Function at 0x48afea
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8d64
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x4e106c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4a0], ecx
push str.TxdlService.exe
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x3c
call fcn.00406eb9
push str.InstallerSvcEx2014
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x6c
call fcn.00406eb9
lea eax, [ebp - 0x4bc]
push eax
call fcn.0048e96b
pop ecx
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4b8], eax
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4b8]
call fcn.004026c4
push eax
lea ecx, [ebp - 0x484]
call fcn.0040224c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4bc]
call fcn.00405d4a
lea ecx, [ebp - 0x46c]
call fcn.004022ad
mov byte [ebp - 4], 3
call fcn.00417fc6
add eax, 4
mov dword [ebp - 0x4a4], eax
push 0x4c0ba4
lea eax, [ebp - 0x46c]
push eax
push str.ServiceExeName
push dword [ebp - 0x4a4]
mov eax, dword [ebp - 0x4a4]
mov eax, dword [eax]
call dword [eax + 8]
lea ecx, [ebp - 0x46c]
call fcn.00401e75
movzx eax, al
test eax, eax
jne 0x48b0f0
lea eax, [ebp - 0x46c]
push eax
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x3c
call fcn.0040204d
lea ecx, [ebp - 0x454]
call fcn.004022ad
mov byte [ebp - 4], 4
call fcn.00417fc6
add eax, 4
mov dword [ebp - 0x4a8], eax
push 0x4c0bc8
lea eax, [ebp - 0x454]
push eax
push str.ServiceInstallName
push dword [ebp - 0x4a8]
mov eax, dword [ebp - 0x4a8]
mov eax, dword [eax]
call dword [eax + 8]
lea ecx, [ebp - 0x454]
call fcn.00401e75
movzx eax, al
test eax, eax
jne 0x48b156
lea eax, [ebp - 0x454]
push eax
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x6c
call fcn.0040204d
lea ecx, [ebp - 0x43c]
call fcn.004022ad
mov byte [ebp - 4], 5
call fcn.00417fc6
add eax, 4
mov dword [ebp - 0x4ac], eax
push 0x4c0bf4
lea eax, [ebp - 0x43c]
push eax
push str.ServiceExeDir
push dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x4ac]
mov eax, dword [eax]
call dword [eax + 8]
lea ecx, [ebp - 0x43c]
call fcn.00401e75
movzx eax, al
test eax, eax
jne 0x48b25f
lea ecx, [ebp - 0x4c0]
call fcn.00407094
mov byte [ebp - 4], 6
xor eax, eax
mov word [ebp - 0x424], ax
push 0x410
push 0
lea eax, [ebp - 0x422]
push eax
call fcn.00458260
add esp, 0xc
push 0x208
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00406ddd
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48b23e
push 0
lea eax, [ebp - 0x424]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48b23c
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x484]
call fcn.00406eb9
jmp 0x48b250
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x484]
call fcn.00406eb9
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4c0]
call fcn.00405d4a
push 0x4c0c14
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00417458
add esp, 0xc
mov dword [ebp - 0x4c4], eax
push dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x54
call fcn.004020fa
lea ecx, [ebp - 0x49c]
call fcn.004020b1
mov eax, dword [ebp - 0x4a0]
add eax, 0x3c
push eax
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x54
call fcn.00402035
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x3c
call fcn.00401e75
movzx eax, al
test eax, eax
jne 0x48b302
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x6c
call fcn.00401e75
movzx eax, al
test eax, eax
jne 0x48b302
mov ecx, dword [ebp - 0x4a0]
add ecx, 0x54
call fcn.00401e75
movzx eax, al
test eax, eax
jne 0x48b302
mov dword [ebp - 0x4b0], 1
jmp 0x48b309
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4c8], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x43c]
call fcn.004020b1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x454]
call fcn.004020b1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x46c]
call fcn.004020b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.004020b1
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455912
mov esp, ebp
pop ebp
ret