Function at 0x41da70
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x620
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x61c], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x216]
push ecx
mov word [esp + 0x218], ax
call fcn.004416b0
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x16]
push eax
mov word [esp + 0x18], dx
call fcn.004416b0
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x436]
push edx
mov word [esp + 0x438], cx
call fcn.004416b0
add esp, 0x24
push 0x103
lea eax, [esp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41db03
sub eax, edx
sar eax, 1
cmp eax, 1
jle 0x41db46
cmp word [ebx], 0x22
jne 0x41db46
lea ecx, [eax - 1]
test ecx, ecx
jle 0x41db30
push esi
push edi
lea esi, [ebx + 2]
mov edi, ebx
rep movsw word es:[edi], word [esi]
pop edi
pop esi
xor edx, edx
cmp word [ebx + eax*2 - 4], 0x22
mov word [ebx + eax*2 - 2], dx
jne 0x41db46
xor ecx, ecx
mov word [ebx + eax*2 - 4], cx
cmp word [ebx], 0x25
jne 0x41db84
push 0x104
lea edx, [esp + 4]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp]
push eax
push 0x104
push ebx
call fcn.0043efc3
add esp, 0xc
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push 9
push str.system32_
push ebx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x41dbe0
lea ecx, [ebx + 0x12]
push ecx
lea edx, [esp + 0x210]
push edx
push 0x47903c
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.0043ed50
lea ecx, [esp + 0x14]
push ecx
push 0x104
push ebx
call fcn.0043efc3
add esp, 0x20
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push 0xd
push str._SystemRoot__
push ebx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x41dc3c
lea edx, [ebx + 0x1a]
push edx
lea eax, [esp + 0x210]
push eax
push 0x47903c
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.0043ed50
lea edx, [esp + 0x14]
push edx
push 0x104
push ebx
call fcn.0043efc3
add esp, 0x20
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push 0xd
push str._SystemRoot__
push ebx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x41dc98
lea eax, [ebx + 0x1a]
push eax
lea ecx, [esp + 0x210]
push ecx
push 0x47903c
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.0043ed50
lea eax, [esp + 0x14]
push eax
push 0x104
push ebx
call fcn.0043efc3
add esp, 0x20
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push 0xc
push str.SystemRoot_
push ebx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x41dcb4
lea ecx, [ebx + 0x18]
jmp 0x41db9b
push 4
push str.___
push ebx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x41dd03
lea edx, [ebx + 8]
push edx
lea eax, [esp + 4]
push 0x104
push eax
call fcn.0043efc3
lea ecx, [esp + 0xc]
push ecx
push 0x104
push ebx
call fcn.0043efc3
add esp, 0x18
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret
push 0x48101c
push ebx
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x41dd35
push 0x48101c
lea edx, [esp + 0x210]
push edx
push 0x47903c
push 0x104
push ebx
call fcn.0043ed50
add esp, 0x14
push str.Userinit.exe
push ebx
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x41dd67
push str.Userinit.exe
lea eax, [esp + 0x418]
push eax
push 0x47903c
push 0x104
push ebx
call fcn.0043ed50
add esp, 0x14
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x620
ret