Function at 0x42d953
Capabilities:
Get common file path
Get program files directory
Get session user name
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x42e4b3
mov edx, dword [ebp - 0x10c]
movsx eax, byte [edx]
cmp eax, 0xd
je 0x42e4b3
mov ecx, dword [ebp - 0x10c]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x42e4b3
mov dword [ebp - 0x110], 1
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [eax]
cmp ecx, 0x25
jne 0x42e475
push 9
mov edx, dword [ebp - 0x10c]
push edx
push str._windows_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42d9f7
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x42e3d6
push 0xa
mov ecx, dword [ebp - 0x10c]
push ecx
push 0x4de578
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42da28
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x42e3d6
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._sysdisk_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42da60
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [ebp - 0x106], 0
jmp 0x42e3d6
push 6
mov edx, dword [ebp - 0x10c]
push edx
push 0x4de590
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42da91
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42e3d6
push 5
mov ecx, dword [ebp - 0x10c]
push ecx
push str._tmp_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dac2
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x42e3d6
push 6
mov eax, dword [ebp - 0x10c]
push eax
push str._user_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dbd2
mov dword [ebp - 0x31c], 0x104
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x42db11
mov dword [ebp - 0x110], 0
jmp 0x42e4b3
mov byte [ebp - 0x318], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x16
lea eax, [ebp - 0x318]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42db50
mov dword [ebp - 0x110], 0
jmp 0x42e4b3
lea ecx, [ebp - 0x318]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
test eax, eax
jbe 0x42dbcd
push str.All_Users
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x42dbcd
mov eax, dword [ebp - 0x324]
lea ecx, [ebp - 0x318]
sub eax, ecx
mov dword [ebp - 0x320], eax
mov edx, dword [ebp - 0x320]
mov byte [ebp + edx - 0x318], 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x318]
push ecx
push 0x4de5b4
push 0x104
lea edx, [ebp - 0x108]
push edx
call fcn.0040a230
add esp, 0x14
jmp 0x42e3d6
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._APPDATA_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dc12
push 0
push 0x1a
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dc0d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x10
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_APPDATA_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dc52
push 0
push 0x23
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dc4d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x12
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_DOCUMENTS_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dc92
push 0
push 0x2e
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dc8d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_FAVORITES_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dcd2
push 0
push 0x1f
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dccd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x11
mov edx, dword [ebp - 0x10c]
push edx
push 0x4de604
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dd12
push 0
push 0x17
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dd0d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x12
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_STARTMENU_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dd52
push 0
push 0x16
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dd4d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x10
mov eax, dword [ebp - 0x10c]
push eax
push 0x4de62c
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dd92
push 0
push 0x18
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dd8d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._CONTROLS_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42ddd2
push 0
push 3
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42ddcd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 9
mov ecx, dword [ebp - 0x10c]
push ecx
push str._DESKTOP_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42de12
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42de0d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._DESKTOPDIRECTORY_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42de52
push 0
push 0x10
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42de4d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x11
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_PROGRAMS_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42de92
push 0
push 0x17
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42de8d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xb
mov ecx, dword [ebp - 0x10c]
push ecx
push str._FAVORITES_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42ded2
push 0
push 6
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42decd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xf
mov eax, dword [ebp - 0x10c]
push eax
push str._LOCAL_APPDATA_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42df12
push 0
push 0x1c
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42df0d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._PERSONAL_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42df52
push 0
push 5
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42df4d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x16
mov ecx, dword [ebp - 0x10c]
push ecx
push str._PROGRAM_FILES_COMMON_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42df92
push 0
push 0x2b
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42df8d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xf
mov eax, dword [ebp - 0x10c]
push eax
push str._PROGRAM_FILES_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42dfd2
push 0
push 0x26
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42dfcd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xa
mov edx, dword [ebp - 0x10c]
push edx
push str._PROGRAMS_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e012
push 0
push 2
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e00d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 8
mov ecx, dword [ebp - 0x10c]
push ecx
push str._SYSTEM_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e052
push 0
push 0x25
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e04d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 9
mov eax, dword [ebp - 0x10c]
push eax
push str._WINDOWS_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e092
push 0
push 0x24
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e08d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 8
mov edx, dword [ebp - 0x10c]
push edx
push str._WINDIR_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e0d2
push 0
push 0x24
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e0cd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xc
mov ecx, dword [ebp - 0x10c]
push ecx
push str._SYSTEMROOT_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e112
push 0
push 0x24
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e10d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xd
mov eax, dword [ebp - 0x10c]
push eax
push str._CDBURN_AREA_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e152
push 0
push 0x3b
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e14d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xe
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_MUSIC_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e192
push 0
push 0x35
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e18d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x11
mov ecx, dword [ebp - 0x10c]
push ecx
push str._COMMON_PICTURES_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e1d2
push 0
push 0x36
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e1cd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x12
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_TEMPLATES_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e212
push 0
push 0x2d
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e20d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xe
mov edx, dword [ebp - 0x10c]
push edx
push str._COMMON_VIDEO_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e252
push 0
push 0x37
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e24d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 9
mov ecx, dword [ebp - 0x10c]
push ecx
push str._PROFILE_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e292
push 0
push 0x28
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e28d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x19
mov eax, dword [ebp - 0x10c]
push eax
push str._COMMON_DESKTOPDIRECTORY_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e2d2
push 0
push 0x19
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e2cd
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 9
mov edx, dword [ebp - 0x10c]
push edx
push str._COOKIES_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e312
push 0
push 0x21
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e30d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 7
mov ecx, dword [ebp - 0x10c]
push ecx
push str._FONTS_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e352
push 0
push 0x14
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e34d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0x10
mov eax, dword [ebp - 0x10c]
push eax
push str._INTERNET_CACHE_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e38f
push 0
push 0x20
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e38d
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
push 0xb
mov edx, dword [ebp - 0x10c]
push edx
push str._PRINTHOOD_
call fcn.00415370
add esp, 0xc
test eax, eax
jne 0x42e3cc
push 0
push 0x1b
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x42e3ca
mov dword [ebp - 0x110], 0
jmp 0x42e3d6
mov dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0
je 0x42e475
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x108]
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x328]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x42e41d
mov edx, dword [ebp - 0x328]
movsx eax, byte [edx - 1]
cmp eax, 0x2f
jne 0x42e427
mov ecx, dword [ebp - 0x328]
mov byte [ecx - 1], 0
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00409100
mov edx, dword [ebp + 0xc]
push edx
call sub.ntdll.dll_strlen
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov dword [ebp + 0xc], ecx
push 0x25
mov edx, dword [ebp - 0x10c]
add edx, 1
push edx
call dword [sym.imp.ntdll.dll_strchr]
add esp, 8
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x42d975
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 4]
jae 0x42e49b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10c]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
jmp 0x42e49f
xor eax, eax
jmp 0x42e4b8
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
jmp 0x42d975
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret