Function at 0x411960
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
lea edi, [eax + 0x108]
push edi
call esi
cmp eax, 0xffffffff
jne 0x411b2d
lea ecx, [esp + 0x18]
push 0x104
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov al, byte [esp + 0x18]
lea ebp, [esp + 0x18]
cmp al, 0x22
jne 0x4119be
lea edx, [esp + 0x19]
push 0x22
push edx
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
je 0x4119ba
mov byte [eax], 0
lea ebp, [esp + 0x19]
push ebp
call esi
cmp eax, 0xffffffff
jne 0x4119ff
or ecx, eax
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
mov edi, ecx
add edi, ebp
cmp edi, eax
jbe 0x4119ff
mov bl, byte [edi]
cmp bl, 0x20
je 0x4119e9
cmp bl, 9
jne 0x4119f6
push ebp
mov byte [edi], 0
call esi
cmp eax, 0xffffffff
jne 0x4119ff
mov byte [edi], bl
dec edi
lea ecx, [esp + 0x18]
cmp edi, ecx
ja 0x4119dd
mov edi, str.SystemRoot_
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.MSVCRT.dll__mbsnbicmp]
dec ecx
mov edi, ecx
lea ebx, [edx + 0x108]
push edi
push ebp
push str.SystemRoot_
call esi
add esp, 0xc
test eax, eax
jne 0x411a49
push 0x104
push ebx
add ebp, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add ebx, eax
mov byte [ebx], 0x5c
inc ebx
jmp 0x411aa3
mov edi, str.system32_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push str.system32_
call esi
add esp, 0xc
test eax, eax
jne 0x411a80
push 0x104
push ebx
add ebp, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add ebx, eax
mov byte [ebx], 0x5c
inc ebx
jmp 0x411aa3
mov edi, 0x44ae44
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push 0x44ae44
call esi
add esp, 0xc
test eax, eax
jne 0x411aa3
add ebp, edi
push ebp
push 0x44ae40
push ebx
mov ebx, dword [sym.imp.ntdll.dll_sprintf]
call ebx
mov eax, dword [esp + 0x130]
mov edi, dword [sym.imp.MSVCRT.dll__mbschr]
push 0x5c
lea esi, [eax + 0x108]
push esi
call edi
add esp, 0x14
test eax, eax
jne 0x411b2d
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x411b2d
lea ecx, [esp + 0x18]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + eax + 0x18]
push esi
push 0x44ae3c
push edi
call ebx
add esp, 0xc
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x411b19
push esi
push str._system32_s
push edi
call ebx
add esp, 0xc
lea eax, [esp + 0x18]
push 0x104
push eax
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov ebx, dword [esp + 0x120]
mov eax, 0x532ae21d
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
sub edx, ecx
mov ebp, ecx
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x411c67
mov esi, dword [ebx + 4]
test esi, esi
je 0x411b7b
mov edx, ecx
mov eax, 0x532ae21d
sub edx, esi
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
mov edi, edx
ja 0x411b80
mov edi, 1
test esi, esi
jne 0x411b88
xor edx, edx
jmp 0x411b9b
sub ecx, esi
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [edx + edi]
test eax, eax
mov dword [esp + 0x14], eax
jge 0x411ba8
xor eax, eax
lea edx, [eax + eax*2]
shl edx, 4
add edx, eax
lea eax, [eax + edx*4]
shl eax, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, dword [ebx + 4]
add esp, 4
cmp esi, ebp
mov dword [esp + 0x10], eax
mov edi, eax
je 0x411be6
push esi
push edi
call fcn.00411fa0
add esi, 0x314
add esp, 8
add edi, 0x314
cmp esi, ebp
jne 0x411bcc
mov ecx, dword [esp + 0x124]
push ecx
push edi
call fcn.00411fa0
mov edx, dword [ebx + 8]
add esp, 8
add edi, 0x314
mov ecx, ebx
push edi
push edx
push ebp
call fcn.00411ee0
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
push ecx
mov ecx, ebx
call fcn.00411ed0
mov edx, dword [ebx + 4]
push edx
call fcn.0043fa08
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
add esp, 4
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
lea edx, [eax + ecx*4]
mov ecx, ebx
lea eax, [esi + edx*4]
mov dword [ebx + 0xc], eax
call fcn.00411ea0
inc eax
mov dword [ebx + 4], esi
pop edi
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
lea edx, [eax + ecx*4]
lea eax, [esi + edx*4]
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov edx, ecx
mov eax, 0x532ae21d
sub edx, ebp
imul edx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x411ce4
lea edx, [ebp + 0x314]
push edx
push ecx
push ebp
mov ecx, ebx
call fcn.00411ee0
mov edi, dword [ebx + 8]
mov eax, dword [esp + 0x124]
mov ecx, edi
push eax
sub ecx, ebp
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
mov eax, 1
shr ecx, 0x1f
add edx, ecx
mov ecx, ebx
sub eax, edx
push eax
push edi
call fcn.00411f20
mov eax, dword [ebx + 8]
cmp ebp, eax
je 0x411d3f
mov esi, dword [esp + 0x124]
mov edi, ebp
add ebp, 0x314
mov ecx, 0xc5
cmp ebp, eax
rep movsd dword es:[edi], dword [esi]
jne 0x411cc8
jmp 0x411d3f
push ecx
push ecx
add ecx, 0xfffffcec
push ecx
mov ecx, ebx
call fcn.00411ee0
mov edx, dword [ebx + 8]
lea eax, [edx - 0x314]
cmp ebp, eax
je 0x411d1b
sub eax, 0x314
sub edx, 0x314
mov ecx, 0xc5
mov esi, eax
mov edi, edx
cmp eax, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x411d01
lea eax, [ebp + 0x314]
cmp ebp, eax
je 0x411d3f
mov esi, dword [esp + 0x124]
mov edi, ebp
add ebp, 0x314
mov ecx, 0xc5
cmp ebp, eax
rep movsd dword es:[edi], dword [esi]
jne 0x411d25
mov eax, dword [ebx + 8]
pop edi
add eax, 0x314
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
add esp, 0x10c
ret 8