Function at 0x404494
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
mov esi, 0x104
push edi
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419d00
push edi
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x4044b6
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419cf4
push edi
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x4044df
lea eax, [ebp - 0x10c]
push 0x41da98
push eax
call fcn.0040b270
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419ce4
push edi
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x40450d
push 0x419cb8
push 0x80000002
push 0x419ca8
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0040709e
add esp, 0x14
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c98
push edi
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x404547
mov esi, dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
call esi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 8]
push eax
push 7
push 0
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c8c
push dword [ebp + 8]
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x4045a3
lea eax, [ebp - 4]
push eax
call esi
lea eax, [ebp - 8]
push eax
push 2
push 0
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c78
push dword [ebp + 8]
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x4045f5
lea eax, [ebp - 4]
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0x10
push 0
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c6c
push dword [ebp + 8]
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x404647
mov ebx, dword [ebp + 8]
push 0x419c5c
push ebx
call fcn.0040b9a0
pop ecx
test eax, eax
pop ecx
je 0x404703
lea eax, [ebp - 0x10c]
push 0x41d408
push eax
call fcn.0040b270
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
call esi
lea eax, [ebp - 8]
push eax
push 0x1a
push 0
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10c]
push eax
call fcn.00405a1d
lea eax, [ebp - 0x10c]
mov dword [esp], 0x419c30
push eax
call fcn.0040b280
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c5c
push ebx
call fcn.004043f8
mov ebx, dword [ebp + 8]
add esp, 0x10
test al, al
jne 0x4046e5
push 0x419c20
push ebx
call fcn.0040b9a0
pop ecx
test eax, eax
pop ecx
je 0x404777
lea eax, [ebp - 0x10c]
push 0x41d408
push eax
call fcn.0040b270
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
call esi
lea eax, [ebp - 8]
push eax
push 5
push 0
call edi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c20
push ebx
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x40475c
mov esi, 0x419c14
push esi
push ebx
call fcn.0040b9a0
pop ecx
test eax, eax
pop ecx
je 0x40479e
push 0
push 0x41dba0
push esi
push ebx
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x404789
mov ecx, dword [0x41deb8]
test ecx, ecx
je 0x4047cf
lea eax, [ebp - 0x10c]
push eax
call fcn.0040342c
lea eax, [ebp - 0x10c]
push 1
push eax
push 0x419c08
push ebx
call fcn.004043f8
add esp, 0x10
test al, al
jne 0x4047b4
push ebx
call fcn.0040b7d0
cmp eax, 2
pop ecx
jbe 0x404804
lea eax, [ebx + 2]
jmp 0x4047fe
cmp cl, 0x5c
jne 0x4047fd
lea ecx, [eax + 1]
cmp byte [ecx], 0x5c
jne 0x4047fd
jmp 0x4047f8
lea esi, [ecx + 1]
mov dl, byte [esi]
mov byte [ecx], dl
mov ecx, esi
cmp byte [ecx], 0
jne 0x4047ef
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x4047e0
pop edi
pop esi
pop ebx
leave
ret