Function at 0x411249
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x210], 0
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x208]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [ebp - 0x21c]
cmp dword [edx + 0x438], 0
jne 0x4112e9
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4112e9
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4112f9
xor eax, eax
jmp 0x411e17
push 0
push 0x16
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4113cb
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jbe 0x4113cb
push 0x4c465c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x4113cb
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x208]
sub ecx, edx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
mov byte [ebp + eax - 0x208], 0
mov ecx, dword [ebp - 0x21c]
cmp dword [ecx + 0x438], 0
je 0x41137f
jmp 0x4113cb
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411394
jmp 0x4113cb
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4113b5
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4113c5
xor eax, eax
jmp 0x411e17
xor ecx, ecx
test ecx, ecx
jne 0x41136e
push 0x4c4668
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00409100
mov dword [ebp - 0x20c], 0
jmp 0x4113fc
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x1a
jge 0x41148d
mov ecx, dword [ebp - 0x20c]
add ecx, 0x41
mov byte [ebp - 0x208], cl
lea edx, [ebp - 0x208]
push edx
call fcn.0042f31b
add esp, 4
test eax, eax
je 0x411488
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x41143c
jmp 0x411488
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411451
jmp 0x411488
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411472
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411482
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x41142b
jmp 0x4113ed
lea ecx, [ebp - 0x104]
push ecx
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.00409100
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x4114b6
jmp 0x411502
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4114cb
jmp 0x411502
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4114ec
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4114fc
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x4114a5
lea ecx, [ebp - 0x104]
push ecx
push str._s_system32drivers_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a230
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411533
jmp 0x41157f
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411548
jmp 0x41157f
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411569
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411579
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411522
lea ecx, [ebp - 0x104]
push ecx
push str._s_system32_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a230
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x4115b0
jmp 0x4115fc
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4115c5
jmp 0x4115fc
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4115e6
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4115f6
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x41159f
lea ecx, [ebp - 0x104]
push ecx
push str._s_system_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a230
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x41162d
jmp 0x411679
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411642
jmp 0x411679
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411663
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411673
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x41161c
lea ecx, [ebp - 0x104]
push ecx
push 0x4c46a0
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a230
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x4116aa
jmp 0x4116f6
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4116bf
jmp 0x4116f6
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4116e0
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4116f0
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411699
lea ecx, [ebp - 0x104]
push ecx
push str._sinf_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a230
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x411727
jmp 0x411773
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x41173c
jmp 0x411773
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x41175d
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x41176d
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411716
lea ecx, [ebp - 0x104]
push ecx
push str._s_system32dllcache_
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.0040a230
add esp, 0x10
mov eax, dword [ebp - 0x21c]
cmp dword [eax + 0x438], 0
je 0x4117a4
jmp 0x4117f0
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4117b9
jmp 0x4117f0
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4117da
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4117ea
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411793
mov byte [ebp - 0x208], 0
push 0
push 0x1a
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411810
jmp 0x41185c
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411825
jmp 0x41185c
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411846
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411856
xor eax, eax
jmp 0x411e17
xor ecx, ecx
test ecx, ecx
jne 0x4117f0
mov byte [ebp - 0x208], 0
push 0
push 0x23
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x41187c
jmp 0x4118c8
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411891
jmp 0x4118c8
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4118b2
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x4118c2
xor eax, eax
jmp 0x411e17
xor edx, edx
test edx, edx
jne 0x41185c
mov byte [ebp - 0x208], 0
push 0
push 0x2e
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4118e8
jmp 0x411934
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4118fd
jmp 0x411934
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x41191e
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x41192e
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x4118c8
mov byte [ebp - 0x208], 0
push 0
push 0x1f
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411954
jmp 0x4119a0
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411969
jmp 0x4119a0
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x41198a
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x41199a
xor eax, eax
jmp 0x411e17
xor ecx, ecx
test ecx, ecx
jne 0x411934
mov byte [ebp - 0x208], 0
push 0
push 0x16
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4119c0
jmp 0x411a0c
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x4119d5
jmp 0x411a0c
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x4119f6
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411a06
xor eax, eax
jmp 0x411e17
xor edx, edx
test edx, edx
jne 0x4119a0
mov byte [ebp - 0x208], 0
push 0
push 0x18
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411a2c
jmp 0x411a78
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411a41
jmp 0x411a78
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411a62
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411a72
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411a0c
mov byte [ebp - 0x208], 0
push 0
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411a98
jmp 0x411ae4
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411aad
jmp 0x411ae4
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411ace
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411ade
xor eax, eax
jmp 0x411e17
xor ecx, ecx
test ecx, ecx
jne 0x411a78
mov byte [ebp - 0x208], 0
push 0
push 0x10
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411b04
jmp 0x411b50
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411b19
jmp 0x411b50
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411b3a
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411b4a
xor eax, eax
jmp 0x411e17
xor edx, edx
test edx, edx
jne 0x411ae4
mov byte [ebp - 0x208], 0
push 0
push 0x17
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411b70
jmp 0x411bbc
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411b85
jmp 0x411bbc
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411ba6
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411bb6
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411b50
mov byte [ebp - 0x208], 0
push 0
push 6
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411bdc
jmp 0x411c28
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411bf1
jmp 0x411c28
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411c12
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411c22
xor eax, eax
jmp 0x411e17
xor ecx, ecx
test ecx, ecx
jne 0x411bbc
mov byte [ebp - 0x208], 0
push 0
push 0x1c
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411c48
jmp 0x411c94
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411c5d
jmp 0x411c94
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411c7e
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411c8e
xor eax, eax
jmp 0x411e17
xor edx, edx
test edx, edx
jne 0x411c28
mov byte [ebp - 0x208], 0
push 0
push 5
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411cb4
jmp 0x411d00
lea ecx, [ebp - 0x208]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411cc9
jmp 0x411d00
push 0
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411cea
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411cfa
xor eax, eax
jmp 0x411e17
xor eax, eax
test eax, eax
jne 0x411c94
mov byte [ebp - 0x208], 0
push 0
push 0x2b
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411d20
jmp 0x411d6c
lea edx, [ebp - 0x208]
push edx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411d35
jmp 0x411d6c
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411d56
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411d66
xor eax, eax
jmp 0x411e17
xor ecx, ecx
test ecx, ecx
jne 0x411d00
mov byte [ebp - 0x208], 0
push 0
push 2
lea edx, [ebp - 0x208]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x411d8c
jmp 0x411dd2
lea eax, [ebp - 0x208]
push eax
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jne 0x411da1
jmp 0x411dd2
push 0
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411dbf
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411dcc
xor eax, eax
jmp 0x411e17
xor edx, edx
test edx, edx
jne 0x411d6c
push 0
push 0x26
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x411e07
push 1
lea ecx, [ebp - 0x208]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.0040bb93
cmp eax, 0xffffffff
jne 0x411e07
or eax, 0xffffffff
jmp 0x411e17
call fcn.0043ac16
test eax, eax
je 0x411e14
xor eax, eax
jmp 0x411e17
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret