Function at 0x407ef0
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
sub esp, 0x658
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x650], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x408226
call fcn.00407c40
test eax, eax
je 0x407f37
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x650]
xor ecx, esp
call fcn.0043e4c7
add esp, 0x658
ret
push 0x104
lea eax, [esp + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x408226
mov esi, str.system32BkavService.exe
xor ebx, ebx
lea esp, [esp]
push esi
lea ecx, [esp + 0x43c]
push ecx
push 0x47903c
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
lea eax, [esp + 0x218]
push edi
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x407f1a
sub ebx, 0xffffff80
sub esi, 0xffffff80
cmp ebx, 0xe80
jb 0x407f60
lea ecx, [esp + 0x438]
push ecx
push str._sSystem32_spooldriversW32X86_
lea edx, [esp + 0x220]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x10
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x407f1a
call fcn.00405e80
cmp eax, 6
je 0x407ff3
call fcn.00405e80
cmp eax, 7
jne 0x40804a
mov esi, str.system32SppExtComObj.exe
xor ebx, ebx
lea ebx, [ebx]
push esi
lea ecx, [esp + 0x43c]
push ecx
push 0x47903c
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
lea eax, [esp + 0x218]
push edi
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x407f1a
sub ebx, 0xffffff80
sub esi, 0xffffff80
cmp ebx, 0x500
jb 0x408000
call fcn.00407be0
test eax, eax
je 0x4080aa
mov esi, str.SysWOW64logonui.exe
xor ebx, ebx
lea ebx, [ebx]
push esi
lea ecx, [esp + 0x43c]
push ecx
push 0x47903c
lea edx, [esp + 0x224]
push 0x104
push edx
call fcn.0043ed50
add esp, 0x14
lea eax, [esp + 0x218]
push edi
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x407f1a
sub ebx, 0xffffff80
sub esi, 0xffffff80
cmp ebx, 0x900
jb 0x408060
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x1a]
push edx
mov word [esp + 0x1c], cx
call fcn.004416b0
add esp, 0xc
push 0
push 0x26
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x408226
push 0x4576d8
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.0043f083
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x408100
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408100
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edi
push edx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
je 0x407f1a
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x104
lea eax, [esp + 0x14]
push eax
mov ecx, eax
push ecx
call esi
test eax, eax
je 0x40816c
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408146
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edi
push edx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
je 0x407f1a
call fcn.00407be0
test eax, eax
je 0x408226
push 0x208
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push 0x103
lea ecx, [esp + 0x14]
push ecx
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x4576d8
lea edx, [esp + 0x14]
push 0x103
push edx
call fcn.0043f083
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4081c0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0043f6d2
add esp, 0xc
test eax, eax
je 0x407f1a
push 0x104
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call esi
test eax, eax
je 0x408226
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408200
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.0043f6d2
add esp, 0xc
test eax, eax
je 0x407f1a
mov ecx, dword [esp + 0x65c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043e4c7
add esp, 0x658
ret