Function at 0x10026ea0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x1002715d
cmp word [0x1005d878], 0
push esi
push edi
jne 0x10027072
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x208
push 0x1005d878
push str.SystemRoot
call edi
mov ecx, 0x1005d878
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10026ee0
mov esi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1005d876], 0x5c
je 0x10026f14
push 0x1004846c
push 0x208
push 0x1005d878
call esi
add esp, 0xc
push 0x208
push 0x1005dc88
push str.ProgramFiles
call edi
mov ecx, 0x1005dc88
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10026f30
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1005dc86], 0x5c
je 0x10026f5e
push 0x1004846c
push 0x208
push 0x1005dc88
call esi
add esp, 0xc
push 0x208
push 0x1005e098
push str.windir
call edi
mov ecx, 0x1005e098
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10026f77
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1005e096], 0x5c
je 0x10026fa5
push 0x1004846c
push 0x208
push 0x1005e098
call esi
add esp, 0xc
mov edi, dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x1005d878
push 0x208
push 0x1005e4a8
call edi
push 0x1005d878
push 0x208
push 0x1005e8b8
call edi
push 0x1005d878
push 0x208
push 0x1005ecc8
call edi
add esp, 0x24
push 0x208
push 0x1005f0d8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x1005f0d8
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027000
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1005f0d6], 0x5c
je 0x1002702e
push 0x1004846c
push 0x208
push 0x1005f0d8
call esi
add esp, 0xc
push 0x1005f0d8
push 0x208
push 0x1005f4e8
call edi
mov ecx, 0x1005f4e8
add esp, 0xc
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027050
sub ecx, edx
sar ecx, 1
xor eax, eax
mov dword [ecx*2 + 0x1005f4e2], 0x5c
mov word [0x1005f8f8], ax
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll__wcsnicmp]
xor esi, esi
jmp 0x10027080
mov edx, dword [esi*4 + 0x1005c4cc]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10027090
sub eax, edi
mov edi, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x100270c0
inc esi
cmp esi, 9
jb 0x10027080
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi*4 + 0x1005c4cc]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100270d0
sub ecx, edx
sar ecx, 1
imul esi, esi, 0x410
lea ebx, [esi + 0x1005d878]
mov edx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100270f0
sub edx, esi
mov esi, edi
sar edx, 1
lea eax, [esi + 2]
mov dword [ebp - 4], eax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10027107
sub esi, dword [ebp - 4]
sar esi, 1
sub esi, ecx
lea eax, [esi*2 + 2]
mov esi, dword [sym.imp.MSVCR110.dll_memmove]
push eax
lea eax, [edi + ecx*2]
push eax
lea eax, [edi + edx*2]
push eax
call esi
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10027140
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push edi
call esi
add esp, 0xc
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret