Function at 0x1075153
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x440
mov eax, 0x10b8ec9
call fcn.010aac9f
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1019f14
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x434], edi
call fcn.010ab83f
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
cmp edi, ebx
jne 0x1075200
mov eax, dword [section..data]
cmp eax, section..data
je 0x10751e5
test byte [eax + 0x1c], 4
je 0x10751e5
push 0x1019d30
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102fea5
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.010ab886
mov eax, esi
call fcn.010aad31
ret 4
lea eax, [ebp - 0x428]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1075249
mov eax, dword [section..data]
cmp eax, section..data
je 0x1075264
test byte [eax + 0x1c], 8
je 0x1075264
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079051
jmp 0x1075264
push edi
lea eax, [ebp - 0x428]
push eax
call fcn.01074fdc
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x1075462
and dword [ebp - 0x430], 0
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 0x444], 0x1019f04
mov dword [ebp - 0x440], 0x1019ef4
mov dword [ebp - 0x43c], 0x1019ecc
mov dword [ebp - 0x438], 0x1019ea4
xor eax, eax
mov word [ebp - 0x21c], ax
mov eax, dword [ebp - 0x430]
mov esi, dword [ebp + eax*4 - 0x444]
push ebx
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10752f5
mov eax, dword [section..data]
cmp eax, section..data
je 0x107532a
test byte [eax + 0x1c], 8
je 0x107532a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push esi
push 0x1019d30
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01094f22
jmp 0x107532a
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 1
push 0x7f
call edi
cmp eax, 2
je 0x107532a
push dword [ebp - 0x434]
lea eax, [ebp - 0x21c]
push eax
call fcn.01074fdc
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
je 0x1075346
inc dword [ebp - 0x430]
cmp dword [ebp - 0x430], 4
jl 0x1075299
xor ebx, ebx
cmp dword [ebp - 0x42c], ebx
jne 0x1075462
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
push 0x1c
lea eax, [ebp - 0x21c]
push eax
push ebx
call esi
test eax, eax
jne 0x10753a5
mov eax, dword [section..data]
cmp eax, section..data
je 0x1075407
test byte [eax + 0x1c], 8
je 0x1075407
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079051
jmp 0x1075407
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, ebx
je 0x10753ce
xor ecx, ecx
mov word [eax], cx
push 0x1019e98
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 1
push 0x7f
call edi
cmp eax, 2
je 0x1075407
push dword [ebp - 0x434]
lea eax, [ebp - 0x21c]
push eax
call fcn.01074fdc
mov dword [ebp - 0x42c], eax
cmp eax, ebx
jne 0x1075462
push ebx
push 0x20
lea eax, [ebp - 0x428]
push eax
push ebx
call esi
test eax, eax
jne 0x107544a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1075462
test byte [eax + 0x1c], 8
je 0x1075462
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079051
jmp 0x1075462
push dword [ebp - 0x434]
lea eax, [ebp - 0x428]
push eax
call fcn.01074fdc
mov dword [ebp - 0x42c], eax
mov esi, dword [ebp - 0x42c]
jmp 0x10751e7