Function at 0x4024c8
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a4667
mov eax, dword fs:[0]
push eax
sub esp, 0x344
mov eax, dword [0x6274d0]
xor eax, esp
mov dword [esp + 0x33c], eax
push esi
push edi
mov eax, dword [0x6274d0]
xor eax, esp
push eax
lea eax, [esp + 0x350]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x358], esi
push 7
pop eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0x110], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0xf0], esi
mov word [esp + 0xe0], cx
mov dword [esp + 0x10c], esi
mov word [esp + 0xfc], ax
mov byte [esp + 0x358], 1
push 0x208
mov word [esp + 0x138], ax
lea eax, [esp + 0x13a]
push esi
push eax
call fcn.00560d40
add esp, 0xc
lea eax, [esp + 0x134]
push eax
push esi
push esi
push 0x28
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, esi
jge 0x402653
lea eax, [esp + 0x2c]
push eax
call fcn.00409ac6
mov esi, eax
push str.GFE::Applications::ApplicationDetector::GetSettingsForSHIM:_SHGetFolderPath_failed_with
push esi
mov byte [esp + 0x360], 2
call fcn.0040fa1f
pop ecx
pop ecx
push edi
push esi
call fcn.0040d526
lea eax, [esp + 0xc4]
push eax
mov eax, esi
call fcn.00409b30
mov byte [esp + 0x358], 3
cmp dword [esp + 0xd8], 8
mov eax, dword [esp + 0xc4]
jae 0x4025f4
lea eax, [esp + 0xc4]
push eax
push 2
pop ecx
call fcn.0047c666
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xc8]
call fcn.0040b028
lea eax, [esp + 0x2c]
mov byte [esp + 0x358], 1
call fcn.004021a3
lea eax, [esp + 0x1c]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x402795
mov esi, ebx
call fcn.0040b44a
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
jmp 0x402795
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc4]
push eax
call fcn.0040381b
mov byte [esp + 0x358], 6
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xc4]
sub eax, ecx
push 0x1c
cdq
pop edi
idiv edi
cmp eax, esi
jbe 0x4026ef
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x134]
push eax
lea esi, [esp + 0x11c]
call fcn.00409096
push dword [esp + 0x14]
call fcn.0040cedf
pop ecx
push 1
xor edi, edi
mov byte [esp + 0x17], al
call fcn.0040b028
cmp byte [esp + 0x13], 0
je 0x4026e4
lea eax, [esp + 0x134]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4026ca
mov ecx, dword [esp + 0x14]
sub eax, edx
sar eax, 1
push 0xd
call fcn.0040add2
add dword [esp + 0x14], 0x1c
dec dword [esp + 0x18]
jne 0x40268e
push str.SearchPaths
lea eax, [esp + 0xe4]
push eax
call fcn.0040ad38
push 0x5c29f0
lea esi, [esp + 0x11c]
call fcn.00409096
mov eax, esi
push eax
lea eax, [esp + 0x100]
lea ecx, [esp + 0xc8]
mov byte [esp + 0x35c], 7
call fcn.0040ce61
pop ecx
push 1
xor edi, edi
mov byte [esp + 0x35c], 6
call fcn.0040b028
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x1c]
call fcn.0040a271
lea eax, [esp + 0x1c]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x402789
mov esi, ebx
call fcn.0040b44a
mov eax, dword [esp + 0x1c]
mov dword [ebx], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 8], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
lea esi, [esp + 0xc4]
call fcn.0040b1e1
push 1
xor edi, edi
lea esi, [esp + 0x100]
call fcn.0040b028
push 1
lea esi, [esp + 0xe4]
call fcn.0040b028
lea esi, [esp + 0x1c]
call fcn.0040b44a
mov eax, ebx
mov ecx, dword [esp + 0x350]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x33c]
xor ecx, esp
call fcn.0055d7fe
mov esp, ebp
pop ebp
ret 4