Function at 0x42eb7a
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x489c5a
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x4bc760]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
push esi
push edi
mov eax, dword [0x4bc760]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x28], 7
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov word [esp + 0x14], ax
mov dword [esp + 0x280], ecx
lea edi, [esp + 0x5c]
mov ecx, 0x82
mov edx, str.DESKTOP
rep stosd dword es:[edi], eax
mov ecx, ebx
stosw word es:[edi], ax
call fcn.00415159
test al, al
je 0x42ec28
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x10
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 1
jmp 0x42f00d
mov edx, str.DOWNLOADS
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ec8b
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x28
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
call fcn.0040ca1c
pop ecx
push eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040dec8
mov edi, 0x4a6670
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.0040dd92
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.0042f1e2
jmp 0x42f024
mov edx, str.USERPROFILE
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ecc8
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x28
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 2
jmp 0x42f00d
mov edx, str.LOCALAPPDATA
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ed05
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 3
jmp 0x42f00d
mov edx, str.APPDATA
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ed42
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 4
jmp 0x42f00d
mov edx, str.ProgramFiles_x86_
mov ecx, ebx
call fcn.00415159
test al, al
jne 0x42efd3
mov edx, str.ProgramFiles__x86_
mov ecx, ebx
call fcn.00415159
test al, al
jne 0x42efd3
mov edx, str.WINDOWS
mov ecx, ebx
call fcn.00415159
test al, al
jne 0x42efa9
mov edx, str.WINDIR
mov ecx, ebx
call fcn.00415159
test al, al
jne 0x42efa9
mov edx, str.ProgramFiles
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ee7a
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
lea edx, [esp + 0x2c]
mov byte [esp + 0x280], 7
lea ecx, [esp + 0x44]
call fcn.0042f1e2
lea ecx, [esp + 0x14]
mov byte [esp + 0x280], 8
cmp ecx, eax
je 0x42edf4
push 0xffffffffffffffff
push ebx
push eax
call fcn.0040de35
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040d9e7
push ebx
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x288], bl
call fcn.0040d9e7
mov edi, 0x4a1a20
push edi
call fcn.0040ca1c
pop ecx
push eax
push ebx
push edi
lea ecx, [esp + 0x20]
call fcn.0041462f
inc eax
lea ecx, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x4c]
push eax
call fcn.0040d806
push eax
lea ecx, [esp + 0x18]
call fcn.0040d7d7
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040d9e7
mov edi, str.Program_Files
push edi
call fcn.0040ca1c
pop ecx
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.0040dd92
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0040d7b2
jmp 0x42f024
mov edx, str.TEMP
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ef5f
lea eax, [esp + 0x5c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42eee8
dec eax
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0040dec8
lea edx, [esp + 0x14]
lea ecx, [esp + 0x44]
call fcn.0042f1e2
lea ecx, [esp + 0x14]
mov byte [esp + 0x280], 9
xor ebx, ebx
cmp ecx, eax
je 0x42eeda
push 0xffffffffffffffff
push ebx
push eax
call fcn.0040de35
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040d9e7
jmp 0x42ee69
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
lea edx, [esp + 0x2c]
mov byte [esp + 0x280], 0xa
lea ecx, [esp + 0x44]
call fcn.0042f1e2
lea ecx, [esp + 0x14]
mov byte [esp + 0x280], 0xb
cmp ecx, eax
je 0x42ef36
push 0xffffffffffffffff
push ebx
push eax
call fcn.0040de35
push ebx
push 1
lea ecx, [esp + 0x4c]
call fcn.0040d9e7
push ebx
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x288], bl
call fcn.0040d9e7
mov edi, str.Temp
jmp 0x42ee57
mov edx, str.STARTUP
mov ecx, ebx
call fcn.00415159
test al, al
je 0x42ef99
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 7
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 0xc
jmp 0x42f00d
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0040d7b2
xor ebx, ebx
jmp 0x42f024
lea eax, [esp + 0x5c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 6
jmp 0x42f00d
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x5c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x2a
push ebx
call edi
test eax, eax
je 0x42eff7
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x26
push ebx
call edi
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x30]
call fcn.0040d781
mov byte [esp + 0x280], 5
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.0042f1e2
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.0040d9e7
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.0040d9e7
mov eax, esi
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.00466746
mov esp, ebp
pop ebp
ret