Function at 0x424990
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a48c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
mov dword [ebp - 0x3cc], ecx
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 4], 1
push 0
push 0x4b0e58
lea ecx, [ebp + 0xc]
call fcn.00411e10
test eax, eax
jl 0x424e22
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24c], esp
push 0x4b0e54
call fcn.00401fb0
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp + 0xc]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x2f0]
call fcn.004123d0
mov dword [ebp - 0x3d8], eax
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp - 0x3dc], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x3dc]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x26c]
call fcn.00401fb0
mov dword [ebp - 0x3e0], eax
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x3e4], edx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x3e4]
call fcn.00401c20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x250], esp
push eax
call fcn.00401fb0
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x22c]
push ecx
mov byte [ebp - 4], 7
call fcn.00406900
add esp, 0x3c
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x26c]
call fcn.00401c00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2f0]
call fcn.00412410
push fcn.004863e3
lea edx, [ebp - 0x2f8]
push edx
push 1
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
mov ecx, eax
call fcn.00412050
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x300]
push eax
push 1
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
mov ecx, eax
call fcn.00412080
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x308]
push eax
push 1
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
mov ecx, eax
call fcn.00412050
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.0042b350
add esp, 0x20
lea ecx, [ebp - 0x214]
push ecx
push 0
push 0
push 1
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x314], esp
push eax
call fcn.00401bc0
mov dword [ebp - 0x3f4], eax
mov edx, dword [ebp - 0x3f4]
mov dword [ebp - 0x3f8], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x3cc]
mov edx, dword [eax]
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x3cc]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x3fc], eax
mov ecx, dword [ebp - 0x3fc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x424e13
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x230]
call fcn.0040fbc0
mov byte [ebp - 4], 0xc
push str.PROGRAMFILES
push 1
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
push eax
call fcn.0042b330
add esp, 8
movzx eax, al
test eax, eax
je 0x424c27
push 0
push 0x4b0e4c
lea ecx, [ebp - 0x230]
call fcn.00411e10
test eax, eax
jl 0x424c27
push 0x4ade8c
push str._x86_
lea ecx, [ebp - 0x230]
call fcn.00427d90
lea ecx, [ebp - 0x230]
call fcn.00427fd0
jmp 0x424da1
push str.SYSTEMDRIVE
push 1
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
push eax
call fcn.0042b330
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x424da1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x318], esp
push 0x4b09ac
call fcn.00401fb0
mov dword [ebp - 0x400], eax
mov edx, dword [ebp - 0x400]
mov dword [ebp - 0x404], edx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x230]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x3bc]
call fcn.004123d0
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x40c], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x40c]
call fcn.0043fc50
push eax
lea ecx, [ebp - 0x338]
call fcn.00401fb0
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
mov dword [ebp - 0x414], ecx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x414]
call fcn.00401c20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x31c], esp
push eax
call fcn.00401fb0
mov dword [ebp - 0x418], eax
mov edx, dword [ebp - 0x418]
mov dword [ebp - 0x41c], edx
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 0x12
call fcn.00406900
add esp, 0x3c
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x338]
call fcn.00401c00
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3bc]
call fcn.00412410
push 0
lea ecx, [ebp - 0x248]
call fcn.00453cc0
mov ecx, eax
call fcn.00401c20
push eax
lea ecx, [ebp - 0x3c0]
call fcn.004132d0
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x428], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x428]
push edx
lea ecx, [ebp - 0x230]
call fcn.00413340
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x3c0]
call fcn.0043bb20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x248]
call fcn.00408130
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp + 0xc]
call fcn.00413340
push 2
lea ecx, [ebp - 0x22c]
call fcn.00453cc0
mov ecx, eax
call fcn.00401c20
push eax
lea ecx, [ebp - 0x3c4]
call fcn.004132d0
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x430]
push edx
lea ecx, [ebp + 0xc]
call fcn.00408de0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3c4]
call fcn.0043bb20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x230]
call fcn.0043bb20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x22c]
call fcn.00408130
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004059f0
mov ecx, dword [ebp - 0x3c8]
or ecx, 1
mov dword [ebp - 0x3c8], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043bb20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8