Function at 0x10003cc0
Capabilities:
Get common file path
Get startup folder
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10029dae
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x6fec
call fcn.10027ba0
mov eax, dword [0x10045070]
xor eax, esp
mov dword [esp + 0x6fe8], eax
push ebx
push esi
push edi
mov eax, dword [0x10045070]
xor eax, esp
push eax
lea eax, [esp + 0x7000]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
push dword [eax + 4]
mov ecx, esi
call fcn.10008840
mov eax, dword [esi]
mov ecx, ebx
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
mov dword [esi + 4], 0
mov eax, dword [ebx]
push dword [eax + 4]
call fcn.10008840
mov eax, dword [ebx]
mov dword [eax + 4], eax
mov eax, dword [ebx]
mov dword [eax], eax
mov eax, dword [ebx]
mov dword [eax + 8], eax
mov dword [ebx + 4], 0
call fcn.100250a0
mov byte [esp + 0x37], al
xor eax, eax
push 0x206
push eax
mov word [esp + 0x330c], ax
lea eax, [esp + 0x330e]
push eax
call sub.MSVCR110.dll_memset
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
lea eax, [esp + 0x3304]
push 0
push 0x30
push eax
push 0
call edi
test eax, eax
je 0x10003ef5
lea ecx, [esp + 0x3304]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003da0
sub ecx, edx
sar ecx, 1
je 0x10003ef5
lea eax, [esp + 0x38]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0x30
call fcn.10008710
push 0x10
push 0x1002fb58
mov ecx, eax
call fcn.10009b60
lea eax, [esp + 0x3304]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x30
call fcn.100096c0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x700c], 0
call fcn.10008710
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x10003e4b
cmp dword [eax + 0x14], 8
jb 0x10003e30
push dword [eax]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add esp, 4
xor edx, edx
push ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov ecx, eax
mov word [eax], dx
call fcn.10009620
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10003e6a
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x3c], 0x30
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 1
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4144], ax
lea eax, [esp + 0x4146]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x413c]
push 0
push 0x1d
push eax
push 0
call edi
test eax, eax
je 0x1000408c
lea ecx, [esp + 0x413c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003f37
sub ecx, edx
sar ecx, 1
je 0x1000408c
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x18], 0x1d
call fcn.10008710
push 0x10
push str.CSIDL_ALTSTARTUP
mov ecx, eax
call fcn.10009b60
lea eax, [esp + 0x413c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1d
call fcn.100096c0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x700c], 2
call fcn.10008710
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x10003fe2
cmp dword [eax + 0x14], 8
jb 0x10003fc7
push dword [eax]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add esp, 4
xor edx, edx
push ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov ecx, eax
mov word [eax], dx
call fcn.10009620
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004001
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x1d
mov dword [esp + 0x3c], 0x1d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 3
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x65c], ax
lea eax, [esp + 0x65e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x654]
push 0
push 0x1a
push eax
push 0
call edi
test eax, eax
je 0x10004225
lea ecx, [esp + 0x654]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100040d0
sub ecx, edx
sar ecx, 1
je 0x10004225
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x18], 0x1a
call fcn.10008710
push 0xd
push str.CSIDL_APPDATA
mov ecx, eax
call fcn.10009b60
lea eax, [esp + 0x654]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1a
call fcn.100096c0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x700c], 4
call fcn.10008710
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x1000417b
cmp dword [eax + 0x14], 8
jb 0x10004160
push dword [eax]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add esp, 4
xor edx, edx
push ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov ecx, eax
mov word [eax], dx
call fcn.10009620
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x1000419a
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x1a
mov dword [esp + 0x3c], 0x1a
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 5
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3b2c], ax
lea eax, [esp + 0x3b2e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3b24]
push 0
push 0xa
push eax
push 0
call edi
test eax, eax
je 0x100043bc
lea ecx, [esp + 0x3b24]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004267
sub ecx, edx
sar ecx, 1
je 0x100043bc
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x18], 0xa
call fcn.10008710
push 0xf
push str.CSIDL_BITBUCKET
mov ecx, eax
call fcn.10009b60
lea eax, [esp + 0x3b24]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xa
call fcn.100096c0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x700c], 6
call fcn.10008710
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x10004312
cmp dword [eax + 0x14], 8
jb 0x100042f7
push dword [eax]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
add esp, 4
xor edx, edx
push ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
mov ecx, eax
mov word [eax], dx
call fcn.10009620
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004331
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0xa
mov dword [esp + 0x3c], 0xa
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 7
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0xa6c], ax
lea eax, [esp + 0xa6e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0xa64]
push 0
push 0x3b
push eax
push 0
call edi
test eax, eax
je 0x1000451f
lea ecx, [esp + 0xa64]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004400
sub ecx, edx
sar ecx, 1
je 0x1000451f
push str.CSIDL_CDBURN_AREA
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x3b
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0xa64]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x3b
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 8
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004494
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x3b
mov dword [esp + 0x3c], 0x3b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 9
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x67dc], ax
lea eax, [esp + 0x67de]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x67d4]
push 0
push 0x2f
push eax
push 0
call edi
test eax, eax
je 0x10004680
lea ecx, [esp + 0x67d4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004561
sub ecx, edx
sar ecx, 1
je 0x10004680
push str.CSIDL_COMMON_ADMINTOOLS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x2f
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x67d4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x2f
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0xa
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x100045f5
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x2f
mov dword [esp + 0x3c], 0x2f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0xb
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0xe7c], ax
lea eax, [esp + 0xe7e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0xe74]
push 0
push 0x1e
push eax
push 0
call edi
test eax, eax
je 0x100047e1
lea ecx, [esp + 0xe74]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100046c2
sub ecx, edx
sar ecx, 1
je 0x100047e1
push str.CSIDL_COMMON_ALTSTARTUP
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x1e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0xe74]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1e
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0xc
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004756
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x1e
mov dword [esp + 0x3c], 0x1e
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0xd
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3f3c], ax
lea eax, [esp + 0x3f3e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3f34]
push 0
push 0x23
push eax
push 0
call edi
test eax, eax
je 0x10004942
lea ecx, [esp + 0x3f34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004823
sub ecx, edx
sar ecx, 1
je 0x10004942
push str.CSIDL_COMMON_APPDATA
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x23
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x3f34]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x23
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0xe
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x100048b7
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x23
mov dword [esp + 0x3c], 0x23
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0xf
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x128c], ax
lea eax, [esp + 0x128e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x1284]
push 0
push 0x19
push eax
push 0
call edi
test eax, eax
je 0x10004aa3
lea ecx, [esp + 0x1284]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004984
sub ecx, edx
sar ecx, 1
je 0x10004aa3
push str.CSIDL_COMMON_DESKTOPDIRECTORY
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x19
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x1284]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x19
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x10
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004a18
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x19
mov dword [esp + 0x3c], 0x19
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x11
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x579c], ax
lea eax, [esp + 0x579e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x5794]
push 0
push 0x2e
push eax
push 0
call edi
test eax, eax
je 0x10004c04
lea ecx, [esp + 0x5794]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004ae5
sub ecx, edx
sar ecx, 1
je 0x10004c04
push str.CSIDL_COMMON_DOCUMENTS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x2e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x5794]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x2e
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x12
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004b79
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x2e
mov dword [esp + 0x3c], 0x2e
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x13
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x169c], ax
lea eax, [esp + 0x169e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x1694]
push 0
push 0x1f
push eax
push 0
call edi
test eax, eax
je 0x10004d65
lea ecx, [esp + 0x1694]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004c46
sub ecx, edx
sar ecx, 1
je 0x10004d65
push str.CSIDL_COMMON_FAVORITES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x1f
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x1694]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1f
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x14
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004cda
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x1f
mov dword [esp + 0x3c], 0x1f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x15
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x434c], ax
lea eax, [esp + 0x434e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x4344]
push 0
push 0x35
push eax
push 0
call edi
test eax, eax
je 0x10004ec6
lea ecx, [esp + 0x4344]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004da7
sub ecx, edx
sar ecx, 1
je 0x10004ec6
push str.CSIDL_COMMON_MUSIC
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x35
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x4344]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x35
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x16
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
mov dword [esp + 0x7008], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x10004e3b
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x35
mov dword [esp + 0x3c], 0x35
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x17
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x1aac], ax
lea eax, [esp + 0x1aae]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x1aa4]
push 0
push 0x3a
push eax
push 0
call edi
test eax, eax
je 0x10005024
lea ecx, [esp + 0x1aa4]
lea edx, [ecx + 2]
jmp 0x10004f10
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004f10
sub ecx, edx
sar ecx, 1
je 0x10005024
push str.CSIDL_COMMON_OEM_LINKS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x3a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x1aa4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x3a
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x18
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x3a
mov dword [esp + 0x3c], 0x3a
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x19
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x63cc], ax
lea eax, [esp + 0x63ce]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x63c4]
push 0
push 0x36
push eax
push 0
call edi
test eax, eax
je 0x1000517a
lea ecx, [esp + 0x63c4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005066
sub ecx, edx
sar ecx, 1
je 0x1000517a
push str.CSIDL_COMMON_PICTURES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x36
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x63c4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x36
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x1a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x36
mov dword [esp + 0x3c], 0x36
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x1b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x1ebc], ax
lea eax, [esp + 0x1ebe]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x1eb4]
push 0
push 0x17
push eax
push 0
call edi
test eax, eax
je 0x100052e2
lea ecx, [esp + 0x1eb4]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100051c0
sub ecx, edx
sar ecx, 1
je 0x100052e2
push str.CSIDL_COMMON_PROGRAMS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x17
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x1eb4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x17
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x1c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x17
mov dword [esp + 0x3c], 0x17
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
xor edx, edx
push 0xffffffffffffffff
push edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], dx
call fcn.100097e0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x1d
call fcn.10008710
sub esp, 0x18
mov esi, esp
push ecx
mov ecx, esi
mov edi, eax
call fcn.10009ce0
push 0
push 0
mov ecx, esi
call fcn.10009d00
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.100097e0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea esi, [ebx + 8]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x475c], ax
lea eax, [esp + 0x475e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x4754]
push 0
push 0x16
push eax
push 0
call edi
test eax, eax
je 0x1000540c
lea ecx, [esp + 0x4754]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005324
sub ecx, edx
sar ecx, 1
je 0x1000540c
push str.CSIDL_COMMON_STARTMENU
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x16
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x4754]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x16
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x1e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x16
mov dword [esp + 0x3c], 0x16
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x1f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x22cc], ax
lea eax, [esp + 0x22ce]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x22c4]
push 0
push 0x18
push eax
push 0
call edi
test eax, eax
je 0x10005538
lea ecx, [esp + 0x22c4]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005450
sub ecx, edx
sar ecx, 1
je 0x10005538
push str.CSIDL_COMMON_STARTUP
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x18
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x22c4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x18
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x20
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x3c], 0x18
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x21
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5bac], ax
lea eax, [esp + 0x5bae]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x5ba4]
push 0
push 0x2d
push eax
push 0
call edi
test eax, eax
je 0x10005668
lea ecx, [esp + 0x5ba4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005580
sub ecx, edx
sar ecx, 1
je 0x10005668
push str.CSIDL_COMMON_TEMPLATES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x2d
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x5ba4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x2d
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x22
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x2d
mov dword [esp + 0x3c], 0x2d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x23
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x26dc], ax
lea eax, [esp + 0x26de]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x26d4]
push 0
push 0x37
push eax
push 0
call edi
test eax, eax
je 0x10005798
lea ecx, [esp + 0x26d4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100056b0
sub ecx, edx
sar ecx, 1
je 0x10005798
push str.CSIDL_COMMON_VIDEO
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x37
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x26d4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x37
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x24
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x37
mov dword [esp + 0x3c], 0x37
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x25
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4b6c], ax
lea eax, [esp + 0x4b6e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x4b64]
push 0
push 0x3d
push eax
push 0
call edi
test eax, eax
je 0x100058c8
lea ecx, [esp + 0x4b64]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100057e0
sub ecx, edx
sar ecx, 1
je 0x100058c8
push str.CSIDL_COMPUTERSNEARME
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x3d
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x4b64]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x3d
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x26
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x3d
mov dword [esp + 0x3c], 0x3d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x27
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x2aec], ax
lea eax, [esp + 0x2aee]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x2ae4]
push 0
push 0x31
push eax
push 0
call edi
test eax, eax
je 0x100059f8
lea ecx, [esp + 0x2ae4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005910
sub ecx, edx
sar ecx, 1
je 0x100059f8
push str.CSIDL_CONNECTIONS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x31
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x2ae4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x31
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x28
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x31
mov dword [esp + 0x3c], 0x31
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x29
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x6bec], ax
lea eax, [esp + 0x6bee]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x6be4]
push 0
push 3
push eax
push 0
call edi
test eax, eax
je 0x10005b28
lea ecx, [esp + 0x6be4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005a40
sub ecx, edx
sar ecx, 1
je 0x10005b28
push str.CSIDL_CONTROLS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 3
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x6be4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 3
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x2a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 3
mov dword [esp + 0x3c], 3
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x2b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x2efc], ax
lea eax, [esp + 0x2efe]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x2ef4]
push 0
push 0x21
push eax
push 0
call edi
test eax, eax
je 0x10005c58
lea ecx, [esp + 0x2ef4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005b70
sub ecx, edx
sar ecx, 1
je 0x10005c58
push str.CSIDL_COOKIES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x21
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x2ef4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x21
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x2c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x21
mov dword [esp + 0x3c], 0x21
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x2d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4f7c], ax
lea eax, [esp + 0x4f7e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x4f74]
push 0
push 0
push eax
push 0
call edi
test eax, eax
je 0x10005d88
lea ecx, [esp + 0x4f74]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005ca0
sub ecx, edx
sar ecx, 1
je 0x10005d88
push str.CSIDL_DESKTOP
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x4f74]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x2e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x3c], 0
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x2f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x24c], ax
lea eax, [esp + 0x24e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x244]
push 0
push 0x10
push eax
push 0
call edi
test eax, eax
je 0x10005eb8
lea ecx, [esp + 0x244]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005dd0
sub ecx, edx
sar ecx, 1
je 0x10005eb8
push str.CSIDL_DESKTOPDIRECTORY
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x10
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x244]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x10
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x30
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x3c], 0x10
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x31
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5fbc], ax
lea eax, [esp + 0x5fbe]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x5fb4]
push 0
push 0x11
push eax
push 0
call edi
test eax, eax
je 0x10005fe8
lea ecx, [esp + 0x5fb4]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005f00
sub ecx, edx
sar ecx, 1
je 0x10005fe8
push str.CSIDL_DRIVES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x11
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x5fb4]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x11
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x32
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x11
mov dword [esp + 0x3c], 0x11
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x33
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x371c], ax
lea eax, [esp + 0x371e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3714]
push 0
push 6
push eax
push 0
call edi
test eax, eax
je 0x10006118
lea ecx, [esp + 0x3714]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006030
sub ecx, edx
sar ecx, 1
je 0x10006118
push str.CSIDL_FAVORITES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 6
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x3714]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 6
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x34
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 6
mov dword [esp + 0x3c], 6
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x35
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x538c], ax
lea eax, [esp + 0x538e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x5384]
push 0
push 0x14
push eax
push 0
call edi
test eax, eax
je 0x10006248
lea ecx, [esp + 0x5384]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006160
sub ecx, edx
sar ecx, 1
je 0x10006248
push str.CSIDL_FONTS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x14
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x5384]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x14
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x36
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x14
mov dword [esp + 0x3c], 0x14
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x37
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x454], ax
lea eax, [esp + 0x456]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x44c]
push 0
push 0x22
push eax
push 0
call edi
test eax, eax
je 0x10006378
lea ecx, [esp + 0x44c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006290
sub ecx, edx
sar ecx, 1
je 0x10006378
push str.CSIDL_HISTORY
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x22
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x22
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x38
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x22
mov dword [esp + 0x3c], 0x22
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x39
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x864], ax
lea eax, [esp + 0x866]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x85c]
push 0
push 1
push eax
push 0
call edi
test eax, eax
je 0x100064a8
lea ecx, [esp + 0x85c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100063c0
sub ecx, edx
sar ecx, 1
je 0x100064a8
push str.CSIDL_INTERNET
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 1
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x85c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 1
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x3a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x3c], 1
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x3b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc74], ax
lea eax, [esp + 0xc76]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0xc6c]
push 0
push 0x20
push eax
push 0
call edi
test eax, eax
je 0x100065d8
lea ecx, [esp + 0xc6c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100064f0
sub ecx, edx
sar ecx, 1
je 0x100065d8
push str.CSIDL_INTERNET_CACHE
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x20
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0xc6c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x20
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x3c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x20
mov dword [esp + 0x3c], 0x20
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x3d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x1084], ax
lea eax, [esp + 0x1086]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x107c]
push 0
push 0x1c
push eax
push 0
call edi
test eax, eax
je 0x10006708
lea ecx, [esp + 0x107c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006620
sub ecx, edx
sar ecx, 1
je 0x10006708
push str.CSIDL_LOCAL_APPDATA
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x1c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x107c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1c
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x3e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x1c
mov dword [esp + 0x3c], 0x1c
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x3f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x1494], ax
lea eax, [esp + 0x1496]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x148c]
push 0
push 5
push eax
push 0
call edi
test eax, eax
je 0x10006838
lea ecx, [esp + 0x148c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006750
sub ecx, edx
sar ecx, 1
je 0x10006838
push str.CSIDL_MYDOCUMENTS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 5
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x148c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 5
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x40
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 5
mov dword [esp + 0x3c], 5
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x41
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18a4], ax
lea eax, [esp + 0x18a6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x189c]
push 0
push 0xd
push eax
push 0
call edi
test eax, eax
je 0x10006968
lea ecx, [esp + 0x189c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006880
sub ecx, edx
sar ecx, 1
je 0x10006968
push str.CSIDL_MYMUSIC
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0xd
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x189c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xd
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x42
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0xd
mov dword [esp + 0x3c], 0xd
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x43
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x1cb4], ax
lea eax, [esp + 0x1cb6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x1cac]
push 0
push 0x27
push eax
push 0
call edi
test eax, eax
je 0x10006a98
lea ecx, [esp + 0x1cac]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100069b0
sub ecx, edx
sar ecx, 1
je 0x10006a98
push str.CSIDL_MYPICTURES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x27
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x1cac]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x27
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x44
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x27
mov dword [esp + 0x3c], 0x27
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x45
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x20c4], ax
lea eax, [esp + 0x20c6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x20bc]
push 0
push 0xe
push eax
push 0
call edi
test eax, eax
je 0x10006bc8
lea ecx, [esp + 0x20bc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006ae0
sub ecx, edx
sar ecx, 1
je 0x10006bc8
push str.CSIDL_MYVIDEO
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0xe
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x20bc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xe
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x46
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0xe
mov dword [esp + 0x3c], 0xe
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x47
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x24d4], ax
lea eax, [esp + 0x24d6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x24cc]
push 0
push 0x13
push eax
push 0
call edi
test eax, eax
je 0x10006cf8
lea ecx, [esp + 0x24cc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006c10
sub ecx, edx
sar ecx, 1
je 0x10006cf8
push str.CSIDL_NETHOOD
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x13
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x24cc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x13
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x48
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x13
mov dword [esp + 0x3c], 0x13
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x49
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x28e4], ax
lea eax, [esp + 0x28e6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x28dc]
push 0
push 0x12
push eax
push 0
call edi
test eax, eax
je 0x10006e28
lea ecx, [esp + 0x28dc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006d40
sub ecx, edx
sar ecx, 1
je 0x10006e28
push str.CSIDL_NETWORK
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x12
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x28dc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x12
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x4a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x12
mov dword [esp + 0x3c], 0x12
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x4b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x2cf4], ax
lea eax, [esp + 0x2cf6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x2cec]
push 0
push 5
push eax
push 0
call edi
test eax, eax
je 0x10006f58
lea ecx, [esp + 0x2cec]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006e70
sub ecx, edx
sar ecx, 1
je 0x10006f58
push str.CSIDL_PERSONAL
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 5
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x2cec]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 5
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x4c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 5
mov dword [esp + 0x3c], 5
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x4d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3104], ax
lea eax, [esp + 0x3106]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x30fc]
push 0
push 4
push eax
push 0
call edi
test eax, eax
je 0x10007088
lea ecx, [esp + 0x30fc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006fa0
sub ecx, edx
sar ecx, 1
je 0x10007088
push str.CSIDL_PRINTERS
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 4
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x30fc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 4
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x4e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 4
mov dword [esp + 0x3c], 4
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x4f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3514], ax
lea eax, [esp + 0x3516]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x350c]
push 0
push 0x1b
push eax
push 0
call edi
test eax, eax
je 0x100071b8
lea ecx, [esp + 0x350c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100070d0
sub ecx, edx
sar ecx, 1
je 0x100071b8
push str.CSIDL_PRINTHOOD
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x1b
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x350c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x1b
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x50
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x1b
mov dword [esp + 0x3c], 0x1b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x51
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3924], ax
lea eax, [esp + 0x3926]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x391c]
push 0
push 0x28
push eax
push 0
call edi
test eax, eax
je 0x100072e8
lea ecx, [esp + 0x391c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007200
sub ecx, edx
sar ecx, 1
je 0x100072e8
push str.CSIDL_PROFILE
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x28
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x391c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0x28
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x52
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x3c], 0x28
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x53
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x3d34], ax
lea eax, [esp + 0x3d36]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3d2c]
push 0
push 0x26
push eax
push 0
call edi
test eax, eax
je 0x10007457
lea ecx, [esp + 0x3d2c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007330
sub ecx, edx
sar ecx, 1
je 0x10007457
lea eax, [esp + 0x3d2c]
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_wchar_t_const__]
push 0x1003040c
push str.__x86_
lea ecx, [esp + 0x40]
mov dword [esp + 0x7010], 0x54
call dword [sym.imp.ouilibx.dll_public:_int___thiscall_OUI::COString::Replace_wchar_t_const___wchar_t_const__]
push str.CSIDL_PROGRAM_FILES
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0x26
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
push 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], 0x26
call dword [sym.imp.ouilibx.dll_public:_wchar_t____thiscall_OUI::COString::GetBuffer_int_]
push eax
lea ecx, [esp + 0x20]
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
mov byte [esp + 0x7014], 0x55
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7008], 0x54
call fcn.10009cb0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
mov dword [esp + 0x18], 0x26
mov dword [esp + 0x1c], 0x26
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov byte [esp + 0x7024], 0x56
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov byte [esp + 0x7038], 0x54
call fcn.100086a0
lea ecx, [esp + 0x38]
mov dword [esp + 0x7008], 0xffffffff
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::destructor_void_]
cmp byte [esp + 0x37], 0
je 0x10007585
xor eax, eax
push 0x206
push eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x46]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3c]
push 0
push 0x2a
push eax
push 0
call edi
test eax, eax
je 0x10007585
lea ecx, [esp + 0x3c]
lea edx, [ecx + 2]
jmp 0x100074a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100074a0
sub ecx, edx
sar ecx, 1
je 0x10007585
push str.CSIDL_PROGRAM_FILESX86
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x2a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x2a
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x57
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x2a
mov dword [esp + 0x18], 0x2a
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x58
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4554], ax
lea eax, [esp + 0x4556]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x454c]
push 0
push 0x2b
push eax
push 0
call edi
test eax, eax
je 0x100076ee
lea ecx, [esp + 0x454c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100075c7
sub ecx, edx
sar ecx, 1
je 0x100076ee
lea eax, [esp + 0x454c]
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::constructor_wchar_t_const__]
push 0x1003040c
push str.__x86_
lea ecx, [esp + 0x40]
mov dword [esp + 0x7010], 0x59
call dword [sym.imp.ouilibx.dll_public:_int___thiscall_OUI::COString::Replace_wchar_t_const___wchar_t_const__]
push str.CSIDL_PROGRAM_FILES_COMMON
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x2b
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
push 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], 0x2b
call dword [sym.imp.ouilibx.dll_public:_wchar_t____thiscall_OUI::COString::GetBuffer_int_]
push eax
lea ecx, [esp + 0x20]
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov byte [esp + 0x7014], 0x5a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7008], 0x59
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x2b
mov dword [esp + 0x18], 0x2b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x7024], 0x5b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov byte [esp + 0x7038], 0x59
call fcn.100086a0
lea ecx, [esp + 0x38]
mov dword [esp + 0x7008], 0xffffffff
call dword [sym.imp.ouilibx.dll_public:_void___thiscall_OUI::COString::destructor_void_]
cmp byte [esp + 0x37], 0
je 0x10007815
xor eax, eax
push 0x206
push eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x46]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3c]
push 0
push 0x2c
push eax
push 0
call edi
test eax, eax
je 0x10007815
lea ecx, [esp + 0x3c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007730
sub ecx, edx
sar ecx, 1
je 0x10007815
push str.CSIDL_PROGRAM_FILES_COMMONX86
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x2c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x2c
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x5c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x2c
mov dword [esp + 0x18], 0x2c
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x5d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4964], ax
lea eax, [esp + 0x4966]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x495c]
push 0
push 2
push eax
push 0
call edi
test eax, eax
je 0x1000793f
lea ecx, [esp + 0x495c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007857
sub ecx, edx
sar ecx, 1
je 0x1000793f
push str.CSIDL_PROGRAMS
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 2
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x495c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 2
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x5e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 2
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x5f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4d74], ax
lea eax, [esp + 0x4d76]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x4d6c]
push 0
push 8
push eax
push 0
call edi
test eax, eax
je 0x10007a69
lea ecx, [esp + 0x4d6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007981
sub ecx, edx
sar ecx, 1
je 0x10007a69
push str.CSIDL_RECENT
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 8
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x4d6c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 8
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x60
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 8
mov dword [esp + 0x18], 8
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x61
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5184], ax
lea eax, [esp + 0x5186]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x517c]
push 0
push 0x38
push eax
push 0
call edi
test eax, eax
je 0x10007b98
lea ecx, [esp + 0x517c]
lea edx, [ecx + 2]
jmp 0x10007ab0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007ab0
sub ecx, edx
sar ecx, 1
je 0x10007b98
push str.CSIDL_RESOURCES
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x38
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x517c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x38
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x62
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x38
mov dword [esp + 0x18], 0x38
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x63
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5594], ax
lea eax, [esp + 0x5596]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x558c]
push 0
push 0x39
push eax
push 0
call edi
test eax, eax
je 0x10007cc8
lea ecx, [esp + 0x558c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007be0
sub ecx, edx
sar ecx, 1
je 0x10007cc8
push str.CSIDL_RESOURCES_LOCALIZED
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x39
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x558c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x39
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x64
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x39
mov dword [esp + 0x18], 0x39
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x65
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x59a4], ax
lea eax, [esp + 0x59a6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x599c]
push 0
push 9
push eax
push 0
call edi
test eax, eax
je 0x10007df8
lea ecx, [esp + 0x599c]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007d10
sub ecx, edx
sar ecx, 1
je 0x10007df8
push str.CSIDL_SENDTO
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 9
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x599c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 9
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x66
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 9
mov dword [esp + 0x18], 9
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x67
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5db4], ax
lea eax, [esp + 0x5db6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x5dac]
push 0
push 0xb
push eax
push 0
call edi
test eax, eax
je 0x10007f28
lea ecx, [esp + 0x5dac]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007e40
sub ecx, edx
sar ecx, 1
je 0x10007f28
push str.CSIDL_STARTMENU
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0xb
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x5dac]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0xb
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x68
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0xb
mov dword [esp + 0x18], 0xb
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x69
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x61c4], ax
lea eax, [esp + 0x61c6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x61bc]
push 0
push 7
push eax
push 0
call edi
test eax, eax
je 0x10008058
lea ecx, [esp + 0x61bc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007f70
sub ecx, edx
sar ecx, 1
je 0x10008058
push str.CSIDL_STARTUP
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 7
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x61bc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 7
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x6a
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 7
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x6b
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x65d4], ax
lea eax, [esp + 0x65d6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x65cc]
push 0
push 0x25
push eax
push 0
call edi
test eax, eax
je 0x10008188
lea ecx, [esp + 0x65cc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100080a0
sub ecx, edx
sar ecx, 1
je 0x10008188
push str.CSIDL_SYSTEM
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x25
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x65cc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x25
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x6c
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x25
mov dword [esp + 0x18], 0x25
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x6d
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
cmp byte [esp + 0x37], 0
je 0x100082b5
xor eax, eax
push 0x206
push eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x46]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x3c]
push 0
push 0x29
push eax
push 0
call edi
test eax, eax
je 0x100082b5
lea ecx, [esp + 0x3c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100081d0
sub ecx, edx
sar ecx, 1
je 0x100082b5
push str.CSIDL_SYSTEMX86
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x29
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x29
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x6e
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x29
mov dword [esp + 0x18], 0x29
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x6f
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x69e4], ax
lea eax, [esp + 0x69e6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x69dc]
push 0
push 0x15
push eax
push 0
call edi
test eax, eax
je 0x100083df
lea ecx, [esp + 0x69dc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100082f7
sub ecx, edx
sar ecx, 1
je 0x100083df
push str.CSIDL_TEMPLATES
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x15
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x69dc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x15
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x70
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x15
mov dword [esp + 0x18], 0x15
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x71
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
xor eax, eax
push 0x206
push eax
mov word [esp + 0x6df4], ax
lea eax, [esp + 0x6df6]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [esp + 0x6dec]
push 0
push 0x24
push eax
push 0
call edi
test eax, eax
je 0x10008509
lea ecx, [esp + 0x6dec]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008421
sub ecx, edx
sar ecx, 1
je 0x10008509
push str.CSIDL_WINDOWS
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], 0x24
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009c60
lea eax, [esp + 0x6dec]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 0x24
call fcn.100096c0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
mov dword [esp + 0x7014], 0x72
call fcn.10008710
add esp, 4
mov ecx, eax
call fcn.10009680
lea ecx, [esp + 0x1c]
mov dword [esp + 0x7008], 0xffffffff
call fcn.10009cb0
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
mov dword [esp + 0x1c], 0x24
mov dword [esp + 0x18], 0x24
call fcn.10008710
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.100095f0
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x7024], 0x73
call fcn.10008710
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100095f0
mov ecx, ebx
mov dword [esp + 0x7038], 0xffffffff
call fcn.100086a0
mov ecx, dword [esp + 0x7000]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6fe8]
xor ecx, esp
call fcn.10027146
mov esp, ebp
pop ebp
ret