Function at 0x4768b0
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x4768d9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2a
jae 0x476b87
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d3d8]
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 8
ja case.default.0x476921
mov eax, dword [ebp - 0x118]
jmp dword [eax*4 + 0x476b91]
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d3dc]
push edx
push 0x104
lea eax, [ebp - 0x10c]
push eax
call fcn.00409000
jmp 0x476b06
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d3dc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
push 0x104
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [eax + 0x52d3dc]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d3dc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
push 0x104
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x109], 0
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [eax + 0x52d3dc]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
push 0
push 0x18
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x476a44
jmp 0x4768d0
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d3dc]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
push 0
push 7
lea ecx, [ebp - 0x10c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x476a7f
jmp 0x4768d0
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d3dc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
lea edx, [ebp - 0x10c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [eax + 0x52d3dc]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
push 0
push 0x26
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x476ae5
jmp 0x4768d0
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ecx + 0x52d3dc]
push edx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
jmp 0x476b06
jmp 0x4768d0
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0042b4af
add esp, 4
test eax, eax
jne 0x476b1e
jmp 0x4768d0
mov edx, dword [ebp - 4]
shl edx, 4
cmp dword [edx + 0x52d3e0], 0
je 0x476b4b
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 4]
shl ecx, 4
call dword [ecx + 0x52d3e0]
add esp, 4
mov dword [ebp - 0x110], eax
jmp 0x476b5d
mov edx, dword [ebp - 4]
shl edx, 4
mov eax, dword [edx + 0x52d3e4]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [ebp + 8]
jmp 0x4768d0
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret 8