Function at 0x46f240
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x46f269
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2a
jae 0x46f517
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d670]
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 8
ja case.default.0x46f2b1
mov eax, dword [ebp - 0x118]
jmp dword [eax*4 + 0x46f521]
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d674]
push edx
push 0x104
lea eax, [ebp - 0x10c]
push eax
call fcn.00409190
jmp 0x46f496
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d674]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
push 0x104
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [eax + 0x52d674]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d674]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
push 0x104
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x109], 0
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [eax + 0x52d674]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
push 0
push 0x18
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x46f3d4
jmp 0x46f260
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d674]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
push 0
push 7
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x46f40f
jmp 0x46f260
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d674]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [eax + 0x52d674]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
push 0
push 0x26
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x46f475
jmp 0x46f260
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d674]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x46f496
jmp 0x46f260
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0042ae0a
add esp, 4
test eax, eax
jne 0x46f4ae
jmp 0x46f260
mov edx, dword [ebp - 4]
shl edx, 4
cmp dword [edx + 0x52d678], 0
je 0x46f4db
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 4]
shl ecx, 4
call dword [ecx + 0x52d678]
add esp, 4
mov dword [ebp - 0x110], eax
jmp 0x46f4ed
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d67c]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [ebp + 8]
jmp 0x46f260
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret 8