Function at 0x40b435
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4de270]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x48
mov eax, 0x49f4fa
call fcn.00486a61
mov ebx, edx
push str.CSystemCommands::GetSafeEnv____bool____start
lea esi, [ebp - 0x38]
mov edi, ecx
mov dword [ebp - 0x1c], ebx
call fcn.00404db2
and dword [ebp - 4], 0
call fcn.00404e64
or dword [ebp - 4], 0xffffffff
push 0
push 1
call fcn.00404f5a
push 0x4aec58
push ebx
call fcn.00404d8d
test edi, edi
je 0x40b6a6
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b49b
sub eax, edx
je 0x40b6a6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x40b4c0
xor eax, eax
jmp 0x40b4d5
lea eax, [esi + esi]
call fcn.00486560
mov eax, esp
push 3
push esi
push edi
mov esi, eax
call fcn.00406b96
push eax
lea esi, [ebp]
call fcn.00404db2
push str.CSystemCommands::GetSafeEnv__varName
lea esi, [ebp - 0x38]
mov dword [ebp - 4], 2
call fcn.00404db2
mov eax, esi
push eax
lea ebx, [ebp]
mov byte [ebp - 4], 3
call fcn.00404975
pop ecx
xor ebx, ebx
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.00404f5a
push 0x104
call fcn.00480474
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
pop ecx
push ebx
push ebx
push edi
mov dword [ebp - 0x14], ebx
call esi
mov dword [ebp - 0x18], eax
cmp eax, ebx
jbe 0x40b544
push eax
call fcn.00480474
pop ecx
push dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push eax
push edi
call esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x40b62a
push str.CSystemCommands::GetSafeEnv__GetEnvironmentVariableA_fails
lea esi, [ebp - 0x38]
call fcn.00404db2
mov byte [ebp - 4], 4
call fcn.00404e64
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.00404f5a
push str.APPDATA
push edi
call fcn.004926f5
pop ecx
pop ecx
test eax, eax
jne 0x40b585
push ebx
push 0x1c
jmp 0x40b5af
push str.COMMONAPPDATA
push edi
call fcn.004926f5
pop ecx
pop ecx
test eax, eax
jne 0x40b59b
push ebx
push 0x23
jmp 0x40b5af
push str.ProgramFiles
push edi
call fcn.004926f5
pop ecx
pop ecx
test eax, eax
jne 0x40b5be
push ebx
push 0x26
lea eax, [ebp + 0x1c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
jne 0x40b5f2
push str.CSystemCommands::GetSafeEnv__failed_to_read_folder_name
lea esi, [ebp - 0x38]
call fcn.00404db2
mov byte [ebp - 4], 5
call fcn.00404e64
push ebx
push 1
call fcn.00404f5a
mov byte [ebp - 0xd], bl
push ebx
push 1
lea esi, [ebp]
call fcn.00404f5a
mov al, byte [ebp - 0xd]
jmp 0x40b6c8
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp + 0x1c]
push eax
push ebx
call fcn.00404d8d
push str.CSystemCommands::GetSafeEnv__using_SHGetSpecialFolderPath__returns:
lea esi, [ebp - 0x38]
call fcn.00404db2
mov eax, esi
push eax
mov byte [ebp - 4], 6
call fcn.00404975
pop ecx
push 0
push 1
call fcn.00404f5a
mov byte [ebp - 0xd], 1
xor ebx, ebx
jmp 0x40b5df
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x40b643
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
cmp esi, 0x3fffffff
jle 0x40b647
xor eax, eax
jmp 0x40b65c
lea eax, [esi + esi]
call fcn.00486560
mov eax, esp
push 3
push esi
push edi
mov esi, eax
call fcn.00406b96
push eax
push dword [ebp - 0x1c]
call fcn.00404d8d
cmp edi, ebx
je 0x40b670
push edi
call fcn.004812c1
pop ecx
push str.CSystemCommands::GetSafeEnv__returns:
lea esi, [ebp - 0x54]
call fcn.00404db2
mov ebx, dword [ebp - 0x1c]
mov eax, esi
push eax
mov byte [ebp - 4], 7
call fcn.00404975
pop ecx
push 0
push 1
call fcn.00404f5a
push 0
push 1
lea esi, [ebp]
call fcn.00404f5a
mov al, 1
jmp 0x40b6c8
push str.CSystemCommands::GetSafeEnv____varName__NULL__quits
lea esi, [ebp - 0x38]
call fcn.00404db2
xor edi, edi
inc edi
mov dword [ebp - 4], edi
call fcn.00404e64
push 0
push edi
call fcn.00404f5a
xor al, al
lea esp, [ebp - 0x64]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.004812cc
add ebp, 0x228
leave
ret