Function at 0x40ccd0
Capabilities:
Get common file path
Get program files directory
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44868c
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0x370], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0x38c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x39c]
mov dword [esp + 0x18], ecx
xor edx, edx
mov ecx, 7
mov dword [esp + 0x24], eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edx
mov word [esp + 0x48], dx
mov dword [esp + 0x394], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x74], edx
mov word [esp + 0x64], dx
lea ebx, [eax + 0xc]
mov byte [esp + 0x394], 1
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov esi, eax
test ebx, ebx
mov edi, dword [ebx + 4]
je 0x40cd5f
cmp ebx, ebx
je 0x40cd64
call fcn.00422ffd
cmp esi, edi
je 0x40ce79
test ebx, ebx
jne 0x40cd75
call fcn.00422ffd
cmp esi, dword [ebx + 4]
jne 0x40cd7f
call fcn.00422ffd
mov eax, dword [esi + 0x20]
lea ebp, [esi + 0xc]
push 0x44d3f8
mov edi, 0xa
mov ecx, ebp
call fcn.00403d20
test eax, eax
jne 0x40cdba
mov edx, 0x44d3f4
call fcn.004015c0
test eax, eax
je 0x40cdba
mov ecx, 0x44d3f4
call fcn.00401690
push eax
push str._installDir_
jmp 0x40ce0d
cmp esi, dword [ebx + 4]
jne 0x40cdc4
call fcn.00422ffd
mov edi, 8
cmp dword [ebp + 0x18], edi
jb 0x40cdd3
mov ebp, dword [ebp + 4]
jmp 0x40cdd6
add ebp, 4
push ebp
lea eax, [esp + 0x288]
push str.___s__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp esi, dword [ebx + 4]
jne 0x40cdf7
call fcn.00422ffd
cmp dword [esi + 0x40], edi
jb 0x40ce01
mov eax, dword [esi + 0x2c]
jmp 0x40ce04
lea eax, [esi + 0x2c]
push eax
lea ecx, [esp + 0x288]
push ecx
mov edx, dword [esp + 0x20]
push edx
call fcn.00421010
add esp, 0xc
cmp byte [esi + 0x45], 0
je 0x40ce2a
call fcn.00422ffd
jmp 0x40cd54
mov eax, dword [esi + 8]
cmp byte [eax + 0x45], 0
jne 0x40ce50
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
jne 0x40cd54
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
je 0x40ce41
jmp 0x40cd54
mov eax, dword [esi + 4]
cmp byte [eax + 0x45], 0
jne 0x40cd52
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x40cd52
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x45], 0
je 0x40ce60
jmp 0x40cd52
mov edx, dword [esp + 0x18]
push 0x44e78c
mov ebx, 1
xor eax, eax
call fcn.004123a0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40d36d
lea esp, [esp]
mov esi, dword [esp + 0x18]
lea eax, [ebp + 1]
push 0x44e78c
mov ebx, 1
mov edx, esi
call fcn.004123a0
sub eax, ebp
lea edi, [eax + 1]
push edi
push esi
mov ecx, ebp
lea esi, [esp + 0x30]
mov dword [esp + 0x24], edi
call fcn.00410d00
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x39c], 2
call fcn.00403570
mov byte [esp + 0x394], bl
cmp dword [esp + 0x40], 8
jb 0x40cefe
mov eax, dword [esp + 0x2c]
push eax
call fcn.00422ece
add esp, 4
push 0x44e790
xor eax, eax
lea edx, [esp + 0x48]
call fcn.004123a0
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x40cf8a
mov esi, eax
add esi, ebx
push 0x44e794
mov eax, esi
lea edx, [esp + 0x48]
call fcn.004123a0
mov edi, eax
sub edi, dword [esp + 0x20]
lea edx, [esp + 0x44]
lea ecx, [edi - 1]
push ecx
mov ecx, esi
push edx
lea esi, [esp + 0x30]
call fcn.00410d00
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x39c], 3
call fcn.00403570
mov byte [esp + 0x394], 1
cmp dword [esp + 0x40], 8
jb 0x40cf76
mov eax, dword [esp + 0x2c]
push eax
call fcn.00422ece
add esp, 4
mov ebx, dword [esp + 0x20]
lea eax, [edi + 1]
lea esi, [esp + 0x44]
call fcn.00403740
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x44]
call fcn.004212f0
mov eax, dword [esp + 0x58]
cmp eax, 7
mov esi, eax
jb 0x40cfa3
mov esi, 7
cmp dword [esp + 0x5c], 8
mov edx, dword [esp + 0x48]
jae 0x40cfb2
lea edx, [esp + 0x48]
test esi, esi
mov ecx, 0x44e798
jbe 0x40cfe5
jmp 0x40cfc0
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x40cfd5
add edx, 2
add ecx, 2
sub esi, 1
jne 0x40cfc0
jmp 0x40cfe5
mov dx, bx
cmp dx, word [ecx]
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 1
jne 0x40cff2
cmp eax, 7
jb 0x40d036
xor ecx, ecx
cmp eax, 7
setne cl
test ecx, ecx
jne 0x40d036
push 0x104
push 0x45a020
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x45a020
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d010
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
push 0x45a020
push edi
mov esi, ebp
call fcn.004121a0
jmp 0x40d34d
mov ebx, 8
push str._source_
mov edi, ebx
lea ecx, [esp + 0x48]
call fcn.00403d20
test eax, eax
jne 0x40d086
mov edx, dword [esp + 0x24]
add edx, 0x3c
mov eax, edx
lea esi, [eax + 2]
jmp 0x40d060
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d060
mov ebx, dword [esp + 0x18]
sub eax, esi
sar eax, 1
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
mov esi, ebp
call fcn.004121a0
jmp 0x40d34d
mov eax, dword [esp + 0x58]
push str._system_
lea ecx, [esp + 0x48]
call fcn.00403d20
test eax, eax
jne 0x40d0e0
push 0x104
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x40d0c6
push 0x104
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d0d0
jmp 0x40d1ab
mov eax, dword [esp + 0x58]
push str._windir_
lea ecx, [esp + 0x48]
call fcn.00403d20
test eax, eax
jne 0x40d120
push 0x104
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d110
jmp 0x40d1ab
mov eax, dword [esp + 0x58]
push str._root_
mov edi, 6
lea ecx, [esp + 0x48]
call fcn.00403d20
test eax, eax
jne 0x40d16d
push 0x104
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x7c]
mov word [esp + 0x82], 0
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d160
jmp 0x40d1ab
mov eax, dword [esp + 0x58]
push str._progfilesdir_
mov edi, 0xe
lea ecx, [esp + 0x48]
call fcn.00403d20
test eax, eax
jne 0x40d1cd
lea edx, [esp + 0x7c]
push edx
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d1a0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x80]
push eax
push ecx
mov esi, ebp
call fcn.004121a0
jmp 0x40d34d
mov eax, dword [esp + 0x58]
push str._progfilesdir64_
mov edi, 0x10
lea ecx, [esp + 0x48]
call fcn.00403d20
test eax, eax
jne 0x40d205
push 0x104
lea edx, [esp + 0x80]
push edx
push str.ProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x40d2ac
mov esi, str._startmenu_
lea ecx, [esp + 0x44]
call fcn.00415e90
test al, al
je 0x40d246
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
lea edx, [esp + 0x88]
call fcn.00410cd0
jmp 0x40d34d
mov esi, str._commonappsdir_
lea ecx, [esp + 0x44]
call fcn.00415e90
test al, al
je 0x40d287
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
lea edx, [esp + 0x88]
call fcn.00410cd0
jmp 0x40d34d
mov esi, str._commondesktop_
lea ecx, [esp + 0x44]
call fcn.00415e90
test al, al
je 0x40d2c8
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ebp
lea edx, [esp + 0x84]
push ecx
call fcn.00410cd0
jmp 0x40d34d
mov esi, str._getswitch_
lea ecx, [esp + 0x44]
call fcn.00415e90
test al, al
je 0x40d318
cmp dword [esp + 0x78], ebx
mov edx, dword [esp + 0x64]
jae 0x40d2e8
lea edx, [esp + 0x64]
call fcn.004015c0
test eax, eax
je 0x40d33e
cmp dword [esp + 0x78], ebx
mov ecx, dword [esp + 0x64]
jae 0x40d2ff
lea ecx, [esp + 0x64]
call fcn.00401690
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov edx, eax
push ecx
call fcn.00410cd0
jmp 0x40d34d
cmp dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x48]
jae 0x40d326
lea eax, [esp + 0x48]
push eax
push str.Unknown_variable___s___ignoring
push 0x4575d0
mov eax, 1
call fcn.00419220
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, ebp
call fcn.00403740
mov edx, dword [esp + 0x18]
push 0x44e78c
mov ebx, 1
xor eax, eax
call fcn.004123a0
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40cea0
mov esi, 8
cmp dword [esp + 0x78], esi
jb 0x40d385
mov edx, dword [esp + 0x64]
push edx
call fcn.00422ece
add esp, 4
xor eax, eax
cmp dword [esp + 0x5c], esi
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
jb 0x40d3ab
mov eax, dword [esp + 0x48]
push eax
call fcn.00422ece
add esp, 4
mov ecx, dword [esp + 0x38c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.00422834
add esp, 0x384
ret 4