Function at 0x41a6f0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5927e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9f8
push ebx
push esi
push edi
mov edi, ecx
push 0x104
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [edi + 0x9c]
call fcn.004545a5
push 1
mov ecx, edi
call fcn.0044f389
mov ecx, dword [edi + 0x374]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
push ebx
push ebx
push 0xf0
push ecx
call esi
push ebx
push ebx
test eax, eax
mov eax, dword [edi + 0x1a4]
push 0xf0
setne dl
push eax
mov byte [ebp - 0x4c], dl
call esi
mov edx, dword [edi + 0x218]
push ebx
push ebx
test eax, eax
push 0xf0
setne cl
push edx
mov byte [ebp - 0x48], cl
call esi
mov ecx, dword [edi + 0x28c]
push ebx
push ebx
test eax, eax
push 0xf0
setne al
push ecx
mov byte [ebp - 0x58], al
call esi
push ebx
push ebx
cmp eax, 1
mov eax, dword [edi + 0x300]
push 0xf0
sete dl
push eax
mov byte [ebp - 0x54], dl
call esi
cmp eax, 1
sete cl
mov eax, 7
xor edx, edx
mov byte [ebp - 0x5c], cl
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x84], ebx
mov word [ebp - 0x94], dx
mov dword [ebp - 4], ebx
xor ecx, ecx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], ebx
mov word [ebp - 0x13c], cx
mov byte [ebp - 4], 1
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], ebx
mov word [ebp - 0x78], dx
mov byte [ebp - 4], 2
mov dword [ebp - 0x1d0], eax
xor eax, eax
mov dword [ebp - 0x1d4], ebx
mov word [ebp - 0x1e4], ax
lea eax, [ebp - 0x3ec]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a814
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x3ec]
push ecx
lea ecx, [ebp - 0x1e4]
call fcn.004025a0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x50]
push edx
call fcn.0043b190
mov ecx, dword [ebp - 0x50]
push 0x104
lea eax, [ebp - 0x7fc]
push eax
push 0x5aa378
push ecx
call fcn.0043b050
add esp, 0x14
test eax, eax
jne 0x41a8db
push 1
push 5
lea edx, [ebp - 0x5f4]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x5f4]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a880
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0x78]
call fcn.004025a0
push 1
push 0x5aa374
lea ecx, [ebp - 0x78]
call fcn.00404e30
mov edx, dword [edi + 0x6f8]
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a8c0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x78]
call fcn.00404e30
jmp 0x41a903
lea eax, [ebp - 0x7fc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a8e4
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x7fc]
push ecx
lea ecx, [ebp - 0x78]
call fcn.004025a0
mov eax, dword [edi + 0x72c]
cmp dword [eax - 4], 1
jle 0x41a91e
mov edx, dword [eax - 0xc]
push edx
lea ecx, [edi + 0x72c]
call fcn.004018f0
mov esi, dword [edi + 0x72c]
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, esi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a940
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.004025a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x13c]
call fcn.004089d0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 8
jb 0x41a982
mov edx, dword [ebp - 0x28]
push edx
call fcn.00448f11
add esp, 4
push 1
push 0x1a
lea ecx, [ebp - 0xa04]
push ecx
xor eax, eax
push ebx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xa04]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a9b0
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0xa04]
push edx
lea ecx, [ebp - 0x94]
call fcn.004025a0
push 9
push 0x5aa350
lea ecx, [ebp - 0x94]
call fcn.00404e30
mov eax, dword [edi + 0x728]
mov ecx, 0x5a9528
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41aa16
test dx, dx
je 0x41aa12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41aa16
add eax, 4
add ecx, 4
test dx, dx
jne 0x41a9f0
xor eax, eax
jmp 0x41aa1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x41aa36
push 1
push 0x5acd24
lea ecx, [edi + 0x728]
call fcn.00402090
mov eax, dword [edi + 0x724]
cmp dword [eax - 4], 1
jle 0x41aa51
mov eax, dword [eax - 0xc]
push eax
lea ecx, [edi + 0x724]
call fcn.004018f0
mov esi, dword [edi + 0x724]
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xf0], 7
mov dword [ebp - 0xf4], 0
mov word [ebp - 0x104], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41aa80
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x104]
call fcn.004025a0
mov byte [ebp - 4], 5
mov eax, dword [edi + 0x728]
cmp dword [eax - 4], 1
jle 0x41aabb
mov edx, dword [eax - 0xc]
push edx
lea ecx, [edi + 0x728]
call fcn.004018f0
mov ecx, dword [edi + 0x728]
xor eax, eax
mov word [ebp - 0x44], ax
mov eax, ecx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
lea esi, [eax + 2]
xor ebx, ebx
lea esp, [esp]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x41aae0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.004025a0
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x720]
cmp dword [eax - 4], 1
jle 0x41ab18
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [edi + 0x720]
call fcn.004018f0
mov esi, dword [edi + 0x720]
xor edx, edx
mov eax, esi
mov word [ebp - 0x1ac], dx
mov dword [ebp - 0x198], 7
mov dword [ebp - 0x19c], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ab40
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x1ac]
call fcn.004025a0
mov byte [ebp - 4], 7
mov eax, dword [edi + 0x71c]
cmp dword [eax - 4], 1
jle 0x41ab7b
mov eax, dword [eax - 0xc]
push eax
lea ecx, [edi + 0x71c]
call fcn.004018f0
mov esi, dword [edi + 0x71c]
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x1b4], 7
mov dword [ebp - 0x1b8], ebx
mov word [ebp - 0x1c8], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41aba0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x1c8]
call fcn.004025a0
mov byte [ebp - 4], 8
mov eax, dword [edi + 0x718]
cmp dword [eax - 4], 1
jle 0x41abdb
mov edx, dword [eax - 0xc]
push edx
lea ecx, [edi + 0x718]
call fcn.004018f0
mov esi, dword [edi + 0x718]
xor eax, eax
mov word [ebp - 0x158], ax
mov eax, esi
mov dword [ebp - 0x144], 7
mov dword [ebp - 0x148], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ac00
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x158]
call fcn.004025a0
mov byte [ebp - 4], 9
mov eax, dword [edi + 0x710]
cmp dword [eax - 4], 1
jle 0x41ac3b
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [edi + 0x710]
call fcn.004018f0
mov esi, dword [edi + 0x710]
xor edx, edx
mov eax, esi
mov word [ebp - 0x190], dx
mov dword [ebp - 0x17c], 7
mov dword [ebp - 0x180], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ac60
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x190]
call fcn.004025a0
mov byte [ebp - 4], 0xa
mov eax, dword [edi + 0x70c]
cmp dword [eax - 4], 1
jle 0x41ac9b
mov eax, dword [eax - 0xc]
push eax
lea ecx, [edi + 0x70c]
call fcn.004018f0
mov esi, dword [edi + 0x70c]
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x10c], 7
mov dword [ebp - 0x110], ebx
mov word [ebp - 0x120], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41acc0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x120]
call fcn.004025a0
mov byte [ebp - 4], 0xb
mov eax, dword [edi + 0x708]
cmp dword [eax - 4], 1
jle 0x41acfb
mov edx, dword [eax - 0xc]
push edx
lea ecx, [edi + 0x708]
call fcn.004018f0
mov esi, dword [edi + 0x708]
xor eax, eax
mov word [ebp - 0xb0], ax
mov eax, esi
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ad20
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xb0]
call fcn.004025a0
mov byte [ebp - 4], 0xc
mov eax, dword [edi + 0x704]
cmp dword [eax - 4], 1
jle 0x41ad5b
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [edi + 0x704]
call fcn.004018f0
mov esi, dword [edi + 0x704]
xor edx, edx
mov eax, esi
mov word [ebp - 0xe8], dx
mov dword [ebp - 0xd4], 7
mov dword [ebp - 0xd8], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ad80
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xe8]
call fcn.004025a0
mov byte [ebp - 4], 0xd
mov eax, dword [edi + 0x700]
cmp dword [eax - 4], 1
jle 0x41adbb
mov eax, dword [eax - 0xc]
push eax
lea ecx, [edi + 0x700]
call fcn.004018f0
mov esi, dword [edi + 0x700]
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xb8], 7
mov dword [ebp - 0xbc], ebx
mov word [ebp - 0xcc], cx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ade0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0xcc]
call fcn.004025a0
mov byte [ebp - 4], 0xe
mov eax, dword [edi + 0x6fc]
cmp dword [eax - 4], 1
jle 0x41ae1b
mov edx, dword [eax - 0xc]
push edx
lea ecx, [edi + 0x6fc]
call fcn.004018f0
mov esi, dword [edi + 0x6fc]
xor eax, eax
mov word [ebp - 0x174], ax
mov eax, esi
mov dword [ebp - 0x160], 7
mov dword [ebp - 0x164], ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ae40
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x174]
call fcn.004025a0
mov byte [ebp - 4], 0xf
xor ecx, ecx
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41ae80
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x3ec]
push edx
lea ecx, [ebp - 0x28]
call fcn.004025a0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x13c]
push ecx
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x94]
push edx
mov edx, dword [ebp - 0x54]
push eax
push ecx
push edx
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x1ac]
push edx
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x158]
push ecx
push edx
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0xb0]
push edx
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0x174]
push edx
push eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [edi + 0x6f4]
call fcn.00411400
mov byte [ebp - 4], 0xf
mov esi, 8
cmp dword [ebp - 0x14], esi
jb 0x41af3c
mov edx, dword [ebp - 0x28]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x160], esi
jb 0x41af6d
mov edx, dword [ebp - 0x174]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x164], ebx
mov word [ebp - 0x174], cx
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0xb8], esi
jb 0x41afa2
mov edx, dword [ebp - 0xcc]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xbc], ebx
mov word [ebp - 0xcc], cx
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0xd4], esi
jb 0x41afd7
mov edx, dword [ebp - 0xe8]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd8], ebx
mov word [ebp - 0xe8], cx
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x9c], esi
jb 0x41b00c
mov edx, dword [ebp - 0xb0]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ebx
mov word [ebp - 0xb0], cx
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x10c], esi
jb 0x41b041
mov edx, dword [ebp - 0x120]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], ebx
mov word [ebp - 0x120], cx
mov byte [ebp - 4], 9
cmp dword [ebp - 0x17c], esi
jb 0x41b076
mov edx, dword [ebp - 0x190]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x180], ebx
mov word [ebp - 0x190], cx
mov byte [ebp - 4], 8
cmp dword [ebp - 0x144], esi
jb 0x41b0ab
mov edx, dword [ebp - 0x158]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], ebx
mov word [ebp - 0x158], cx
mov byte [ebp - 4], 7
cmp dword [ebp - 0x1b4], esi
jb 0x41b0e0
mov edx, dword [ebp - 0x1c8]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b8], ebx
mov word [ebp - 0x1c8], cx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x198], esi
jb 0x41b115
mov edx, dword [ebp - 0x1ac]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x19c], ebx
mov word [ebp - 0x1ac], cx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x30], esi
jb 0x41b144
mov edx, dword [ebp - 0x44]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], cx
mov byte [ebp - 4], 3
cmp dword [ebp - 0xf0], esi
jb 0x41b170
mov edx, dword [ebp - 0x104]
push edx
call fcn.00448f11
add esp, 4
mov eax, 7
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3ec]
mov word [ebp - 0x44], dx
mov dword [ebp - 0xf4], ebx
mov word [ebp - 0x104], cx
mov dword [ebp - 0x34], ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41b1a0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x44]
call fcn.004025a0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [edi + 0x94]
call fcn.004397c0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x30], esi
jb 0x41b1e7
mov edx, dword [ebp - 0x44]
push edx
call fcn.00448f11
add esp, 4
mov edi, 7
xor eax, eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x44], ax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1d0], esi
jb 0x41b213
mov ecx, dword [ebp - 0x1e4]
push ecx
call fcn.00448f11
add esp, 4
xor edx, edx
mov dword [ebp - 0x1d0], edi
mov dword [ebp - 0x1d4], ebx
mov word [ebp - 0x1e4], dx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x64], esi
jb 0x41b23d
mov eax, dword [ebp - 0x78]
push eax
call fcn.00448f11
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], ebx
mov word [ebp - 0x78], cx
mov byte [ebp - 4], cl
cmp dword [ebp - 0x128], esi
jb 0x41b263
mov edx, dword [ebp - 0x13c]
push edx
call fcn.00448f11
add esp, 4
xor eax, eax
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x12c], ebx
mov word [ebp - 0x13c], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x80], esi
jb 0x41b293
mov ecx, dword [ebp - 0x94]
push ecx
call fcn.00448f11
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x80], edi
pop edi
xor edx, edx
mov dword [ebp - 0x84], ebx
pop esi
mov word [ebp - 0x94], dx
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret