Function at 0x402bd5
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebx
mov edx, 0x84
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402bdb
call fcn.00429ae0
push dword [esp + 0x21c]
call fcn.00412380
mov edx, dword [esp + 0x218]
lea ecx, [esp]
call fcn.00412000
mov dword [esp + 4], 0
push dword [esp]
mov edx, str.ApplicationData
mov ecx, dword [esp]
call fcn.00412310
je 0x402c3b
lea eax, [esp + 8]
push eax
push 0x1a
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonApplicationData
mov ecx, dword [esp]
call fcn.00412310
je 0x402c63
lea eax, [esp + 8]
push eax
push 0x23
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.LocalApplicationData
mov ecx, dword [esp]
call fcn.00412310
je 0x402c8b
lea eax, [esp + 8]
push eax
push 0x1c
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Cookies
mov ecx, dword [esp]
call fcn.00412310
je 0x402cb3
lea eax, [esp + 8]
push eax
push 0x21
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Desktop
mov ecx, dword [esp]
call fcn.00412310
je 0x402cdb
lea eax, [esp + 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Favorites
mov ecx, dword [esp]
call fcn.00412310
je 0x402d03
lea eax, [esp + 8]
push eax
push 6
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.History
mov ecx, dword [esp]
call fcn.00412310
je 0x402d2b
lea eax, [esp + 8]
push eax
push 0x22
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.InternetCache
mov ecx, dword [esp]
call fcn.00412310
je 0x402d53
lea eax, [esp + 8]
push eax
push 0x20
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Programs
mov ecx, dword [esp]
call fcn.00412310
je 0x402d7b
lea eax, [esp + 8]
push eax
push 2
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.MyMusic
mov ecx, dword [esp]
call fcn.00412310
je 0x402da3
lea eax, [esp + 8]
push eax
push 0xd
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.MyPictures
mov ecx, dword [esp]
call fcn.00412310
je 0x402dcb
lea eax, [esp + 8]
push eax
push 0x27
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Recent
mov ecx, dword [esp]
call fcn.00412310
je 0x402df3
lea eax, [esp + 8]
push eax
push 8
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.SendTo
mov ecx, dword [esp]
call fcn.00412310
je 0x402e1b
lea eax, [esp + 8]
push eax
push 9
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.StartMenu
mov ecx, dword [esp]
call fcn.00412310
je 0x402e43
lea eax, [esp + 8]
push eax
push 0xb
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Startup
mov ecx, dword [esp]
call fcn.00412310
je 0x402e6b
lea eax, [esp + 8]
push eax
push 7
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.System
mov ecx, dword [esp]
call fcn.00412310
je 0x402e93
lea eax, [esp + 8]
push eax
push 0x25
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Templates
mov ecx, dword [esp]
call fcn.00412310
je 0x402ebb
lea eax, [esp + 8]
push eax
push 0x15
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.DesktopDirectory
mov ecx, dword [esp]
call fcn.00412310
je 0x402ee3
lea eax, [esp + 8]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.MyDocuments
mov ecx, dword [esp]
call fcn.00412310
je 0x402f0b
lea eax, [esp + 8]
push eax
push 5
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.ProgramFiles
mov ecx, dword [esp]
call fcn.00412310
je 0x402f33
lea eax, [esp + 8]
push eax
push 0x26
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonProgramFiles
mov ecx, dword [esp]
call fcn.00412310
je 0x402f5b
lea eax, [esp + 8]
push eax
push 0x2b
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.AdminTools
mov ecx, dword [esp]
call fcn.00412310
je 0x402f83
lea eax, [esp + 8]
push eax
push 0x30
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CDBurning
mov ecx, dword [esp]
call fcn.00412310
je 0x402fab
lea eax, [esp + 8]
push eax
push 0x3b
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonAdminTools
mov ecx, dword [esp]
call fcn.00412310
je 0x402fd3
lea eax, [esp + 8]
push eax
push 0x2f
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonDocuments
mov ecx, dword [esp]
call fcn.00412310
je 0x402ffb
lea eax, [esp + 8]
push eax
push 0x2e
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonMusic
mov ecx, dword [esp]
call fcn.00412310
je 0x403023
lea eax, [esp + 8]
push eax
push 0x35
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonPictures
mov ecx, dword [esp]
call fcn.00412310
je 0x40304b
lea eax, [esp + 8]
push eax
push 0x36
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonStartMenu
mov ecx, dword [esp]
call fcn.00412310
je 0x403073
lea eax, [esp + 8]
push eax
push 0x16
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, 0x4b8f84
mov ecx, dword [esp]
call fcn.00412310
je 0x40309b
lea eax, [esp + 8]
push eax
push 0x17
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonStartup
mov ecx, dword [esp]
call fcn.00412310
je 0x4030c3
lea eax, [esp + 8]
push eax
push 0x18
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonDesktopDirectory
mov ecx, dword [esp]
call fcn.00412310
je 0x4030eb
lea eax, [esp + 8]
push eax
push 0x19
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonTemplates
mov ecx, dword [esp]
call fcn.00412310
je 0x403113
lea eax, [esp + 8]
push eax
push 0x2d
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonVideos
mov ecx, dword [esp]
call fcn.00412310
je 0x40313b
lea eax, [esp + 8]
push eax
push 0x37
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Fonts
mov ecx, dword [esp]
call fcn.00412310
je 0x403163
lea eax, [esp + 8]
push eax
push 0x14
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.MyVideos
mov ecx, dword [esp]
call fcn.00412310
je 0x40318b
lea eax, [esp + 8]
push eax
push 0xe
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.UserProfile
mov ecx, dword [esp]
call fcn.00412310
je 0x4031b3
lea eax, [esp + 8]
push eax
push 0x28
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.CommonProgramFilesX86
mov ecx, dword [esp]
call fcn.00412310
je 0x4031db
lea eax, [esp + 8]
push eax
push 0x2c
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.ProgramFilesX86
mov ecx, dword [esp]
call fcn.00412310
je 0x403203
lea eax, [esp + 8]
push eax
push 0x2a
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Resources
mov ecx, dword [esp]
call fcn.00412310
je 0x40322b
lea eax, [esp + 8]
push eax
push 0x38
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.SystemX86
mov ecx, dword [esp]
call fcn.00412310
je 0x403253
lea eax, [esp + 8]
push eax
push 0x29
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.Windows
mov ecx, dword [esp]
call fcn.00412310
je 0x403278
lea eax, [esp + 8]
push eax
push 0x24
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
jmp 0x4032f6
mov edx, str.ProgramFilesX64
mov ecx, dword [esp]
call fcn.00412310
je 0x4032f6
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
mov eax, str.ProgramW6432
push eax
call fcn.00413ade
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00429b70
lea edx, [esp + 0xc]
push edx
call fcn.00429940
pop edx
push eax
push 0x104
push edx
call fcn.00429be0
call fcn.00429980
mov edx, 0x4b7024
pop ecx
push ecx
call fcn.00412300
mov ecx, eax
call fcn.00412310
je 0x4032f6
lea eax, [esp + 8]
push eax
push 0x26
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
pop eax
mov ebx, dword [esp + 4]
and ebx, ebx
je 0x403316
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListW
push dword [esp + 4]
call sub.OLE32.DLL_CoTaskMemFree
lea edx, [esp + 8]
push edx
call fcn.00429940
pop edx
push eax
push 0x104
push edx
call fcn.00429be0
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x403343
push dword [esp]
call fcn.00429b40
add esp, 0x210
pop ebx
ret 4