Function at 0x5127a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x1e28
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x1e24], eax
push ebp
mov ebp, dword [esp + 0x1e30]
push edi
mov edi, dword [esp + 0x1e3c]
push 0x103
lea eax, [esp + 0x429]
push 0
push eax
mov byte [esp + 0x430], 0
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x539]
push 0
push ecx
mov byte [esp + 0x540], 0
call fcn.005dfd60
xor edx, edx
add esp, 0x18
mov dword [esp + 0xc], edx
test ebp, ebp
jne 0x512818
test edi, edi
jne 0x512854
xor eax, eax
jmp 0x5135c2
cmp byte [ebp], 0x22
jne 0x512827
mov edx, 1
mov dword [esp + 0xc], edx
mov al, byte [edx + ebp]
cmp al, 0x25
je 0x5128a5
cmp al, 0x5c
jne 0x512840
mov cl, byte [edx + ebp + 1]
cmp cl, 0x73
je 0x5128a5
cmp cl, 0x53
je 0x5128a5
cmp al, 0x73
je 0x512848
cmp al, 0x53
jne 0x512811
mov al, byte [edx + ebp + 1]
cmp al, 0x79
je 0x5128a5
cmp al, 0x59
jmp 0x51289f
cmp word [edi], 0x22
jne 0x512863
mov edx, 1
mov dword [esp + 0xc], edx
movzx eax, word [edi + edx*2]
cmp ax, 0x25
je 0x5128a5
cmp ax, 0x5c
jne 0x512884
movzx ecx, word [edi + edx*2 + 2]
cmp cx, 0x73
je 0x5128a5
cmp cx, 0x53
je 0x5128a5
cmp ax, 0x73
je 0x512890
cmp ax, 0x53
jne 0x512811
movzx eax, word [edi + edx*2 + 2]
cmp ax, 0x79
je 0x5128a5
cmp ax, 0x59
jne 0x512811
cmp dword [0x74e634], 1
push ebx
push esi
mov ebx, 0x104
jne 0x51294f
cmp byte [0x74e530], 0
je 0x512c44
cmp dword [esp + 0x1e40], 0
je 0x512c44
push 0x103
lea edx, [esp + 0x21]
push 0
push edx
mov byte [esp + 0x28], 0
call fcn.005dfd60
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x24], ebx
call fcn.004e7c90
add esp, 0x14
test eax, eax
je 0x51294f
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + edx + 0x20], 0
call fcn.004e4310
lea ecx, [esp + 0x20]
push 0x74e530
push ecx
call fcn.004dd620
add esp, 0xc
test eax, eax
je 0x51294f
push ebx
push 0
push 0x74e530
mov dword [0x74e634], 0
call fcn.005dfd60
add esp, 0xc
mov dword [0x6908e0], ebx
jmp 0x51295c
cmp dword [0x74e634], 0
jne 0x512c44
push 0x103
lea edx, [esp + 0x21]
push 0
push edx
mov byte [esp + 0x28], 0
call fcn.005dfd60
push 0x6908e0
push 0x74e530
call fcn.004e7c90
add esp, 0x14
test eax, eax
je 0x5129a1
mov eax, dword [0x6908e0]
push 0x74e530
mov byte [eax + 0x74e530], 0
call fcn.004e4310
add esp, 4
push 0x74e428
call fcn.004ef9d0
cmp eax, 1
je 0x5129ba
push 0x74e428
call fcn.004efb60
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x74e428
call fcn.004e82a0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push 0x74e428
call esi
push ebx
push 0x74e320
call fcn.004f6260
push ebx
lea eax, [esp + 0x28]
push eax
push 0x74e320
call fcn.004e82a0
add esp, 0x14
lea ecx, [esp + 0x1c]
push ecx
push 0x74e320
call esi
push 0
push 0
lea edx, [esp + 0x434]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x54c]
push ecx
push 0x64d3e8
mov byte [esp + 0x554], 0
mov byte [esp + 0x450], 0
call fcn.0050f490
test eax, eax
je 0x512b19
push 0x103
lea edx, [esp + 0x229]
push 0
push edx
mov byte [esp + 0x230], 0
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x131]
push 0
push eax
mov byte [esp + 0x138], 0
call fcn.005dfd60
lea ecx, [esp + 0x444]
push ecx
lea edx, [esp + 0x240]
push 0x64d530
push edx
mov dword [esp + 0x34], ebx
call fcn.005dfb23
add esp, 0x24
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x124]
push ecx
push 0x6486bc
lea edx, [esp + 0x230]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
test al, al
je 0x512b19
cmp byte [esp + 0x120], 0
je 0x512b19
lea eax, [esp + 0x120]
push 0
push eax
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x512b19
lea ecx, [esp + 0x120]
push ecx
push 0x74e218
call esi
push ebx
lea edx, [esp + 0x20]
push edx
push 0x74e218
call fcn.004e82a0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x74e218
call esi
push ebx
push 0x74e110
call fcn.004ebf90
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 8
push ebx
push 0x74e008
call esi
push 0x5c
push 0x74e008
call fcn.005e3012
add esp, 8
test eax, eax
je 0x512b5b
push 0x647674
push 0x74e008
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x74df00
call esi
call fcn.004d96c0
test eax, eax
je 0x512b7a
push ebx
push 0x74ddf8
call fcn.004db700
add esp, 8
push 0
push 0x74dcf0
push 0x74dbe8
push 0x74dae0
push 0x74d9d8
push 0x74d8d0
push 0x74d7c8
push 0x74d6c0
push 0x74d5b8
push 0x74d4b0
call fcn.00512330
add esp, 0x28
push 0
push 0x74d3a8
push 0x74d2a0
push 0x74d198
push 0x74d090
push 0x74cf88
push 0x74ce80
push 0x74cd78
call fcn.0050edd0
cmp byte [0x74cf88], 0
je 0x512c02
push 0
push 0x74cc70
push 0x74cf88
call fcn.004d83c0
push 0x74cc70
call fcn.004e2520
add esp, 0x10
cmp byte [0x74d8d0], 0
je 0x512c29
push 0
push 0x74cb68
push 0x74d8d0
call fcn.004d83c0
push 0x74cb68
call fcn.004e2520
add esp, 0x10
push ebx
push 0x74ca60
push 0x625698
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [0x74e634], 1
test ebp, ebp
je 0x512d5d
mov ecx, dword [esp + 0x14]
lea esi, [ecx + ebp]
push 0x800
lea edx, [esp + 0x638]
push esi
push edx
call fcn.005e2f3c
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x512c70
sub eax, edx
cmp eax, 0x800
jb 0x512c87
mov byte [esp + 0xe33], cl
push 0xd
lea eax, [esp + 0x638]
push 0x64db28
push eax
call fcn.005e3491
add esp, 0xc
test eax, eax
jne 0x512ced
push 4
push 0x74df00
push esi
call fcn.005e1e30
add esp, 0xc
cmp byte [esp + 0x641], 0x5c
mov byte [esi + 2], 0
je 0x512cc9
push ebp
call fcn.004e24e0
add esp, 4
lea eax, [esp + 0x641]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x512cd2
sub eax, edx
dec ebp
mov edi, ebp
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x512ce0
jmp 0x512ec2
push 0xc
lea ecx, [esp + 0x638]
push 0x64db18
push ecx
call fcn.005e3491
add esp, 0xc
test eax, eax
jne 0x512edc
push 4
push 0x74e428
push esi
call fcn.005e1e30
add esp, 0xc
cmp byte [esp + 0x640], 0x5c
mov byte [esi + 2], 0
je 0x512d33
push ebp
call fcn.004e24e0
add esp, 4
lea eax, [esp + 0x640]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x512d40
sub eax, edx
dec ebp
mov edi, ebp
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x512d50
jmp 0x512ec2
mov ebx, dword [esp + 0x14]
lea esi, [edi + ebx*2]
lea edx, [esp + 0xe34]
mov eax, esi
sub edx, esi
nop
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x512d70
push 0xd
lea edx, [esp + 0xe38]
push 0x64dafc
push edx
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x512e23
push 0x206
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.005dfd60
lea edx, [esp + 0x230]
push 0x74df00
push edx
call fcn.004dab80
push 4
lea eax, [esp + 0x23c]
push eax
push esi
call fcn.005e3986
xor ecx, ecx
add esp, 0x20
cmp word [esp + 0xe4e], 0x5c
mov word [edi + ebx*2 + 4], cx
je 0x512df9
push edi
call fcn.004dab00
add esp, 4
lea eax, [esp + 0xe4e]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x512e02
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x512e12
jmp 0x512ec2
push 0xc
lea edx, [esp + 0xe38]
push 0x64dae0
push edx
call fcn.005e38e0
add esp, 0xc
test eax, eax
jne 0x513257
push 0x206
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.005dfd60
lea edx, [esp + 0x230]
push 0x74e428
push edx
call fcn.004dab80
push 4
lea eax, [esp + 0x23c]
push eax
push esi
call fcn.005e3986
xor ecx, ecx
add esp, 0x20
cmp word [esp + 0xe4c], 0x5c
mov word [edi + ebx*2 + 4], cx
je 0x512e9d
push edi
call fcn.004dab00
add esp, 4
lea eax, [esp + 0xe4c]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x512ea6
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x512eb6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
jmp 0x5135c0
push 0x74d4b0
push 0x64dad8
push ebp
call fcn.004e4030
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5135be
push 0x74cb68
push 0x64dac8
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e110
push 0x64dabc
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x64dab0
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74cc70
push 0x64da9c
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d5b8
push 0x64da84
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74cf88
push 0x64da74
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74ca60
push 0x64da6c
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d090
push 0x64da58
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d198
push 0x64da44
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d6c0
push 0x64da38
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d2a0
push 0x64da28
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d8d0
push 0x64da1c
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d9d8
push 0x64da10
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e008
push 0x64da00
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e110
push 0x64d9f0
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e110
push 0x64d9e0
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x6256f4
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
cmp byte [0x74ddf8], 0
je 0x5130f4
push 0x74ddf8
push 0x64a858
push ebp
call fcn.004e4030
push 0x74ddf8
push 0x64d9d4
push ebp
or esi, eax
call fcn.004e4030
add esp, 0x18
or esi, eax
test esi, esi
jne 0x5135be
push 0x74df00
push 0x64d9c8
push ebp
call fcn.004e4030
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5135be
push 0x74e110
push 0x64d9bc
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74dbe8
push 0x64d9b0
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x64d9a4
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x64d994
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d4b0
push 0x64d984
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d4b0
push 0x64d970
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d5b8
push 0x64d954
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d8d0
push 0x64d940
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74ce80
push 0x64d930
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e428
push 0x626c74
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e320
push 0x626c60
push ebp
call fcn.004e4030
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e218
push 0x64d91c
push ebp
call fcn.004e4030
jmp 0x5135b9
push 0x74d4b0
push 0x64dad8
push edi
call fcn.004db200
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5135be
push 0x74cb68
push 0x64dac8
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e110
push 0x64dabc
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x64dab0
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74cc70
push 0x64da9c
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d5b8
push 0x64da84
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74cf88
push 0x64da74
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74ca60
push 0x64da6c
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d090
push 0x64da58
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d198
push 0x64da44
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d6c0
push 0x64da38
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d2a0
push 0x64da28
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d8d0
push 0x64da1c
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d9d8
push 0x64da10
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e008
push 0x64da00
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e110
push 0x64d9f0
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e110
push 0x64d9e0
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x6256f4
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
cmp byte [0x74ddf8], 0
je 0x51346f
push 0x74ddf8
push 0x64a858
push edi
call fcn.004db200
push 0x74ddf8
push 0x64d9d4
push edi
or esi, eax
call fcn.004db200
add esp, 0x18
or esi, eax
test esi, esi
jne 0x5135be
push 0x74df00
push 0x64d9c8
push edi
call fcn.004db200
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5135be
push 0x74e110
push 0x64d9bc
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74dbe8
push 0x64d9b0
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x64d9a4
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74df00
push 0x64d994
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d4b0
push 0x64d984
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d4b0
push 0x64d970
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d5b8
push 0x64d954
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74d8d0
push 0x64d940
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74ce80
push 0x64d930
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e428
push 0x626c74
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e320
push 0x626c60
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
jne 0x5135be
push 0x74e218
push 0x64d91c
push edi
call fcn.004db200
add esp, 0xc
or esi, eax
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x1e2c]
pop edi
pop ebp
xor ecx, esp
call fcn.005dfbbe
add esp, 0x1e28
ret 0xc