Function at 0x427991
Capabilities:
Get common file path

Disassembly:
push 0x734
mov eax, 0x491c6a
call fcn.004302e1
mov esi, 0x208
lea eax, [ebp - 0x628]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00475400
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00475400
push esi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00475400
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x628]
add esp, 0x24
push ebx
push 0x19
push eax
push ebx
call esi
push ebx
push 0x17
lea eax, [ebp - 0x218]
push eax
push ebx
call esi
push ebx
push 0x1a
lea eax, [ebp - 0x420]
push eax
push ebx
call esi
test eax, eax
je 0x427a18
lea eax, [ebp - 0x420]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.0047c3eb
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x704], 7
mov dword [ebp - 0x708], ebx
mov word [ebp - 0x718], ax
cmp word [ebp - 0x628], ax
je 0x427a47
lea eax, [ebp - 0x628]
push eax
call fcn.00478f03
pop ecx
push eax
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x718]
call fcn.00402510
push 7
xor eax, eax
mov dword [ebp - 4], ebx
pop esi
mov dword [ebp - 0x6ec], esi
mov dword [ebp - 0x6f0], ebx
mov word [ebp - 0x700], ax
cmp word [ebp - 0x420], ax
jne 0x427a82
mov eax, ebx
jmp 0x427a8f
lea eax, [ebp - 0x420]
push eax
call fcn.00478f03
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x700]
call fcn.00402510
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x71c], esi
mov dword [ebp - 0x720], ebx
mov word [ebp - 0x730], ax
cmp word [ebp - 0x218], ax
jne 0x427ac8
mov eax, ebx
jmp 0x427ad5
lea eax, [ebp - 0x218]
push eax
call fcn.00478f03
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x730]
call fcn.00402510
mov byte [ebp - 4], 2
call fcn.0042424f
mov ecx, eax
call fcn.004292d6
mov dword [ebp - 0x740], eax
test eax, eax
je 0x428011
mov esi, dword [eax]
jmp 0x428008
mov edi, dword [esi]
xor eax, eax
push str.ShortcutPos
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], ebx
mov word [ebp - 0x640], ax
call fcn.00478f03
pop ecx
push eax
push str.ShortcutPos
lea ecx, [ebp - 0x640]
call fcn.00402510
mov eax, dword [edi]
lea ecx, [ebp - 0x640]
push ecx
mov ecx, edi
mov byte [ebp - 4], 3
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 2
mov ebx, eax
call fcn.004023bd
and dword [ebp - 0x6a8], 0
xor eax, eax
push str.ShortcutName
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
call fcn.00478f03
pop ecx
push eax
push str.ShortcutName
lea ecx, [ebp - 0x6b8]
call fcn.00402510
mov eax, dword [edi]
lea ecx, [ebp - 0x6b8]
push ecx
mov ecx, edi
mov byte [ebp - 4], 4
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 0x738], eax
mov byte [ebp - 4], 2
call fcn.004023bd
and dword [ebp - 0x6c0], 0
xor eax, eax
push str.SourceName
mov dword [ebp - 0x6bc], 7
mov word [ebp - 0x6d0], ax
call fcn.00478f03
pop ecx
push eax
push str.SourceName
lea ecx, [ebp - 0x6d0]
call fcn.00402510
mov eax, dword [edi]
lea ecx, [ebp - 0x6d0]
push ecx
mov ecx, edi
mov byte [ebp - 4], 5
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x73c], eax
mov byte [ebp - 4], 2
call fcn.004023bd
and dword [ebp - 0x6d8], 0
xor eax, eax
push str.FolderName
mov dword [ebp - 0x6d4], 7
mov word [ebp - 0x6e8], ax
call fcn.00478f03
pop ecx
push eax
push str.FolderName
lea ecx, [ebp - 0x6e8]
call fcn.00402510
mov eax, dword [edi]
lea ecx, [ebp - 0x6e8]
push ecx
mov ecx, edi
mov byte [ebp - 4], 6
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6e8]
mov dword [ebp - 0x734], eax
mov byte [ebp - 4], 2
call fcn.004023bd
and dword [ebp - 0x648], 0
xor eax, eax
push str.Describe
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
call fcn.00478f03
pop ecx
push eax
push str.Describe
lea ecx, [ebp - 0x658]
call fcn.00402510
mov eax, dword [edi]
lea ecx, [ebp - 0x658]
push ecx
mov ecx, edi
mov byte [ebp - 4], 7
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 2
mov edi, eax
call fcn.004023bd
test ebx, ebx
je 0x427ffd
and dword [ebp - 0x660], 0
lea ecx, [ebp - 0x670]
xor eax, eax
mov dword [ebp - 0x65c], 7
push eax
push 0x496acc
mov word [ebp - 0x670], ax
call fcn.00402510
and dword [ebp - 0x678], 0
lea ecx, [ebp - 0x688]
xor eax, eax
mov byte [ebp - 4], 8
push eax
push 0x496acc
mov dword [ebp - 0x674], 7
mov word [ebp - 0x688], ax
call fcn.00402510
and dword [ebp - 0x690], 0
lea ecx, [ebp - 0x6a0]
xor eax, eax
mov byte [ebp - 4], 9
push eax
push 0x496acc
mov dword [ebp - 0x68c], 7
mov word [ebp - 0x6a0], ax
call fcn.00402510
cmp dword [ebx + 0x14], 8
mov byte [ebp - 4], 0xa
jb 0x427d8a
mov eax, dword [ebx]
jmp 0x427d8c
mov eax, ebx
push str.Desktop
push eax
call fcn.00478fab
pop ecx
pop ecx
test eax, eax
jne 0x427db2
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x670]
call fcn.00402454
cmp dword [ebx + 0x14], 8
jb 0x427dbc
mov eax, dword [ebx]
jmp 0x427dbe
mov eax, ebx
push str.StartMenu
push eax
call fcn.00478fab
pop ecx
pop ecx
test eax, eax
jne 0x427de1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x670]
call fcn.004024e9
cmp dword [ebx + 0x14], 8
jb 0x427deb
mov eax, dword [ebx]
jmp 0x427ded
mov eax, ebx
push str.Program
push eax
call fcn.00478fab
pop ecx
pop ecx
test eax, eax
jne 0x427e10
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x670]
call fcn.004024e9
cmp dword [ebx + 0x14], 8
jb 0x427e18
mov ebx, dword [ebx]
push str.StartUp
push ebx
call fcn.00478fab
pop ecx
pop ecx
test eax, eax
jne 0x427e3b
lea eax, [ebp - 0x700]
push eax
lea ecx, [ebp - 0x670]
call fcn.00427973
mov ebx, dword [ebp - 0x734]
test ebx, ebx
je 0x427e71
call fcn.0042424f
mov ecx, eax
call fcn.004291fd
push eax
lea ecx, [ebp - 0x688]
call fcn.004024e9
cmp dword [ebx + 0x14], 8
jb 0x427e65
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x688]
call fcn.00428041
test edi, edi
je 0x427e89
cmp dword [edi + 0x14], 8
jb 0x427e7d
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x6a0]
call fcn.004024e9
mov ebx, dword [ebp - 0x738]
xor eax, eax
cmp dword [ebp - 0x660], eax
mov edi, dword [ebp - 0x73c]
setne al
xor ecx, ecx
test ebx, ebx
cmove eax, ecx
test edi, edi
cmove eax, ecx
test eax, eax
je 0x427fcb
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x640]
call fcn.00424863
push 0x498fe8
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0xb
call fcn.00428041
cmp dword [ebx + 0x14], 8
jb 0x427ee2
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x640]
call fcn.00428041
push 0x498fec
lea ecx, [ebp - 0x640]
call fcn.00428041
push 8
pop ebx
cmp dword [ebp - 0x62c], ebx
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push eax
call fcn.00470e71
pop ecx
call fcn.0042424f
mov ecx, eax
call fcn.004291fd
push eax
lea ecx, [ebp - 0x658]
call fcn.00401f2f
mov byte [ebp - 4], 0xc
cmp dword [edi + 0x14], ebx
jb 0x427f3e
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x658]
call fcn.00428041
cmp dword [ebp - 0x674], ebx
lea edi, [ebp - 0x688]
lea edx, [ebp - 0x6a0]
cmovae edi, dword [ebp - 0x688]
lea ecx, [ebp - 0x658]
cmp dword [ebp - 0x68c], ebx
lea eax, [ebp - 0x640]
push 0x496acc
cmovae edx, dword [ebp - 0x6a0]
cmp dword [ebp - 0x644], ebx
push edi
cmovae ecx, dword [ebp - 0x658]
cmp dword [ebp - 0x62c], ebx
cmovae eax, dword [ebp - 0x640]
xor ebx, ebx
push ebx
push 1
push ebx
push edx
push ecx
push eax
call fcn.0047125c
add esp, 0x20
lea ecx, [ebp - 0x658]
push ebx
push 1
call fcn.004023bd
push ebx
push 1
lea ecx, [ebp - 0x640]
call fcn.004023bd
jmp 0x427fcd
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x6a0]
call fcn.004023bd
push ebx
push 1
lea ecx, [ebp - 0x688]
call fcn.004023bd
push ebx
push 1
lea ecx, [ebp - 0x670]
mov byte [ebp - 4], 2
call fcn.004023bd
jmp 0x427fff
xor ebx, ebx
mov eax, dword [ebp - 0x740]
add esi, 4
cmp esi, dword [eax + 4]
jne 0x427b0d
push ebx
push 1
lea ecx, [ebp - 0x730]
call fcn.004023bd
push ebx
push 1
lea ecx, [ebp - 0x700]
call fcn.004023bd
push ebx
push 1
lea ecx, [ebp - 0x718]
call fcn.004023bd
call fcn.0043028b
ret