Function at 0x416f40
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x494b87
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x4b6170]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b6170]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
call fcn.004350d0
push 0x11c
call fcn.0043f6a7
xor ebp, ebp
add esp, 4
cmp eax, ebp
je 0x416f9f
mov dword [eax], ebp
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
mov edi, eax
jmp 0x416fa1
xor edi, edi
lea ecx, [esp + 0x14]
call fcn.00416820
mov dword [esp + 0x2b8], ebp
cmp dword [eax + 0x18], 0x10
jb 0x416fbc
mov eax, dword [eax + 4]
jmp 0x416fbf
add eax, 4
mov edx, str.WebKit.dll
mov esi, eax
mov ecx, edi
call fcn.0041a9d0
mov esi, 0x10
mov dword [esp + 0x2b8], 0xffffffff
mov bl, al
cmp dword [esp + 0x2c], esi
jb 0x416ff2
mov eax, dword [esp + 0x18]
push eax
call fcn.0043f604
add esp, 4
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebp
mov byte [esp + 0x18], 0
test bl, bl
je 0x417019
push str.xxxbbbfffccc
push edi
call fcn.0041ab60
mov dword [0x4b9208], eax
jmp 0x41701e
mov eax, dword [0x4b9208]
cmp eax, ebp
je 0x4172a7
call eax
mov edx, dword [eax]
mov dword [0x4b9204], eax
mov ecx, eax
mov eax, dword [edx]
call eax
call fcn.00401a50
lea ecx, [esp + 0x14]
call fcn.00416820
mov dword [esp + 0x2b8], 1
cmp dword [eax + 0x18], esi
jb 0x417058
mov eax, dword [eax + 4]
jmp 0x41705b
add eax, 4
mov ecx, dword [0x4b9204]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x34]
call eax
mov dword [esp + 0x2b8], 0xffffffff
cmp dword [esp + 0x2c], esi
jb 0x417087
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0043f604
add esp, 4
call fcn.00401930
movzx esi, word [eax + 0xec]
call fcn.00401930
movzx eax, word [eax + 0xee]
mov ecx, dword [0x4b9204]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x20
movzx esi, si
movzx eax, ax
push esi
push eax
call edx
mov ecx, dword [0x4b9204]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push 1
call edx
push 0x206
lea ecx, [esp + 0xaa]
xor eax, eax
push ebp
push ecx
mov word [esp + 0xb0], ax
call fcn.00446600
add esp, 0xc
push 1
push 0x23
lea edx, [esp + 0xac]
push edx
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.AppData
lea eax, [esp + 0xa8]
push 0x104
push eax
call fcn.0043fdd7
add esp, 0xc
mov edi, 7
xor ecx, ecx
lea eax, [esp + 0xa4]
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebp
mov word [esp + 0x70], cx
lea edx, [eax + 2]
mov ebx, 2
mov cx, word [eax]
add eax, ebx
cmp cx, bp
jne 0x417140
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xa8]
lea esi, [esp + 0x70]
call fcn.00403500
push 1
push 0x4a3638
mov eax, esi
mov dword [esp + 0x2c0], ebx
call fcn.0040bbe0
call fcn.00401930
lea esi, [esp + 0x34]
call fcn.0041a650
push ebp
push eax
or eax, 0xffffffff
lea esi, [esp + 0x74]
mov byte [esp + 0x2c0], 3
call fcn.0040bed0
mov byte [esp + 0x2b8], bl
mov ebx, 8
cmp dword [esp + 0x4c], ebx
jb 0x4171b7
mov edx, dword [esp + 0x38]
push edx
call fcn.0043f604
add esp, 4
xor eax, eax
push edi
mov word [esp + 0x3c], ax
push str.ck.txt
lea eax, [esp + 0x74]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebp
call fcn.0040bbe0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
push ebp
lea eax, [esp + 0x90]
mov word [ecx + 4], dx
call fcn.004027a0
lea edi, [esp + 0xa4]
call fcn.00403cd0
add esp, 0x1c
mov byte [esp + 0x2b8], 4
mov eax, dword [esp + 0x8c]
mov esi, 0x10
cmp dword [esp + 0xa0], esi
jae 0x41722c
lea eax, [esp + 0x8c]
mov ecx, dword [0x4b9204]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
cmp dword [esp + 0xa0], esi
jb 0x417253
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.0043f604
add esp, 4
mov dword [esp + 0x2b8], 0xffffffff
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], ebp
mov byte [esp + 0x8c], 0
cmp dword [esp + 0x84], ebx
jb 0x41728e
mov edx, dword [esp + 0x70]
push edx
call fcn.0043f604
add esp, 4
xor eax, eax
mov dword [esp + 0x84], 7
mov dword [esp + 0x80], ebp
mov word [esp + 0x70], ax
call fcn.00417b80
mov esi, eax
call fcn.004263f0
test al, al
je 0x4172c6
call fcn.00417b80
mov ecx, dword [eax]
push ebp
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push ebp
push ebp
push ebp
lea edx, [esp + 0x5c]
push edx
call esi
test eax, eax
je 0x417302
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x50]
push eax
call edi
lea ecx, [esp + 0x50]
push ecx
call ebx
push ebp
push ebp
push ebp
lea edx, [esp + 0x5c]
push edx
call esi
test eax, eax
jne 0x4172e6
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.0043f4b7
add esp, 0x2a8
ret