Function at 0x406210
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4747c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00406070
mov edi, dword [ebp + 8]
test al, al
je 0x4062d0
push 0x4797e0
push str.RandSeedFile
push str.Generic
call fcn.00405fe0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4062a7
push eax
push 1
push 0x105
call fcn.004344b0
add esp, 0xc
mov esi, eax
push 0x105
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.004384c0
add esp, 8
test eax, eax
je 0x4062a4
movq xmm0, qword [str.putty.rnd]
movq qword [eax], xmm0
mov cx, word [0x45d10c]
mov word [eax + 8], cx
mov cl, byte [0x45d10e]
mov byte [eax + 0xa], cl
jmp 0x4062a7
mov byte [esi], 0
cmp byte [esi], 0
je 0x4062c5
lea eax, [ebp - 0x214]
push eax
push edi
push esi
call fcn.004065c0
add esp, 0xc
test al, al
jne 0x4064f2
push esi
call fcn.00434320
add esp, 4
jmp 0x406334
push 0
push str.SoftwareSimonTathamPuTTY
push 0x80000001
push 0
push 0
call fcn.00435300
mov esi, eax
add esp, 0x14
test esi, esi
je 0x406334
push str.RandSeedFile
push esi
call fcn.00435190
mov ebx, eax
push esi
mov dword [ebp - 0x218], ebx
call fcn.00435180
add esp, 0xc
test ebx, ebx
je 0x406334
lea eax, [ebp - 0x214]
push eax
push edi
push ebx
call fcn.004065c0
push dword [ebp - 0x218]
mov bl, al
call fcn.00434320
add esp, 0x10
test bl, bl
jne 0x4064f2
cmp byte [0x475308], 0
jne 0x40637d
push str.shell32.dll
call fcn.00434ff0
add esp, 4
mov dword [0x47530c], eax
test eax, eax
je 0x40636d
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x475310], eax
mov byte [0x475308], 1
jmp 0x406382
xor eax, eax
mov byte [0x475308], 1
mov dword [0x475310], eax
jmp 0x406382
mov eax, dword [0x475310]
test eax, eax
je 0x406424
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
push 0x1c
push 0
call eax
test eax, eax
js 0x4063d5
push 0
lea eax, [ebp - 0x10c]
push str.PUTTY.RND
push eax
call fcn.004353b0
mov esi, eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
call fcn.004065c0
push esi
mov bl, al
call fcn.00434320
add esp, 0x1c
test bl, bl
jne 0x4064f2
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [0x475310]
test eax, eax
js 0x406424
push 0
lea eax, [ebp - 0x10c]
push str.PUTTY.RND
push eax
call fcn.004353b0
mov esi, eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
call fcn.004065c0
push esi
mov bl, al
call fcn.00434320
add esp, 0x1c
test bl, bl
jne 0x4064f2
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x210]
push 0x104
push eax
push str.HOMEDRIVE
call esi
mov ebx, eax
lea eax, [ebp - 0x10c]
push 0x104
push eax
push str.HOMEPATH
call esi
test ebx, ebx
jne 0x40645e
mov byte [ebp - 0x210], bl
jmp 0x406466
cmp ebx, 0x104
jae 0x4064a7
dec eax
cmp eax, 0x102
ja 0x4064a7
push 0
push str.PUTTY.RND
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004353b0
mov esi, eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
call fcn.004065c0
push esi
mov bl, al
call fcn.00434320
add esp, 0x20
test bl, bl
jne 0x4064f2
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x406509
push 0
lea eax, [ebp - 0x10c]
push str.PUTTY.RND
push eax
call fcn.004353b0
mov esi, eax
lea eax, [ebp - 0x214]
push eax
push edi
push esi
call fcn.004065c0
push esi
mov bl, al
call fcn.00434320
add esp, 0x1c
test bl, bl
je 0x406509
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437271
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437271
mov esp, ebp
pop ebp
ret