Function at 0x41905f
Capabilities:
Get common file path
Get startup folder
List user accounts

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
lea edx, [ebp - 0x2c]
push ebx
push esi
push edi
mov ecx, 0xd5
xor bl, bl
call fcn.0041c8a9
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4192ae
lea edx, [ebp - 0x4c]
mov ecx, 0xd6
call fcn.0041c861
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x419121
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x258]
push ecx
mov dword [ebp - 4], 0x104
call eax
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x419121
lea eax, [ebp - 0x460]
push eax
push ecx
push 0xffffffffffffffff
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x419121
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x419121
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x460]
push 0xffffffffffffffff
lea edx, [edx + eax*2]
lea ecx, [ebp - 0x460]
call fcn.0043397c
inc bl
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test bl, bl
je 0x4192ae
xor bl, bl
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0
call dword [sym.imp.NETAPI32.dll_NetUserEnum]
mov edi, eax
test edi, edi
je 0x41916a
cmp edi, 0xea
jne 0x419250
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x419244
xor esi, esi
cmp dword [ebp - 0xc], esi
jbe 0x41923d
lea eax, [ebp - 8]
push eax
push 0x17
push dword [ecx + esi*4]
push 0
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x419230
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x419230
mov ecx, dword [ecx + 0x10]
lea edx, [ebp - 0x258]
call fcn.0040acf6
test al, al
je 0x419227
lea eax, [ebp - 0x460]
lea edx, [ebp - 0x258]
push eax
mov ecx, edx
call fcn.00419668
test eax, eax
je 0x419227
lea ecx, [ebp - 0x258]
call fcn.0041acb7
test al, al
je 0x419227
lea eax, [ebp - 0x668]
push eax
push ecx
push ecx
push 0x4000080
push 0x407a84
lea edx, [ebp - 0x258]
xor ecx, ecx
call fcn.0043153a
test eax, eax
je 0x419227
push 0
lea edx, [ebp - 0x668]
xor ecx, ecx
call fcn.0040be12
test al, al
je 0x419227
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x668]
mov ecx, dword [ecx + 0x10]
mov bl, 1
call fcn.00418d01
push dword [ebp - 8]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov ecx, dword [ebp - 4]
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x419180
push ecx
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp edi, 0xea
je 0x419136
lea eax, [ebp - 0x460]
push eax
push 1
push 0xffffffffffffffff
push 0x8007
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4192aa
lea eax, [ebp - 0x668]
push eax
push ecx
push ecx
push 0x4000080
push 0x407a84
lea edx, [ebp - 0x460]
xor ecx, ecx
call fcn.0043153a
test eax, eax
je 0x4192aa
push 0
lea edx, [ebp - 0x668]
xor ecx, ecx
call fcn.0040be12
movzx ebx, bl
test al, al
push 1
pop eax
cmovne ebx, eax
mov al, bl
jmp 0x4192b0
xor al, al
pop edi
pop esi
pop ebx
leave
ret