Function at 0x42f8c4
Capabilities:
Get common file path
Get file system object information
Get startup folder
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0588
mov eax, dword fs:[0]
push eax
sub esp, 0x508
mov eax, dword [0x4d0620]
xor eax, esp
mov dword [esp + 0x500], eax
push ebx
push esi
push edi
mov eax, dword [0x4d0620]
xor eax, esp
push eax
lea eax, [esp + 0x518]
mov dword fs:[0], eax
xor esi, esi
mov ebx, ecx
mov dword [esp + 0x34], vtable.CPidl.0
mov dword [esp + 0x38], esi
mov dword [esp + 0x520], esi
call fcn.0045db7e
push eax
lea ecx, [esp + 0x24]
call fcn.0040161b
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov byte [esp + 0x524], 1
call fcn.004663a8
push esi
push esi
push 0x100
mov ecx, ebx
call fcn.00468848
lea eax, [ebx + 0x54]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
cmp eax, esi
jge 0x42f9a6
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00401325
or esi, 0xffffffff
or dword [esp + 0x520], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.0042f5aa
mov eax, esi
mov ecx, dword [esp + 0x518]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x500]
xor ecx, esp
call fcn.0047b9fe
mov esp, ebp
pop ebp
ret 4
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [esp + 0x38]
push eax
push esi
push dword [ebx + 0x20]
call edi
push 0x2b0
lea eax, [esp + 0x54]
push esi
push eax
mov dword [esp + 0x58], esi
call fcn.0047e7d0
add esp, 0xc
push 0x2b4
lea eax, [esp + 0x50]
push esi
push eax
call fcn.0047e7d0
add esp, 0xc
push 0x4009
push 0x2b4
lea eax, [esp + 0x54]
push eax
push esi
push dword [esp + 0x48]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
cmp dword [ebp + 8], esi
mov dword [ebx + 0x80], eax
je 0x42fa71
call fcn.0045ee43
movzx ecx, word [ebp + 8]
mov eax, dword [eax + 0xc]
push esi
push esi
push 0xff00ff
push esi
push 0x10
push ecx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
lea ecx, [ebx + 0x58]
push eax
call fcn.00462a2c
push dword [ebx + 0x5c]
call fcn.0045ee43
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.0040ba02
lea eax, [ebx + 0x58]
cmp eax, esi
jne 0x42fa55
xor eax, eax
jmp 0x42fa58
mov eax, dword [eax + 4]
push eax
push 2
push 0x1109
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.00462a04
jmp 0x42fa74
mov dword [ebx + 0x7c], esi
push 0xfffffffffffffff0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x17
push eax
push 0xfffffffffffffff0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esp + 0x18]
push esi
push 0x1109
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x14]
push 0xffff0000
push 1
push dword [esp + 0x40]
mov dword [ebx + 0x78], 7
push esi
push dword [eax]
push ebx
call fcn.004309ab
mov dword [esp + 0x10], eax
mov dword [ebx + 0x60], eax
mov eax, vtable.CPidl.0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
push 0x206
lea eax, [esp + 0x30a]
push esi
mov byte [esp + 0x528], 3
push eax
mov word [esp + 0x310], si
call fcn.0047e7d0
add esp, 0xc
lea eax, [ebx + 0x308]
push eax
push 0x11
push dword [ebx + 0x20]
mov dword [esp + 0x24], eax
call edi
lea eax, [esp + 0x30]
push eax
push 0x12
push dword [ebx + 0x20]
call edi
push esi
push 5
lea edi, [ebx + 0x94]
push edi
push esi
mov dword [esp + 0x4c], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
call fcn.0047ba0d
pop ecx
push edi
lea esi, [ebx + 0x2b0]
call fcn.0042b9e5
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x304]
push eax
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
push 0x8000
call fcn.0042e41b
test eax, eax
pop ecx
pop ecx
je 0x42fb8b
lea eax, [esp + 0x304]
push eax
call fcn.0047ba0d
pop ecx
lea ecx, [esp + 0x304]
push ecx
lea esi, [ebx + 0x2cc]
call fcn.0042b9e5
mov eax, dword [esp + 0x18]
mov edi, dword [eax]
lea eax, [esp + 0x304]
push eax
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
push 0x8000
call fcn.0042e41b
test eax, eax
pop ecx
pop ecx
je 0x42fbd0
lea eax, [esp + 0x304]
push eax
call fcn.0047ba0d
pop ecx
lea ecx, [esp + 0x304]
push ecx
lea esi, [ebx + 0x2e8]
call fcn.0042b9e5
mov eax, dword [esp + 0x30]
call fcn.0042e6e6
push eax
call fcn.0042e62a
pop ecx
mov dword [esp + 0x24], vtable.CPidl.0
mov dword [esp + 0x28], eax
mov byte [esp + 0x520], 4
cmp dword [0x4ee7dc], 0
je 0x42fc1b
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
test edx, edx
jne 0x42fc0d
and dword [esp + 0x1c], edx
jmp 0x42fc2f
push dword [esp + 0x10]
mov ecx, ebx
push eax
call fcn.00430669
jmp 0x42fc2b
push dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
call fcn.004302fe
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
call fcn.0042e6e6
push eax
call fcn.0042e62a
pop ecx
push eax
lea esi, [esp + 0x28]
call fcn.0042f5c7
push dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push dword [esp + 0x2c]
mov ecx, dword [eax]
call fcn.004302fe
mov ecx, dword [esp + 0x3c]
call fcn.0042e65f
mov dword [esp + 0x3c], vtable.CPidl.0
mov dword [esp + 0x40], eax
push eax
mov byte [esp + 0x524], 5
call fcn.0042e62a
pop ecx
push eax
call fcn.0042f5c7
push dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push dword [esp + 0x2c]
mov ecx, dword [eax]
call fcn.004302fe
push dword [esp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 2
push 0x1102
push dword [ebx + 0x20]
call esi
push dword [esp + 0x10]
push 9
push 0x110b
push dword [ebx + 0x20]
call esi
lea edi, [esp + 0x10]
mov esi, ebx
call fcn.00432272
lea eax, [ebx + 0x2e8]
push eax
push ebx
call fcn.00431da9
test eax, eax
je 0x42fcee
push eax
push 2
push 0x1102
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, ebx
call fcn.0042f83b
lea ecx, [esp + 0x3c]
mov byte [esp + 0x520], 4
call fcn.0042f5aa
lea ecx, [esp + 0x24]
mov byte [esp + 0x520], 3
call fcn.0042f5aa
lea ecx, [esp + 0x2c]
mov byte [esp + 0x520], 2
call fcn.0042f5aa
lea ecx, [esp + 0x44]
mov byte [esp + 0x520], 1
call fcn.0042f5aa
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00401325
mov esi, dword [esp + 0x1c]
jmp 0x42f96d