x41179f
jmp 0x4117d6
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x4117c0
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x4117d0
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411779
lea ecx, [ebp - 0x104]
push ecx
push str._s_system32dllcache_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a2c0
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411807
jmp 0x411853
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x41181c
jmp 0x411853
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x41183d
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x41184d
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x4117f6
mov byte [ebp - 0x208], 0
push 0
push 0x1a
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411873
jmp 0x4118bf
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411888
jmp 0x4118bf
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x4118a9
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x4118b9
xor eax, eax
jmp 0x411e7a
xor ecx, ecx
test ecx, ecx
jne 0x411853
mov byte [ebp - 0x208], 0
push 0
push 0x23
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4118df
jmp 0x41192b
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4118f4
jmp 0x41192b
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411915
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411925
xor eax, eax
jmp 0x411e7a
xor edx, edx
test edx, edx
jne 0x4118bf
mov byte [ebp - 0x208], 0
push 0
push 0x2e
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x41194b
jmp 0x411997
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411960
jmp 0x411997
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411981
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411991
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x41192b
mov byte [ebp - 0x208], 0
push 0
push 0x1f
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4119b7
jmp 0x411a03
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4119cc
jmp 0x411a03
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x4119ed
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x4119fd
xor eax, eax
jmp 0x411e7a
xor ecx, ecx
test ecx, ecx
jne 0x411997
mov byte [ebp - 0x208], 0
push 0
push 0x16
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411a23
jmp 0x411a6f
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411a38
jmp 0x411a6f
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411a59
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411a69
xor eax, eax
jmp 0x411e7a
xor edx, edx
test edx, edx
jne 0x411a03
mov byte [ebp - 0x208], 0
push 0
push 0x18
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411a8f
jmp 0x411adb
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411aa4
jmp 0x411adb
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411ac5
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411ad5
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411a6f
mov byte [ebp - 0x208], 0
push 0
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411afb
jmp 0x411b47
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411b10
jmp 0x411b47
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411b31
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411b41
xor eax, eax
jmp 0x411e7a
xor ecx, ecx
test ecx, ecx
jne 0x411adb
mov byte [ebp - 0x208], 0
push 0
push 0x10
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411b67
jmp 0x411bb3
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411b7c
jmp 0x411bb3
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411b9d
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411bad
xor eax, eax
jmp 0x411e7a
xor edx, edx
test edx, edx
jne 0x411b47
mov byte [ebp - 0x208], 0
push 0
push 0x17
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411bd3
jmp 0x411c1f
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411be8
jmp 0x411c1f
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411c09
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411c19
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411bb3
mov byte [ebp - 0x208], 0
push 0
push 6
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411c3f
jmp 0x411c8b
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411c54
jmp 0x411c8b
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411c75
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411c85
xor eax, eax
jmp 0x411e7a
xor ecx, ecx
test ecx, ecx
jne 0x411c1f
mov byte [ebp - 0x208], 0
push 0
push 0x1c
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411cab
jmp 0x411cf7
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411cc0
jmp 0x411cf7
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411ce1
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411cf1
xor eax, eax
jmp 0x411e7a
xor edx, edx
test edx, edx
jne 0x411c8b
mov byte [ebp - 0x208], 0
push 0
push 5
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411d17
jmp 0x411d63
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411d2c
jmp 0x411d63
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411d4d
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411d5d
xor eax, eax
jmp 0x411e7a
xor eax, eax
test eax, eax
jne 0x411cf7
mov byte [ebp - 0x208], 0
push 0
push 0x2b
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411d83
jmp 0x411dcf
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411d98
jmp 0x411dcf
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411db9
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411dc9
xor eax, eax
jmp 0x411e7a
xor ecx, ecx
test ecx, ecx
jne 0x411d63
mov byte [ebp - 0x208], 0
push 0
push 2
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411def
jmp 0x411e35
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411e04
jmp 0x411e35
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411e22
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411e2f
xor eax, eax
jmp 0x411e7a
xor edx, edx
test edx, edx
jne 0x411dcf
push 0
push 0x26
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x411e6a
push 1
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bbf6
cmp eax, 0xffffffff
jne 0x411e6a
or eax, 0xffffffff
jmp 0x411e7a
call fcn.00436d76
test eax, eax
je 0x411e77
xor eax, eax
jmp 0x411e7a
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret