Function at 0x406bbe
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x338
mov eax, 0x55c74e
call fcn.005239fe
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 4], esi
push 7
pop eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x248], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x268], esi
mov word [ebp - 0x278], cx
mov dword [ebp - 0x24c], esi
mov word [ebp - 0x25c], ax
mov byte [ebp - 4], 1
push 0x208
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push esi
push eax
call fcn.00517bf0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x28
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, esi
jge 0x406d0d
lea eax, [ebp - 0x344]
push eax
call fcn.00403689
mov esi, eax
push str.GFE::Applications::ApplicationDetector::GetSettingsForSHIM:_SHGetFolderPath_failed_with
push esi
mov byte [ebp - 4], 2
call fcn.00405d65
pop ecx
pop ecx
push edi
push esi
call fcn.00410496
lea eax, [ebp - 0x240]
push eax
mov eax, esi
call fcn.004036f3
mov byte [ebp - 4], 3
cmp dword [ebp - 0x22c], 8
mov eax, dword [ebp - 0x240]
jae 0x406ca9
lea eax, [ebp - 0x240]
push eax
push 2
pop ecx
call fcn.00492cc7
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x240]
call fcn.0040412d
lea eax, [ebp - 0x344]
mov byte [ebp - 4], 1
call fcn.0040262a
lea eax, [ebp - 0x2a8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x406e28
mov esi, ebx
call fcn.0040f22f
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], edi
jmp 0x406e28
mov edi, dword [ebp - 0x298]
lea eax, [ebp - 0x234]
push eax
call fcn.00408007
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x230]
mov edi, dword [ebp - 0x234]
sub eax, edi
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, esi
jbe 0x406d80
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x224]
push eax
mov ecx, edi
call fcn.0040ffab
pop ecx
test al, al
je 0x406d75
lea eax, [ebp - 0x224]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x406d5d
sub eax, edx
sar eax, 1
push 0xd
mov ecx, edi
call fcn.0040ec65
add edi, 0x1c
dec dword [ebp - 0x298]
jne 0x406d41
push str.SearchPaths
lea eax, [ebp - 0x278]
push eax
call fcn.00404104
push 0x586b60
lea esi, [ebp - 0x294]
call fcn.00403350
mov eax, esi
push eax
lea eax, [ebp - 0x25c]
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.0040ffef
pop ecx
push 1
xor edi, edi
mov byte [ebp - 4], 6
call fcn.0040412d
lea ecx, [ebp - 0x278]
lea edx, [ebp - 0x2a8]
call fcn.0040e489
lea eax, [ebp - 0x2a8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x406e1d
mov esi, ebx
call fcn.0040f22f
mov eax, dword [ebp - 0x2a8]
mov dword [ebx], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebx + 8], eax
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], edi
lea esi, [ebp - 0x234]
call fcn.0040f001
push 1
xor edi, edi
lea esi, [ebp - 0x25c]
call fcn.0040412d
push 1
lea esi, [ebp - 0x278]
call fcn.0040412d
lea esi, [ebp - 0x2a8]
call fcn.0040f22f
mov eax, ebx
call fcn.00523a81
ret 4