Function at 0x406b9c
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x338
mov eax, 0x55cb15
call fcn.00523c97
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x2a0], esi
mov dword [ebp - 4], esi
push 7
pop eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x248], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x268], esi
mov word [ebp - 0x278], cx
mov dword [ebp - 0x24c], esi
mov word [ebp - 0x25c], ax
mov byte [ebp - 4], 1
push 0x208
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push esi
push eax
call fcn.00517e90
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x28
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, esi
jge 0x406ceb
lea eax, [ebp - 0x344]
push eax
call fcn.004036c8
mov esi, eax
push str.GFE::Applications::ApplicationDetector::GetSettingsForSHIM:_SHGetFolderPath_failed_with
push esi
mov byte [ebp - 4], 2
call fcn.00405d7d
pop ecx
pop ecx
push edi
push esi
call fcn.00410478
lea eax, [ebp - 0x240]
push eax
mov eax, esi
call fcn.00403732
mov byte [ebp - 4], 3
cmp dword [ebp - 0x22c], 8
mov eax, dword [ebp - 0x240]
jae 0x406c87
lea eax, [ebp - 0x240]
push eax
push 2
pop ecx
call fcn.00492b4d
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x240]
call fcn.00404145
lea eax, [ebp - 0x344]
mov byte [ebp - 4], 1
call fcn.00402669
lea eax, [ebp - 0x2a8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x406e06
mov esi, ebx
call fcn.0040f21b
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], edi
jmp 0x406e06
mov edi, dword [ebp - 0x298]
lea eax, [ebp - 0x234]
push eax
call fcn.00407fcb
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x230]
mov edi, dword [ebp - 0x234]
sub eax, edi
push 0x1c
cdq
pop ecx
idiv ecx
cmp eax, esi
jbe 0x406d5e
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x224]
push eax
mov ecx, edi
call fcn.0040ff8d
pop ecx
test al, al
je 0x406d53
lea eax, [ebp - 0x224]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x406d3b
sub eax, edx
sar eax, 1
push 0xd
mov ecx, edi
call fcn.0040ec73
add edi, 0x1c
dec dword [ebp - 0x298]
jne 0x406d1f
push str.SearchPaths
lea eax, [ebp - 0x278]
push eax
call fcn.0040411c
push 0x586b60
lea esi, [ebp - 0x294]
call fcn.0040338f
mov eax, esi
push eax
lea eax, [ebp - 0x25c]
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 7
call fcn.0040ffd1
pop ecx
push 1
xor edi, edi
mov byte [ebp - 4], 6
call fcn.00404145
lea ecx, [ebp - 0x278]
lea edx, [ebp - 0x2a8]
call fcn.0040e470
lea eax, [ebp - 0x2a8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
cmp ebx, eax
je 0x406dfb
mov esi, ebx
call fcn.0040f21b
mov eax, dword [ebp - 0x2a8]
mov dword [ebx], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebx + 8], eax
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a0], edi
lea esi, [ebp - 0x234]
call fcn.0040f00f
push 1
xor edi, edi
lea esi, [ebp - 0x25c]
call fcn.00404145
push 1
lea esi, [ebp - 0x278]
call fcn.00404145
lea esi, [ebp - 0x2a8]
call fcn.0040f21b
mov eax, ebx
call fcn.00523d1a
ret 4