Function at 0x4295e3
Capabilities:
Get common file path
Get program files directory
Get session user name
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42a143
mov edx, dword [ebp - 0x10c]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x42a143
mov ecx, dword [ebp - 0x10c]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x42a143
mov dword [ebp - 0x110], 1
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax]
cmp ecx, 0x25
jne 0x42a105
push 9
mov edx, dword [ebp - 0x10c]
push edx
push str._windows_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429687
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42a066
push 0xa
mov ecx, dword [ebp - 0x10c]
push ecx
push 0x4d7a68
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x4296b8
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42a066
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._sysdisk_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x4296f0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x106], 0
jmp 0x42a066
push 6
mov edx, dword [ebp - 0x10c]
push edx
push 0x4d7a80
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429721
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42a066
push 5
mov ecx, dword [ebp - 0x10c]
push ecx
push str._tmp_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429752
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42a066
push 6
mov eax, dword [ebp - 0x10c]
push eax
push str._user_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429862
mov dword [ebp - 0x31c], 0x104
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4297a1
mov dword [ebp - 0x110], 0
jmp 0x42a143
mov byte [ebp - 0x318], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x16
lea eax, [ebp - 0x318]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4297e0
mov dword [ebp - 0x110], 0
jmp 0x42a143
lea ecx, [ebp - 0x318]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jbe 0x42985d
push str.All_Users
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x42985d
mov eax, dword [ebp - 0x324]
lea ecx, [ebp - 0x318]
sub eax, ecx
mov dword [ebp - 0x320], eax
mov edx, dword [ebp - 0x320]
mov byte [ebp + edx - 0x318], 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x318]
push ecx
push 0x4d7aa4
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0040a2c0
add esp, 0x14
jmp 0x42a066
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._APPDATA_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x4298a2
push 0
push 0x1a
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42989d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x10
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_APPDATA_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x4298e2
push 0
push 0x23
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4298dd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x12
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_DOCUMENTS_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429922
push 0
push 0x2e
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42991d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_FAVORITES_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429962
push 0
push 0x1f
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42995d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x11
mov edx, dword [ebp - 0x10c]
push edx
push 0x4d7af4
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x4299a2
push 0
push 0x17
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42999d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x12
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_STARTMENU_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x4299e2
push 0
push 0x16
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4299dd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x10
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_STARTUP_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429a22
push 0
push 0x18
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429a1d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._CONTROLS_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429a62
push 0
push 3
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429a5d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 9
mov ecx, dword [ebp - 0x10c]
push ecx
push str._DESKTOP_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429aa2
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429a9d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._DESKTOPDIRECTORY_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429ae2
push 0
push 0x10
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429add
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x11
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_PROGRAMS_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429b22
push 0
push 0x17
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429b1d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xb
mov ecx, dword [ebp - 0x10c]
push ecx
push str._FAVORITES_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429b62
push 0
push 6
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429b5d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xf
mov eax, dword [ebp - 0x10c]
push eax
push str._LOCAL_APPDATA_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429ba2
push 0
push 0x1c
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429b9d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._PERSONAL_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429be2
push 0
push 5
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429bdd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x16
mov ecx, dword [ebp - 0x10c]
push ecx
push str._PROGRAM_FILES_COMMON_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429c22
push 0
push 0x2b
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429c1d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xf
mov eax, dword [ebp - 0x10c]
push eax
push str._PROGRAM_FILES_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429c62
push 0
push 0x26
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429c5d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._PROGRAMS_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429ca2
push 0
push 2
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429c9d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 8
mov ecx, dword [ebp - 0x10c]
push ecx
push str._SYSTEM_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429ce2
push 0
push 0x25
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429cdd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._WINDOWS_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429d22
push 0
push 0x24
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429d1d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 8
mov edx, dword [ebp - 0x10c]
push edx
push str._WINDIR_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429d62
push 0
push 0x24
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429d5d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xc
mov ecx, dword [ebp - 0x10c]
push ecx
push str._SYSTEMROOT_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429da2
push 0
push 0x24
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429d9d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xd
mov eax, dword [ebp - 0x10c]
push eax
push str._CDBURN_AREA_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429de2
push 0
push 0x3b
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429ddd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xe
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_MUSIC_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429e22
push 0
push 0x35
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429e1d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x11
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_PICTURES_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429e62
push 0
push 0x36
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429e5d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_TEMPLATES_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429ea2
push 0
push 0x2d
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429e9d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xe
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_VIDEO_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429ee2
push 0
push 0x37
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429edd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 9
mov ecx, dword [ebp - 0x10c]
push ecx
push str._PROFILE_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429f22
push 0
push 0x28
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429f1d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x19
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_DESKTOPDIRECTORY_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429f62
push 0
push 0x19
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429f5d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 9
mov edx, dword [ebp - 0x10c]
push edx
push str._COOKIES_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429fa2
push 0
push 0x21
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429f9d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 7
mov ecx, dword [ebp - 0x10c]
push ecx
push str._FONTS_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x429fe2
push 0
push 0x14
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429fdd
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0x10
mov eax, dword [ebp - 0x10c]
push eax
push str._INTERNET_CACHE_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x42a01f
push 0
push 0x20
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a01d
mov dword [ebp - 0x110], 0
jmp 0x42a066
push 0xb
mov edx, dword [ebp - 0x10c]
push edx
push str._PRINTHOOD_
call fcn.004153d0
add esp, 0xc
test eax, eax
jne 0x42a05c
push 0
push 0x1b
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a05a
mov dword [ebp - 0x110], 0
jmp 0x42a066
mov dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0
je 0x42a105
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x108]
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x328]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x42a0ad
mov edx, dword [ebp - 0x328]
movsx eax, byte [edx - 1]
cmp eax, 0x2f
jne 0x42a0b7
mov ecx, dword [ebp - 0x328]
mov byte [ecx - 1], 0
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00409190
mov edx, dword [ebp + 0xc]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp + 0xc], ecx
push 0x25
mov edx, dword [ebp - 0x10c]
add edx, 1
push edx
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x429605
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
jae 0x42a12b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10c]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
jmp 0x42a12f
xor eax, eax
jmp 0x42a148
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x429605
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret