Function at 0x407366
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x422196
call fcn.00414d1c
mov eax, 0x8260
call fcn.004175b0
push ebx
xor ebx, ebx
push ebp
mov dword [esp + 8], ebx
push esi
xor eax, eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
push edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
mov dword [esp + 0x8278], 1
mov eax, dword [esp + 0x828c]
cmp dword [eax + 0x10], ebx
je 0x4073c5
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x2c]
call fcn.00406faa
jmp 0x4073ff
lea eax, [esp + 0x68]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4073ff
cmp word [esp + 0x68], 0
jne 0x4073e5
mov eax, ebx
jmp 0x4073f0
lea eax, [esp + 0x68]
push eax
call fcn.0041721d
pop ecx
push eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x28]
call fcn.00407059
mov esi, 0x426028
push esi
call fcn.0041721d
mov edi, dword [esp + 0x828c]
pop ecx
push eax
push ebx
push esi
mov ecx, edi
call fcn.004071af
cmp eax, 0xffffffff
je 0x4074a0
mov eax, dword [edi + 0x14]
push 8
pop ebp
cmp eax, ebp
jb 0x40742f
mov ecx, dword [edi]
jmp 0x407431
mov ecx, edi
cmp word [ecx], 0x2f
je 0x407491
cmp eax, ebp
jb 0x40743f
mov ecx, dword [edi]
jmp 0x407441
mov ecx, edi
cmp word [ecx], 0x5c
je 0x407491
cmp eax, ebp
jb 0x40744f
mov ecx, dword [edi]
jmp 0x407451
mov ecx, edi
cmp word [ecx], bx
je 0x407467
cmp eax, ebp
jb 0x40745e
mov eax, dword [edi]
jmp 0x407460
mov eax, edi
cmp word [eax + 2], 0x3a
je 0x407491
lea eax, [esp + 0x20]
push eax
push edi
push dword [esp + 0x828c]
call fcn.0040721b
add esp, 0xc
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x8278], bl
push ebx
push eax
jmp 0x407784
mov ecx, dword [esp + 0x8284]
push edi
call fcn.00406b5c
jmp 0x40747c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x8278], 2
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00407844
xor eax, eax
push 0x7ffe
mov word [esp + 0x274], ax
lea eax, [esp + 0x276]
push ebx
push eax
call fcn.00414400
add esp, 0xc
lea esi, [esp + 0x270]
push 0x4000
mov eax, esi
push eax
push 0x426030
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, 0x2b2
mov ecx, 0x80000000
test eax, eax
je 0x4075ce
mov edx, dword [0x42f100]
or dword [0x42f104], 0x2b8
mov eax, edx
not eax
and eax, ebp
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov ecx, edx
not ecx
and ecx, ebp
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
mov dword [0x42f100], eax
push 0x3b
mov eax, esi
push eax
jmp 0x40758b
mov ecx, ebx
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [esp + 0x58]
call fcn.00406ba7
mov byte [esp + 0x8278], 3
push eax
lea ecx, [esp + 0x18]
call fcn.004077d7
mov byte [esp + 0x8278], 2
push 0
push 1
lea ecx, [esp + 0x58]
call fcn.00401ab9
lea esi, [ebx + 2]
push 0x3b
push esi
call fcn.0041716f
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x40754d
push esi
lea ecx, [esp + 0x3c]
call fcn.00406b83
mov byte [esp + 0x8278], 4
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
call fcn.004077d7
mov byte [esp + 0x8278], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x40]
call fcn.00401ab9
mov esi, dword [esp + 0x14]
cmp esi, dword [esp + 0x18]
je 0x407754
push 8
pop ebp
mov eax, 0x2fb
mov ecx, 0xc4
cmp dword [esi + 0x10], ebx
je 0x407747
mov edx, dword [0x42f104]
or edx, 0x2e
cmp edx, eax
cmove edx, eax
mov dword [0x42f104], edx
test edx, edx
jne 0x40761c
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x42f104]
mov ecx, 0xc4
cmp edx, ecx
cmove edx, ecx
mov dword [0x42f104], edx
test edx, edx
jne 0x407638
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x42f104]
mov ecx, dword [0x42f100]
mov eax, ecx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
or ecx, eax
inc edx
mov eax, 0x2a7
cmove edx, eax
mov eax, ecx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
or ecx, eax
mov eax, ecx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
shl edx, 0x15
or ecx, eax
or edx, 1
mov dword [0x42f100], ecx
mov dword [0x42f104], edx
cmp dword [edi + 0x14], ebp
jb 0x4076b3
mov ecx, dword [edi]
jmp 0x4076b5
mov ecx, edi
cmp dword [esi + 0x14], ebp
jb 0x4076be
mov eax, dword [esi]
jmp 0x4076c0
mov eax, esi
push ecx
push eax
lea eax, [esp + 0x40]
push str._s_s
push eax
call fcn.004078ec
add esp, 0x10
mov byte [esp + 0x8278], 5
cmp dword [esp + 0x4c], ebp
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x54]
call fcn.00406b83
mov byte [esp + 0x8278], 6
lea eax, [esp + 0x50]
push ebx
push eax
call fcn.00407a7d
pop ecx
pop ecx
mov bl, al
mov byte [esp + 0x8278], 5
push 0
push 1
lea ecx, [esp + 0x58]
call fcn.00401ab9
test bl, bl
jne 0x4077a8
mov byte [esp + 0x8278], 2
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x40]
call fcn.00401ab9
mov eax, 0x2fb
mov ecx, 0xc4
add esi, 0x18
cmp esi, dword [esp + 0x18]
jne 0x4075e9
mov ecx, dword [esp + 0x8284]
push edi
call fcn.00406b5c
mov dword [esp + 0x10], 1
mov byte [esp + 0x8278], 1
lea ecx, [esp + 0x14]
call fcn.00406f82
mov byte [esp + 0x8278], bl
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.00401ab9
mov ecx, dword [esp + 0x8270]
mov eax, dword [esp + 0x8284]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
mov ecx, dword [esp + 0x8284]
lea eax, [esp + 0x38]
push eax
call fcn.00406b38
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x8278], 2
xor ebx, ebx
push ebx
push eax
lea ecx, [esp + 0x40]
call fcn.00401ab9
jmp 0x407769