Function at 0x427cf7
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48409d
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x4b0760]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x4b0760]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x28], 7
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov word [esp + 0x14], ax
mov dword [esp + 0x280], ecx
lea edi, [esp + 0x5c]
mov ecx, 0x82
mov edx, str.DESKTOP
rep stosd dword es:[edi], eax
mov ecx, ebx
stosw word es:[edi], ax
call fcn.0040adb2
test al, al
je 0x427da5
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x10
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 1
jmp 0x42818a
mov edx, 0x497ab4
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x427e08
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x28
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
call fcn.004026a2
pop ecx
push eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1c]
call fcn.00403a06
mov edi, str.Downloads
push edi
call fcn.004026a2
pop ecx
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.004038d0
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.0042835f
jmp 0x4281a1
mov edx, str.USERPROFILE
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x427e45
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x28
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 2
jmp 0x42818a
mov edx, 0x499770
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x427e82
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 3
jmp 0x42818a
mov edx, str.APPDATA
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x427ebf
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 4
jmp 0x42818a
mov edx, str.ProgramFiles_x86_
mov ecx, ebx
call fcn.0040adb2
test al, al
jne 0x428150
mov edx, str.ProgramFiles__x86_
mov ecx, ebx
call fcn.0040adb2
test al, al
jne 0x428150
mov edx, str.WINDOWS
mov ecx, ebx
call fcn.0040adb2
test al, al
jne 0x428126
mov edx, str.WINDIR
mov ecx, ebx
call fcn.0040adb2
test al, al
jne 0x428126
mov edx, str.ProgramFiles
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x427ff7
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
lea edx, [esp + 0x2c]
mov byte [esp + 0x280], 7
lea ecx, [esp + 0x44]
call fcn.0042835f
lea ecx, [esp + 0x14]
mov byte [esp + 0x280], 8
cmp ecx, eax
je 0x427f71
push 0xffffffffffffffff
push ebx
push eax
call fcn.00403973
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040224f
push ebx
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x288], bl
call fcn.0040224f
mov edi, 0x497a94
push edi
call fcn.004026a2
pop ecx
push eax
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.00403690
inc eax
lea ecx, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x4c]
push eax
call fcn.004033f1
push eax
lea ecx, [esp + 0x18]
call fcn.004033ae
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040224f
mov edi, str.Program_Files
push edi
call fcn.004026a2
pop ecx
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.004038d0
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.00403389
jmp 0x4281a1
mov edx, str.TEMP
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x4280dc
lea eax, [esp + 0x5c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x428065
dec eax
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.00403a06
lea edx, [esp + 0x14]
lea ecx, [esp + 0x44]
call fcn.0042835f
lea ecx, [esp + 0x14]
mov byte [esp + 0x280], 9
xor ebx, ebx
cmp ecx, eax
je 0x428057
push 0xffffffffffffffff
push ebx
push eax
call fcn.00403973
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040224f
jmp 0x427fe6
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
lea edx, [esp + 0x2c]
mov byte [esp + 0x280], 0xa
lea ecx, [esp + 0x44]
call fcn.0042835f
lea ecx, [esp + 0x14]
mov byte [esp + 0x280], 0xb
cmp ecx, eax
je 0x4280b3
push 0xffffffffffffffff
push ebx
push eax
call fcn.00403973
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040224f
push ebx
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x288], bl
call fcn.0040224f
mov edi, str.Temp
jmp 0x427fd4
mov edx, str.STARTUP
mov ecx, ebx
call fcn.0040adb2
test al, al
je 0x428116
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 7
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 0xc
jmp 0x42818a
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.00403389
xor ebx, ebx
jmp 0x4281a1
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 6
jmp 0x42818a
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2a
push ebx
call edi
test eax, eax
je 0x428174
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x26
push ebx
call edi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.00403358
mov byte [esp + 0x280], 5
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.0042835f
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.0040224f
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.0040224f
mov eax, esi
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.004600e1
mov esp, ebp
pop ebp
ret