Function at 0x429cb3
Capabilities:
Get common file path
Get program files directory
Get session user name
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42a813
mov edx, dword [ebp - 0x10c]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x42a813
mov ecx, dword [ebp - 0x10c]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x42a813
mov dword [ebp - 0x110], 1
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax]
cmp ecx, 0x25
jne 0x42a7d5
push 9
mov edx, dword [ebp - 0x10c]
push edx
push str._windows_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429d57
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42a736
push 0xa
mov ecx, dword [ebp - 0x10c]
push ecx
push 0x4daf38
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429d88
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42a736
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._sysdisk_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429dc0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x106], 0
jmp 0x42a736
push 6
mov edx, dword [ebp - 0x10c]
push edx
push 0x4daf50
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429df1
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42a736
push 5
mov ecx, dword [ebp - 0x10c]
push ecx
push str._tmp_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429e22
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42a736
push 6
mov eax, dword [ebp - 0x10c]
push eax
push str._user_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429f32
mov dword [ebp - 0x31c], 0x104
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x429e71
mov dword [ebp - 0x110], 0
jmp 0x42a813
mov byte [ebp - 0x318], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x16
lea eax, [ebp - 0x318]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429eb0
mov dword [ebp - 0x110], 0
jmp 0x42a813
lea ecx, [ebp - 0x318]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jbe 0x429f2d
push str.All_Users
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x429f2d
mov eax, dword [ebp - 0x324]
lea ecx, [ebp - 0x318]
sub eax, ecx
mov dword [ebp - 0x320], eax
mov edx, dword [ebp - 0x320]
mov byte [ebp + edx - 0x318], 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x318]
push ecx
push 0x4daf74
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0040a150
add esp, 0x14
jmp 0x42a736
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._APPDATA_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429f72
push 0
push 0x1a
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429f6d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x10
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_APPDATA_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429fb2
push 0
push 0x23
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429fad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x12
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_DOCUMENTS_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x429ff2
push 0
push 0x2e
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x429fed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_FAVORITES_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a032
push 0
push 0x1f
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a02d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x11
mov edx, dword [ebp - 0x10c]
push edx
push 0x4dafc4
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a072
push 0
push 0x17
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a06d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x12
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_STARTMENU_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a0b2
push 0
push 0x16
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a0ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x10
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_STARTUP_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a0f2
push 0
push 0x18
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a0ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._CONTROLS_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a132
push 0
push 3
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a12d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 9
mov ecx, dword [ebp - 0x10c]
push ecx
push str._DESKTOP_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a172
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a16d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._DESKTOPDIRECTORY_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a1b2
push 0
push 0x10
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a1ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x11
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_PROGRAMS_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a1f2
push 0
push 0x17
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a1ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xb
mov ecx, dword [ebp - 0x10c]
push ecx
push str._FAVORITES_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a232
push 0
push 6
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a22d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xf
mov eax, dword [ebp - 0x10c]
push eax
push str._LOCAL_APPDATA_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a272
push 0
push 0x1c
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a26d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._PERSONAL_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a2b2
push 0
push 5
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a2ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x16
mov ecx, dword [ebp - 0x10c]
push ecx
push str._PROGRAM_FILES_COMMON_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a2f2
push 0
push 0x2b
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a2ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xf
mov eax, dword [ebp - 0x10c]
push eax
push str._PROGRAM_FILES_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a332
push 0
push 0x26
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a32d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._PROGRAMS_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a372
push 0
push 2
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a36d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 8
mov ecx, dword [ebp - 0x10c]
push ecx
push str._SYSTEM_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a3b2
push 0
push 0x25
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a3ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._WINDOWS_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a3f2
push 0
push 0x24
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a3ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 8
mov edx, dword [ebp - 0x10c]
push edx
push str._WINDIR_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a432
push 0
push 0x24
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a42d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xc
mov ecx, dword [ebp - 0x10c]
push ecx
push str._SYSTEMROOT_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a472
push 0
push 0x24
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a46d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xd
mov eax, dword [ebp - 0x10c]
push eax
push str._CDBURN_AREA_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a4b2
push 0
push 0x3b
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a4ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xe
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_MUSIC_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a4f2
push 0
push 0x35
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a4ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x11
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_PICTURES_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a532
push 0
push 0x36
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a52d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_TEMPLATES_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a572
push 0
push 0x2d
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a56d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xe
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_VIDEO_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a5b2
push 0
push 0x37
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a5ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 9
mov ecx, dword [ebp - 0x10c]
push ecx
push str._PROFILE_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a5f2
push 0
push 0x28
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a5ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x19
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_DESKTOPDIRECTORY_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a632
push 0
push 0x19
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a62d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 9
mov edx, dword [ebp - 0x10c]
push edx
push str._COOKIES_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a672
push 0
push 0x21
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a66d
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 7
mov ecx, dword [ebp - 0x10c]
push ecx
push str._FONTS_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a6b2
push 0
push 0x14
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a6ad
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0x10
mov eax, dword [ebp - 0x10c]
push eax
push str._INTERNET_CACHE_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a6ef
push 0
push 0x20
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a6ed
mov dword [ebp - 0x110], 0
jmp 0x42a736
push 0xb
mov edx, dword [ebp - 0x10c]
push edx
push str._PRINTHOOD_
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x42a72c
push 0
push 0x1b
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42a72a
mov dword [ebp - 0x110], 0
jmp 0x42a736
mov dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0
je 0x42a7d5
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x108]
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x328]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x42a77d
mov edx, dword [ebp - 0x328]
movsx eax, byte [edx - 1]
cmp eax, 0x2f
jne 0x42a787
mov ecx, dword [ebp - 0x328]
mov byte [ecx - 1], 0
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00409000
mov edx, dword [ebp + 0xc]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp + 0xc], ecx
push 0x25
mov edx, dword [ebp - 0x10c]
add edx, 1
push edx
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x429cd5
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
jae 0x42a7fb
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10c]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
jmp 0x42a7ff
xor eax, eax
jmp 0x42a818
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x429cd5
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret