Function at 0x405260
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push edi
push ebx
sub esp, 0x224
mov eax, dword [esp + 0x234]
mov dword [esp], eax
call fcn.0042d660
sub esp, 4
call fcn.0042d6e0
mov eax, dword [esp + 0x230]
mov dword [esp + 4], eax
lea eax, [esp + 0x230]
mov dword [esp], eax
call fcn.0042d910
sub esp, 8
lea ebx, [esp + 0x18]
mov ecx, 0x82
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x230]
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
call fcn.0042d910
sub esp, 8
mov dword [esp + 4], str.ApplicationData
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405810
mov dword [esp + 4], str.CommonApplicationData
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405890
mov dword [esp + 4], str.LocalApplicationData
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x4058b8
mov dword [esp + 4], str.Cookies
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x4058e0
mov dword [esp + 4], str.Desktop
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405908
mov dword [esp + 4], str.Favorites
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405930
mov dword [esp + 4], str.History
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405958
mov dword [esp + 4], str.InternetCache
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405980
mov dword [esp + 4], str.Programs
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x4059a8
mov dword [esp + 4], str.MyMusic
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x4059cc
mov dword [esp + 4], str.MyPictures
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x4059f0
mov dword [esp + 4], str.Recent
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405a14
mov dword [esp + 4], str.SendTo
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405a38
mov dword [esp + 4], str.StartMenu
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405a5c
mov dword [esp + 4], str.Startup
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405a80
mov dword [esp + 4], str.System
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405aa4
mov dword [esp + 4], str.Templates
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405ac6
mov dword [esp + 4], str.DesktopDirectory
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405ae8
mov dword [esp + 4], str.MyDocuments
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405b0a
mov dword [esp + 4], str.ProgramFiles
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x4057e7
mov dword [esp + 4], str.CommonProgramFiles
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405b2c
mov dword [esp + 4], str.AdminTools
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405b4e
mov dword [esp + 4], str.CDBurning
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405b70
mov dword [esp + 4], str.CommonAdminTools
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405b92
mov dword [esp + 4], str.CommonDocuments
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405bb4
mov dword [esp + 4], str.CommonMusic
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405bd6
mov dword [esp + 4], 0x4e3f04
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405bf8
mov dword [esp + 4], str.CommonStartMenu
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405c1a
mov dword [esp + 4], str.CommonPrograms
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405c3c
mov dword [esp + 4], str.CommonStartup
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405c5e
mov dword [esp + 4], str.CommonDesktopDirectory
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405c80
mov dword [esp + 4], str.CommonTemplates
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405ca2
mov dword [esp + 4], str.CommonVideos
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405cc4
mov dword [esp + 4], str.Fonts
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405ce6
mov dword [esp + 4], str.MyVideos
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405d08
mov dword [esp + 4], str.UserProfile
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405d2a
mov dword [esp + 4], str.CommonProgramFilesX86
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405d4c
mov dword [esp + 4], str.ProgramFilesX86
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405d6e
mov dword [esp + 4], str.Resources
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405d90
mov dword [esp + 4], str.SystemX86
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405db2
mov dword [esp + 4], str.Windows
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
jne 0x405dd4
mov dword [esp + 4], str.ProgramFilesX64
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db30
test eax, eax
je 0x40582f
call fcn.0042d740
call fcn.0042d740
call fcn.0042d790
mov dword [esp + 4], eax
mov dword [esp], str.ProgramW6432
call fcn.00417f55
push edx
push edx
call fcn.0042d790
mov dword [esp + 8], eax
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.0042db70
sub esp, 0xc
call fcn.0042d740
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.0042dbe0
push ecx
push ecx
call fcn.0042dc60
call fcn.0042d840
mov dword [esp + 4], eax
mov dword [esp], 0x4ef2d4
call fcn.0042db30
test eax, eax
je 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x26
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.0042db00
sub esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x405e00
call fcn.0042d740
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call fcn.0042dbe0
sub esp, 8
call fcn.0042d890
mov ebx, eax
mov eax, dword [esp + 0x230]
mov dword [esp], eax
call fcn.0042db00
sub esp, 4
mov eax, ebx
add esp, 0x224
pop ebx
pop edi
ret 8
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1c
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x21
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 6
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x22
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xd
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x27
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 8
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 9
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 7
mov dword [esp], 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x25
xor edi, edi
mov dword [esp], edi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x15
xor ecx, ecx
mov dword [esp], ecx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x10
xor edx, edx
mov dword [esp], edx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 5
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2b
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x3b
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2f
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2e
xor edi, edi
mov dword [esp], edi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x35
xor ecx, ecx
mov dword [esp], ecx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x36
xor edx, edx
mov dword [esp], edx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x16
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x17
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x18
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x19
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2d
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x37
xor edi, edi
mov dword [esp], edi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x14
xor ecx, ecx
mov dword [esp], ecx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xe
xor edx, edx
mov dword [esp], edx
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x28
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2c
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2a
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x38
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x29
xor eax, eax
mov dword [esp], eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x24
xor edi, edi
mov dword [esp], edi
call sub.SHELL32.dll_SHGetSpecialFolderLocation
sub esp, 0xc
jmp 0x40582f
mov eax, dword [esp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.SHELL32.dll_SHGetPathFromIDListW
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call sub.ole32.dll_CoTaskMemFree
sub esp, 4
jmp 0x40584a