Function at 0x40e020
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe54
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xe40], ecx
mov dword [ebp - 0xe50], eax
call fcn.0043c7f0
cmp eax, 1
jne 0x40e063
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
je 0x40e689
cmp word [esi], 0
je 0x40e689
push ebx
push edi
mov edi, dword [sym.imp.MSVCR100.dll__wcsicmp]
push str.desktop
xor ebx, ebx
push esi
mov dword [ebp - 0xe44], ebx
call edi
add esp, 8
test eax, eax
jne 0x40e0cb
mov dword [ebp - 0xe44], ebx
call fcn.00488c20
push eax
push 0
push str.desktopshortcuts
push str.installinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x40e0e9
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0xc
push str.startmenu
push esi
call edi
add esp, 8
test eax, eax
jne 0x40e1eb
mov ebx, 1
mov dword [ebp - 0xe44], ebx
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x822]
push edx
mov word [ebp - 0x824], cx
call sub.MSVCR100.dll_memset
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0xa2a]
push ecx
mov word [ebp - 0xa2c], ax
call sub.MSVCR100.dll_memset
xor edx, edx
push 0x40e
push edx
lea eax, [ebp - 0x61a]
push eax
mov word [ebp - 0x61c], dx
call sub.MSVCR100.dll_memset
xor ecx, ecx
push 0x40e
push ecx
lea edx, [ebp - 0xe3a]
push edx
mov word [ebp - 0xe3c], cx
call sub.MSVCR100.dll_memset
add esp, 0x30
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 1
push 0
jne 0x40e206
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
lea ecx, [ebp - 0x824]
push ecx
push 0
call esi
test eax, eax
je 0x40e671
push 0
push 2
lea edx, [ebp - 0xa2c]
push edx
push 0
call esi
test eax, eax
je 0x40e671
lea eax, [ebp - 0x824]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
xor ecx, ecx
lea edi, [ebp - 0x824]
add esp, 8
mov word [eax + 2], cx
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e1d1
mov ecx, 9
mov esi, str.All_UsersDesktop
rep movsd dword es:[edi], dword [esi]
jmp 0x40e25a
push str.temp
push esi
call edi
add esp, 8
test eax, eax
jne 0x40e09a
lea ebx, [eax + 3]
jmp 0x40e0e3
call fcn.00438260
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movzx edx, al
neg edx
sbb edx, edx
and edx, 0xfffffff7
add edx, 0x19
push edx
lea eax, [ebp - 0x824]
push eax
push 0
call esi
test eax, eax
je 0x40e671
push 0
call fcn.00438260
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0xffffffeb
add ecx, 0x17
push ecx
lea edx, [ebp - 0xa2c]
push edx
push 0
call esi
test eax, eax
je 0x40e671
test ebx, ebx
jne 0x40e27a
xor eax, eax
movzx ecx, word [ebp + eax - 0x824]
mov word [ebp + eax - 0x61c], cx
add eax, 2
test cx, cx
jne 0x40e260
jmp 0x40e2d8
cmp ebx, 3
jne 0x40e2b1
mov eax, dword [ebp - 0xe40]
add eax, 0x30
cmp dword [eax + 0x14], 8
jb 0x40e290
mov eax, dword [eax]
lea edx, [ebp - 0x61c]
sub edx, eax
jmp 0x40e2a0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40e2a0
jmp 0x40e2d8
xor eax, eax
jmp 0x40e2c0
movzx ecx, word [ebp + eax - 0xa2c]
mov word [ebp + eax - 0x61c], cx
add eax, 2
test cx, cx
jne 0x40e2c0
lea eax, [ebp - 0x61c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e2e1
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x61e], 0x5c
je 0x40e317
lea edi, [ebp - 0x61c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e304
mov eax, dword [0x4c7780]
mov dword [edi], eax
push 0x104
lea ecx, [ebp - 0xe3c]
push ecx
push 1
push 0
push 2
call fcn.0043baf0
test eax, eax
jne 0x40e671
push eax
call fcn.00488cb0
push 1
mov ebx, eax
call fcn.00488cb0
mov edi, eax
push 2
mov dword [ebp - 0xe54], edi
call fcn.00488cb0
push 3
mov dword [ebp - 0xe4c], eax
call fcn.00488cb0
mov esi, dword [ebp + 0x10]
add esp, 0x10
mov dword [ebp - 0xe48], eax
test ebx, ebx
jne 0x40e38d
mov edx, esi
and dl, 1
xor ebx, ebx
cmp dl, 1
sete bl
test ebx, ebx
je 0x40e38d
push ebx
push 0
call fcn.00488d60
add esp, 8
test edi, edi
jne 0x40e3b3
mov eax, esi
and al, 2
xor ecx, ecx
cmp al, 2
sete cl
mov eax, ecx
mov dword [ebp - 0xe54], eax
test eax, eax
je 0x40e3b3
push eax
push 1
call fcn.00488d60
add esp, 8
cmp dword [ebp - 0xe4c], 0
jne 0x40e3de
mov edx, esi
xor eax, eax
and dl, 4
cmp dl, 4
sete al
mov dword [ebp - 0xe4c], eax
test eax, eax
je 0x40e3de
push eax
push 2
call fcn.00488d60
add esp, 8
cmp dword [ebp - 0xe48], 0
jne 0x40e409
mov eax, esi
and al, 8
xor ecx, ecx
cmp al, 8
sete cl
mov eax, ecx
mov dword [ebp - 0xe48], eax
test eax, eax
je 0x40e409
push eax
push 3
call fcn.00488d60
add esp, 8
lea edi, [ebp - 0xe3c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40e412
mov eax, dword [ebp - 0xe50]
mov edx, dword [0x4c7780]
mov dword [edi], edx
test eax, eax
je 0x40e467
cmp word [eax], 0
je 0x40e467
mov edx, eax
jmp 0x40e440
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e440
lea edi, [ebp - 0x61c]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40e456
jmp 0x40e50c
cmp dword [ebp - 0xe44], 1
jne 0x40e51c
call fcn.00488c20
mov esi, eax
test esi, esi
je 0x40e51c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e486
sub eax, edx
sar eax, 1
je 0x40e51c
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0x4c79ac
push str.startmenudir
push str.installinfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e4e3
lea edi, [ebp - 0x61c]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40e500
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xe40]
mov edi, dword [ebp - 0xe44]
xor esi, esi
cmp dword [eax + 0x10], esi
je 0x40e536
test edi, edi
jne 0x40e536
lea esi, [edi + 1]
test ebx, ebx
je 0x40e572
cmp dword [eax], 0
je 0x40e572
test edi, edi
je 0x40e556
cmp edi, 3
je 0x40e556
cmp edi, 1
jne 0x40e572
call fcn.00433e60
test eax, eax
jne 0x40e572
push edi
push 0
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0xe3c]
push ecx
mov ecx, dword [ebp - 0xe40]
call fcn.0040d600
cmp dword [ebp - 0xe54], 0
je 0x40e5be
mov edx, dword [ebp - 0xe40]
cmp dword [edx + 4], 0
je 0x40e5be
test esi, esi
jne 0x40e5be
test edi, edi
je 0x40e5a2
cmp edi, 3
je 0x40e5a2
cmp edi, 1
jne 0x40e5be
call fcn.00433e80
test eax, eax
jne 0x40e5be
push edi
push 1
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0xe3c]
push ecx
mov ecx, dword [ebp - 0xe40]
call fcn.0040d600
cmp dword [ebp - 0xe4c], 0
je 0x40e60a
mov edx, dword [ebp - 0xe40]
cmp dword [edx + 0xc], 0
je 0x40e60a
test esi, esi
jne 0x40e60a
test edi, edi
je 0x40e5ee
cmp edi, 3
je 0x40e5ee
cmp edi, 1
jne 0x40e60a
call fcn.00433ea0
test eax, eax
jne 0x40e60a
push edi
push 2
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0xe3c]
push ecx
mov ecx, dword [ebp - 0xe40]
call fcn.0040d600
cmp dword [ebp - 0xe48], 0
je 0x40e656
mov edx, dword [ebp - 0xe40]
cmp dword [edx + 8], 0
je 0x40e656
test esi, esi
jne 0x40e656
test edi, edi
je 0x40e63a
cmp edi, 3
je 0x40e63a
cmp edi, 1
jne 0x40e656
call fcn.00433ec0
test eax, eax
jne 0x40e656
push edi
push 3
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0xe3c]
push ecx
mov ecx, dword [ebp - 0xe40]
call fcn.0040d600
mov eax, dword [ebp - 0xe40]
mov ecx, 1
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
jmp 0x40e0b6
pop edi
pop ebx
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x80070057
pop esi
call fcn.004b12f6
mov esp, ebp
pop ebp
ret 0xc