Function at 0x401000
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
lea eax, [ebp - 0x494]
mov dword [ebp - 0x498], edx
push 0
push eax
mov edi, ecx
call fcn.0040bf00
push 0x208
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x458], 0
push 0
push eax
call fcn.0040bf00
push 0x208
lea eax, [ebp - 0x454]
push 0
push eax
call fcn.0040bf00
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.0040bf00
push 0x103
lea eax, [ebp - 0x24c]
xor esi, esi
push 0x42dcb8
push eax
call fcn.0040e084
xor eax, eax
push 0x103
mov word [ebp - 0x46], ax
lea eax, [ebp - 0x24c]
push str.ll32.dll
push eax
call fcn.0040de40
xor eax, eax
add esp, 0x48
mov word [ebp - 0x46], ax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4012a4
push 0x3f
lea eax, [ebp - 0x44]
push 0x42dcd4
push eax
call fcn.0040e0d0
push 0x3f
lea eax, [ebp - 0x44]
mov byte [ebp - 5], 0
push str.llExecuteExW
push eax
call fcn.0040e200
add esp, 0x18
mov byte [ebp - 5], 0
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x49c], eax
test eax, eax
je 0x40129d
push 0x103
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [ebp - 0x46], ax
lea eax, [ebp - 0x24c]
push 0x5c
push eax
call fcn.0040b6e5
add esp, 8
test eax, eax
je 0x4011be
xor ecx, ecx
lea edi, [eax + 2]
mov word [eax], cx
lea eax, [ebp - 0x24c]
push 0x3a
push eax
call fcn.0040b6e5
add esp, 8
test eax, eax
jne 0x4011b8
lea eax, [ebp - 0x454]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
push 0x103
mov word [ebp - 0x24e], ax
lea eax, [ebp - 0x454]
push 0x42dce8
push eax
call fcn.0040de40
xor eax, eax
mov word [ebp - 0x24e], ax
lea eax, [ebp - 0x24c]
push 0x103
push eax
lea eax, [ebp - 0x454]
push eax
call fcn.0040de40
add esp, 0x18
lea esi, [ebp - 0x454]
xor eax, eax
mov word [ebp - 0x24e], ax
jmp 0x4011be
lea esi, [ebp - 0x24c]
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x494]
push eax
mov dword [ebp - 0x48c], 0
movlpd qword [ebp - 0x474], xmm0
movlpd qword [ebp - 0x46c], xmm0
movlpd qword [ebp - 0x464], xmm0
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x494], 0x3c
mov dword [ebp - 0x490], 0x4640
mov dword [ebp - 0x488], 0x42dcec
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x47c], esi
call dword [ebp - 0x49c]
test eax, eax
je 0x40129d
mov eax, dword [ebp - 0x45c]
test eax, eax
je 0x40129d
cmp dword [ebp + 8], 0
je 0x40128c
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
lea ecx, [ebp - 0x458]
push ecx
push eax
call edi
test eax, eax
je 0x401286
cmp dword [ebp - 0x458], 0x103
jne 0x401286
push 0xa
call esi
mov eax, dword [ebp - 0x45c]
jmp 0x401260
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x45c], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x45c]
pop edi
pop esi
pop ebx
test eax, eax
je 0x4012b8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a851
mov esp, ebp
pop ebp
ret