Function at 0x466bf1
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x5466b0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x7c], eax
lea eax, [ebx + 0xe]
push 0x25
push eax
call fcn.004cc1f7
pop ecx
pop ecx
test eax, eax
je 0x467181
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
sub eax, ebx
sar eax, 1
dec eax
mov edi, eax
push edi
inc ebx
push str.CSIDL_SYSTEMX64
inc ebx
push ebx
mov dword [ebp - 0x80], edi
call esi
test eax, eax
jne 0x466cc9
mov edi, dword [ebp - 0x7c]
push eax
push 0x25
mov esi, 0x105
call fcn.00429bb0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x467181
or eax, 0xffffffff
mov esi, edi
call fcn.004080c0
mov eax, dword [esi]
push str.SysWOW64
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
je 0x466ca3
sub eax, dword [esi]
mov edx, esi
sar eax, 1
call fcn.004084d0
push esi
mov edx, str.System32
call fcn.004048f0
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
cmp word [eax + ecx*2 - 2], 0x5c
mov eax, dword [ebp - 0x80]
lea edx, [ebx + eax*2 + 4]
push esi
je 0x466cbc
lea edx, [ebx + eax*2 + 2]
call fcn.004048f0
xor eax, eax
inc eax
jmp 0x467183
push edi
push str.CSIDL_PROGRAM_FILESX64
push ebx
call esi
test eax, eax
jne 0x466d22
mov edi, dword [ebp - 0x7c]
push eax
push 0x26
mov esi, 0x105
call fcn.00429bb0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x467181
or eax, 0xffffffff
mov esi, edi
call fcn.004080c0
mov eax, dword [esi]
push str.__x86_
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
test eax, eax
je 0x466ca3
sub eax, dword [esi]
mov edx, esi
sar eax, 1
call fcn.004084d0
jmp 0x466ca3
push edi
push str.CSIDL_USERPINNED
push ebx
call esi
test eax, eax
jne 0x466d71
push 0x208
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.004d7710
add esp, 0xc
push 0x105
lea eax, [ebp - 0x78]
push eax
push str._APPDATA_MicrosoftInternet_ExplorerQuick_LaunchUser_Pinned
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x466cc1
mov edi, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.004085a0
jmp 0x466cc1
push edi
push str.CSIDL_DESKTOP
push ebx
call esi
test eax, eax
je 0x46714d
push edi
push str.CSIDL_WINDOWS
push ebx
call esi
test eax, eax
jne 0x466d96
push 0x24
jmp 0x46714c
push edi
push str.CSIDL_SYSTEM
push ebx
call esi
test eax, eax
jne 0x466daa
push 0x25
jmp 0x46714c
push edi
push str.CSIDL_PROGRAM_FILES
push ebx
call esi
test eax, eax
jne 0x466dbe
push 0x26
jmp 0x46714c
push edi
push str.CSIDL_APPDATA
push ebx
call esi
test eax, eax
jne 0x466dd2
push 0x1a
jmp 0x46714c
push edi
push str.CSIDL_TEMPLATES
push ebx
call esi
test eax, eax
jne 0x466de6
push 0x15
jmp 0x46714c
push edi
push str.CSIDL_MYDOCUMENTS
push ebx
call esi
test eax, eax
jne 0x466dfa
push 5
jmp 0x46714c
push edi
push str.CSIDL_PROGRAM_FILESX86
push ebx
call esi
test eax, eax
jne 0x466e0e
push 0x2a
jmp 0x46714c
push edi
push str.CSIDL_SYSTEMX86
push ebx
call esi
test eax, eax
jne 0x466e22
push 0x29
jmp 0x46714c
push edi
push str.CSIDL_LOCAL_APPDATA
push ebx
call esi
test eax, eax
jne 0x466e36
push 0x1c
jmp 0x46714c
push edi
push str.CSIDL_COMMON_FAVORITES
push ebx
call esi
test eax, eax
jne 0x466e4a
push 0x1f
jmp 0x46714c
push edi
push str.CSIDL_INTERNET_CACHE
push ebx
call esi
test eax, eax
jne 0x466e5e
push 0x20
jmp 0x46714c
push edi
push str.CSIDL_COOKIES
push ebx
call esi
test eax, eax
jne 0x466e72
push 0x21
jmp 0x46714c
push edi
push str.CSIDL_HISTORY
push ebx
call esi
test eax, eax
jne 0x466e86
push 0x22
jmp 0x46714c
push edi
push str.CSIDL_COMMON_APPDATA
push ebx
call esi
test eax, eax
jne 0x466e9a
push 0x23
jmp 0x46714c
push edi
push str.CSIDL_MYPICTURES
push ebx
call esi
test eax, eax
jne 0x466eae
push 0x27
jmp 0x46714c
push edi
push str.CSIDL_PROGRAM_FILES_COMMON
push ebx
call esi
test eax, eax
jne 0x466ec2
push 0x2b
jmp 0x46714c
push edi
push str.CSIDL_PROGRAM_FILES_COMMONX86
push ebx
call esi
test eax, eax
jne 0x466ed6
push 0x2c
jmp 0x46714c
push edi
push str.CSIDL_COMMON_TEMPLATES
push ebx
call esi
test eax, eax
jne 0x466eea
push 0x2d
jmp 0x46714c
push edi
push str.CSIDL_COMMON_DOCUMENTS
push ebx
call esi
test eax, eax
jne 0x466efe
push 0x2e
jmp 0x46714c
push edi
push str.CSIDL_COMMON_MUSIC
push ebx
call esi
test eax, eax
jne 0x466f12
push 0x35
jmp 0x46714c
push edi
push str.CSIDL_COMMON_PICTURES
push ebx
call esi
test eax, eax
jne 0x466f26
push 0x36
jmp 0x46714c
push edi
push str.CSIDL_COMMON_VIDEO
push ebx
call esi
test eax, eax
jne 0x466f3a
push 0x37
jmp 0x46714c
push edi
push str.CSIDL_COMMON_DESKTOPDIRECTORY
push ebx
call esi
test eax, eax
jne 0x466f4e
push 0x19
jmp 0x46714c
push edi
push str.CSIDL_PERSONAL
push ebx
call esi
test eax, eax
je 0x466df3
push edi
push str.CSIDL_INTERNET
push ebx
call esi
test eax, eax
jne 0x466f72
inc eax
jmp 0x46714d
push edi
push str.CSIDL_PROGRAMS
push ebx
call esi
test eax, eax
jne 0x466f86
push 2
jmp 0x46714c
push edi
push str.CSIDL_STARTMENU
push ebx
call esi
test eax, eax
jne 0x466f9a
push 0xb
jmp 0x46714c
push edi
push str.CSIDL_MYMUSIC
push ebx
call esi
test eax, eax
jne 0x466fae
push 0xd
jmp 0x46714c
push edi
push str.CSIDL_MYVIDEO
push ebx
call esi
test eax, eax
jne 0x466fc2
push 0xe
jmp 0x46714c
push edi
push str.CSIDL_CONTROLS
push ebx
call esi
test eax, eax
jne 0x466fd6
push 3
jmp 0x46714c
push edi
push str.CSIDL_PRINTERS
push ebx
call esi
test eax, eax
jne 0x466fea
push 4
jmp 0x46714c
push edi
push str.CSIDL_FAVORITES
push ebx
call esi
test eax, eax
jne 0x466ffe
push 6
jmp 0x46714c
push edi
push str.CSIDL_STARTUP
push ebx
call esi
test eax, eax
jne 0x467012
push 7
jmp 0x46714c
push edi
push str.CSIDL_RECENT
push ebx
call esi
test eax, eax
jne 0x467026
push 8
jmp 0x46714c
push edi
push str.CSIDL_SENDTO
push ebx
call esi
test eax, eax
jne 0x46703a
push 9
jmp 0x46714c
push edi
push str.CSIDL_BITBUCKET
push ebx
call esi
test eax, eax
jne 0x46704e
push 0xa
jmp 0x46714c
push edi
push str.CSIDL_DESKTOPDIRECTORY
push ebx
call esi
test eax, eax
jne 0x467062
push 0x10
jmp 0x46714c
push edi
push str.CSIDL_DRIVES
push ebx
call esi
test eax, eax
jne 0x467076
push 0x11
jmp 0x46714c
push edi
push str.CSIDL_NETWORK
push ebx
call esi
test eax, eax
jne 0x46708a
push 0x12
jmp 0x46714c
push edi
push str.CSIDL_NETHOOD
push ebx
call esi
test eax, eax
jne 0x46709e
push 0x13
jmp 0x46714c
push edi
push str.CSIDL_FONTS
push ebx
call esi
test eax, eax
jne 0x4670b2
push 0x14
jmp 0x46714c
push edi
push str.CSIDL_COMMON_STARTMENU
push ebx
call esi
test eax, eax
jne 0x4670c6
push 0x16
jmp 0x46714c
push edi
push str.CSIDL_COMMON_PROGRAMS
push ebx
call esi
test eax, eax
jne 0x4670d7
push 0x17
jmp 0x46714c
push edi
push str.CSIDL_COMMON_STARTUP
push ebx
call esi
test eax, eax
jne 0x4670e8
push 0x18
jmp 0x46714c
push edi
push str.CSIDL_PRINTHOOD
push ebx
call esi
test eax, eax
jne 0x4670f9
push 0x1b
jmp 0x46714c
push edi
push str.CSIDL_PROFILE
push ebx
call esi
test eax, eax
jne 0x46710a
push 0x28
jmp 0x46714c
push edi
push str.CSIDL_COMMON_ADMINTOOLS
push ebx
call esi
test eax, eax
jne 0x46711b
push 0x2f
jmp 0x46714c
push edi
push str.CSIDL_CONNECTIONS
push ebx
call esi
test eax, eax
jne 0x46712c
push 0x31
jmp 0x46714c
push edi
push str.CSIDL_RESOURCES
push ebx
call esi
test eax, eax
jne 0x46713d
push 0x38
jmp 0x46714c
push edi
push str.CSIDL_ADMINTOOLS
push ebx
call esi
test eax, eax
jne 0x467181
push 0x30
pop eax
mov edi, dword [ebp - 0x7c]
push 0
push eax
mov esi, 0x105
call fcn.00429bb0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, edi
test eax, eax
je 0x467179
or eax, 0xffffffff
call fcn.004080c0
jmp 0x466ca3
or eax, 0xffffffff
call fcn.004080c0
xor eax, eax
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cb38b
add ebp, 0x198
leave
ret 4