Function at 0x427f90
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ea54
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x48d814]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [0x48ede0], bl
jne 0x42877d
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebx + 7]
test eax, eax
jbe 0x428068
push 0x47854c
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x234]
push ecx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428016
sub edx, ecx
sar edx, 1
push edx
lea edx, [ebp - 0x218]
push edx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x428053
mov eax, dword [ebp - 0x230]
push eax
call fcn.00450138
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], cx
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x428105
push 0x478544
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 1
lea eax, [ebp - 0x234]
push eax
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x4280b3
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x4280f0
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x218]
push 0x5c
push edx
call fcn.00451f6f
add esp, 8
cmp eax, ebx
je 0x428132
xor ecx, ecx
mov word [eax], cx
push 3
xor edx, edx
push 0x47853c
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
call fcn.00402fe0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x234]
push eax
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea ebx, [ebx]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428180
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x4281bd
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
push ebx
lea ecx, [ebp - 0x218]
push ecx
xor eax, eax
push ebx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call edi
test eax, eax
je 0x428277
push str.desktop
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 3
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428221
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x42825e
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 0x1a
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x428316
push str.appdata
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 4
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea ecx, [ecx]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x4282c0
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x4282fd
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 0x23
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x4283b6
push str.commonappdata
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 5
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428360
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x42839d
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 0x26
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x428456
push 0x4784f8
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 6
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428400
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x42843d
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 5
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x4284f6
push str.personal
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 7
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x4284a0
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x4284dd
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 6
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x428596
push str.favorites
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 8
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428540
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x42857d
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 7
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x428636
push str.startup
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 9
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x4285e0
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x42861d
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 9
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x4286d6
push str.sendto
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 0xa
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428680
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x4286bd
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
push ebx
push 0x2b
lea ecx, [ebp - 0x218]
push ecx
push ebx
call edi
test eax, eax
je 0x428776
push 0x4784a8
lea ecx, [ebp - 0x234]
call fcn.00404150
mov dword [ebp - 4], 0xb
lea edx, [ebp - 0x234]
push edx
mov ecx, 0x48ede4
call fcn.00427de0
lea edx, [ebp - 0x218]
lea ecx, [edx + 2]
lea esp, [esp]
mov si, word [edx]
add edx, 2
cmp si, bx
jne 0x428720
sub edx, ecx
sar edx, 1
push edx
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00402fe0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x21c], 8
jb 0x42875d
mov edx, dword [ebp - 0x230]
push edx
call fcn.00450138
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
mov byte [0x48ede0], 1
mov eax, 0x48ede4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045075f
mov esp, ebp
pop ebp
ret