Function at 0x4b9260
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov ebx, dword [ebp + 0xc]
mov edi, ecx
push edi
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push 0
push 0
push eax
mov eax, dword [esi + 0xc]
sub eax, edx
mov dword [ebp - 0x280], edi
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
push 0x96800000
push ebx
push 0x4e742c
push 0
call edi
push 0x4e6f20
mov ecx, dword [ebp - 0x280]
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xfffffffffffffff0
mov dword [ecx + 4], eax
call dword [sym.imp.GDI32.dll_CreateFontW]
mov ecx, dword [ebp - 0x280]
push 0x7dc
mov dword [ebp - 0x298], 3
mov dword [ebp - 0x290], 0x1c
mov dword [ecx], eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
add eax, 0xfffffffb
mov dword [ebp - 0x294], eax
add eax, 0xffffffdd
mov dword [ebp - 0x29c], eax
call fcn.004bf3e2
mov esi, dword [ebp - 0x280]
lea ecx, [ebp - 0x29c]
sub esp, 0x14
mov dword [ebp - 0x284], eax
push ecx
push dword [esi + 4]
push ecx
mov ecx, eax
call fcn.004baed0
push 0
push 0
push 2
push dword [esi + 4]
mov dword [esi + 8], eax
push 0x1ae
push 0x230
push 0x32
push 0x14
push 0x5680800d
push 0
push str.SysListView32
push 0
call edi
mov edi, esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [edi]
mov dword [edi + 0xc], eax
push 0x30
push eax
call esi
push 0x10021
push 0x10021
push 0x1036
push dword [edi + 0xc]
call esi
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 7
push eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x23c], 2
push 0x1061
push dword [edi + 0xc]
movlpd qword [ebp - 0x234], xmm0
movlpd qword [ebp - 0x22c], xmm0
movlpd qword [ebp - 0x224], xmm0
movlpd qword [ebp - 0x21c], xmm0
mov dword [ebp - 0x238], 0
call esi
lea eax, [ebp - 0x240]
mov dword [ebp - 0x238], 0xf0
push eax
push 1
push 0x1061
push dword [edi + 0xc]
mov dword [ebp - 0x234], 0x4e746c
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push ebx
push 0x4e7414
mov dword [ebp - 0x238], 0x78
call esi
test eax, eax
mov edx, 0x4e747c
lea eax, [ebp - 0x240]
mov ecx, 0x4e7474
push eax
push 2
push 0x1061
push dword [edi + 0xc]
cmovne ecx, edx
mov dword [ebp - 0x234], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x240]
mov dword [ebp - 0x238], 0xc8
push eax
push 3
push 0x1061
push dword [edi + 0xc]
mov dword [ebp - 0x234], 0x4e7484
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x27c], 1
push eax
push 1
xorps xmm0, xmm0
push 0
push 0x23
push 0
movlpd qword [ebp - 0x278], xmm0
movlpd qword [ebp - 0x270], xmm0
movlpd qword [ebp - 0x268], xmm0
movlpd qword [ebp - 0x260], xmm0
movlpd qword [ebp - 0x258], xmm0
movlpd qword [ebp - 0x250], xmm0
movlpd qword [ebp - 0x248], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x4e731c
mov edx, 0x104
lea ecx, [ebp - 0x214]
call fcn.004b40b0
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.004b2c20
add esp, 8
push ebx
push 0x4e7414
call esi
test eax, eax
mov edx, 0x4e74a0
mov ecx, 0x4e7490
lea eax, [ebp - 0x214]
cmovne ecx, edx
push ecx
push str.select__from__ls
push 0x104
push eax
call fcn.004b5c10
mov ecx, dword [ebp - 0x28c]
lea eax, [ebp - 0x284]
push 0
push eax
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x214]
call fcn.004782c0
mov esi, dword [ebp - 0x284]
xor ebx, ebx
push esi
mov dword [ebp - 0x288], ebx
call fcn.004311e0
add esp, 0x24
cmp eax, 0x64
jne 0x4b96dc
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x278], ebx
push eax
push 0
push 0x104d
push dword [edi + 0xc]
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x268], 0
call dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
xor ebx, ebx
test esi, esi
je 0x4b95b3
movzx eax, word [esi + 0x98]
jmp 0x4b95b5
xor eax, eax
cmp edi, eax
jge 0x4b96b7
lea eax, [edi + 1]
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x274], eax
test esi, esi
jne 0x4b95f2
mov ecx, 0x4e33f0
movzx eax, word [ecx + 8]
mov edx, eax
and eax, 0x202
cmp eax, 0x202
jne 0x4b9642
cmp byte [ecx + 0xa], 2
jne 0x4b9642
mov edi, dword [ecx + 0x10]
jmp 0x4b9654
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4b9605
push eax
call dword [0x4ebac8]
add esp, 4
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x4b9622
movzx eax, word [esi + 0x98]
cmp edi, eax
jge 0x4b9622
test edi, edi
js 0x4b9622
add ecx, ebx
jmp 0x4b963a
mov ecx, dword [esi]
mov edx, 0x19
mov dword [ecx + 0x40], 0x19
call fcn.00407cf0
mov ecx, 0x4e33f0
test ecx, ecx
jne 0x4b95d5
xor edi, edi
jmp 0x4b9654
test dl, 1
je 0x4b964b
xor edi, edi
jmp 0x4b9654
mov dl, 2
call fcn.00429ed0
mov edi, eax
test esi, esi
je 0x4b9686
mov ecx, dword [esi]
mov edx, dword [esi + 0x28]
cmp byte [ecx + 0x53], 0
jne 0x4b966b
test edx, edx
jne 0x4b966b
xor eax, eax
jmp 0x4b9670
call fcn.00404df0
mov dword [esi + 0x28], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4b9686
push eax
call dword [0x4ebad0]
add esp, 4
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x268], edi
push eax
mov eax, dword [ebp - 0x280]
push 0
push 0x104c
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x284]
add ebx, 0x28
jmp 0x4b95a6
mov ebx, dword [ebp - 0x288]
inc ebx
push esi
mov dword [ebp - 0x288], ebx
call fcn.004311e0
mov edi, dword [ebp - 0x280]
add esp, 4
cmp eax, 0x64
je 0x4b9571
push esi
call fcn.0042ff80
mov ecx, dword [ebp - 0x28c]
add esp, 4
xor edx, edx
call fcn.004afb00
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bf1a3
mov esp, ebp
pop ebp
ret 0xc