Function at 0x10752a7
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x440
mov eax, 0x10b8e79
call fcn.010aacd7
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1019f14
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x434], edi
call fcn.010ab86f
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
cmp edi, ebx
jne 0x1075354
mov eax, dword [section..data]
cmp eax, section..data
je 0x1075339
test byte [eax + 0x1c], 4
je 0x1075339
push 0x1019d30
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102fea5
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.010ab8b6
mov eax, esi
call fcn.010aad69
ret 4
lea eax, [ebp - 0x428]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x107539d
mov eax, dword [section..data]
cmp eax, section..data
je 0x10753b8
test byte [eax + 0x1c], 8
je 0x10753b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0107918f
jmp 0x10753b8
push edi
lea eax, [ebp - 0x428]
push eax
call fcn.01075130
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x10755b6
and dword [ebp - 0x430], 0
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 0x444], 0x1019f04
mov dword [ebp - 0x440], 0x1019ef4
mov dword [ebp - 0x43c], 0x1019ecc
mov dword [ebp - 0x438], 0x1019ea4
xor eax, eax
mov word [ebp - 0x21c], ax
mov eax, dword [ebp - 0x430]
mov esi, dword [ebp + eax*4 - 0x444]
push ebx
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1075449
mov eax, dword [section..data]
cmp eax, section..data
je 0x107547e
test byte [eax + 0x1c], 8
je 0x107547e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push esi
push 0x1019d30
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0109509d
jmp 0x107547e
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 1
push 0x7f
call edi
cmp eax, 2
je 0x107547e
push dword [ebp - 0x434]
lea eax, [ebp - 0x21c]
push eax
call fcn.01075130
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
je 0x107549a
inc dword [ebp - 0x430]
cmp dword [ebp - 0x430], 4
jl 0x10753ed
xor ebx, ebx
cmp dword [ebp - 0x42c], ebx
jne 0x10755b6
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
push 0x1c
lea eax, [ebp - 0x21c]
push eax
push ebx
call esi
test eax, eax
jne 0x10754f9
mov eax, dword [section..data]
cmp eax, section..data
je 0x107555b
test byte [eax + 0x1c], 8
je 0x107555b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0107918f
jmp 0x107555b
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, ebx
je 0x1075522
xor ecx, ecx
mov word [eax], cx
push 0x1019e98
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 1
push 0x7f
call edi
cmp eax, 2
je 0x107555b
push dword [ebp - 0x434]
lea eax, [ebp - 0x21c]
push eax
call fcn.01075130
mov dword [ebp - 0x42c], eax
cmp eax, ebx
jne 0x10755b6
push ebx
push 0x20
lea eax, [ebp - 0x428]
push eax
push ebx
call esi
test eax, eax
jne 0x107559e
mov eax, dword [section..data]
cmp eax, section..data
je 0x10755b6
test byte [eax + 0x1c], 8
je 0x10755b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0107918f
jmp 0x10755b6
push dword [ebp - 0x434]
lea eax, [ebp - 0x428]
push eax
call fcn.01075130
mov dword [ebp - 0x42c], eax
mov esi, dword [ebp - 0x42c]
jmp 0x107533b