Function at 0x403d30
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov eax, 0x7678
mov word [ebp - 0xac], ax
mov byte [ebp - 0x81], 0
mov dword [ebp - 0x10c], 0
mov ecx, dword [0x55c950]
mov dword [ebp - 0xbc], ecx
mov edx, dword [0x55c92c]
mov dword [ebp - 0x144], edx
mov ax, word [0x55c92c]
mov word [ebp - 0x80], ax
mov dword [ebp - 0x10c], 0x599de
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov esi, eax
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esi, eax
movzx ecx, byte [ebp - 0x81]
mov edx, dword [ebp - 0x10c]
sub edx, ecx
add edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
and edx, dword [ebp - 0x10c]
or esi, edx
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x10c]
jne 0x403dff
cmp dword [ebp - 0x10c], 0xc538
jbe 0x403dff
mov ecx, 0xfffd5103
sub ecx, dword [ebp - 0x10c]
xor edx, edx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], edx
jmp 0x403e67
mov esi, dword [ebp - 0x10c]
and esi, 0x1874c
movzx eax, word [ebp - 0xac]
or esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeExA]
add eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
lea edx, [eax + ecx - 0xc856]
or esi, edx
xor edi, edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor ecx, ecx
sub eax, dword [ebp - 0x70]
sbb ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x10c]
xor ebx, ebx
add eax, edx
adc ecx, ebx
or esi, eax
or edi, ecx
mov word [ebp - 0xac], si
movzx eax, word [ebp - 0xac]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
movzx edx, word [ebp - 0xac]
sub eax, edx
add eax, dword [ebp - 0x10c]
xor ecx, ecx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
movzx esi, word [ebp - 0xac]
and esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
and esi, eax
mov dword [ebp - 0x10c], esi
mov esi, 0x6eb84
sub esi, dword [ebp - 0x10c]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
lea esi, [esi + eax + 0x1db9f]
sub esi, dword [ebp - 0x10c]
add esi, 0x9071
movzx edx, word [ebp - 0xac]
and esi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 0x7d772
or esi, eax
mov word [ebp - 0xac], si
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
xor edx, edx
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
call fcn.0043dfb0
mov esi, eax
mov edi, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
xor ecx, ecx
and esi, eax
and edi, ecx
mov edx, dword [ebp - 0x10c]
add edx, 0xabb35
xor eax, eax
sub edx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
and esi, edx
and edi, eax
mov dword [ebp - 0x10c], esi
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
xor edx, edx
add ecx, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10c]
xor esi, esi
sub ecx, eax
sbb edx, esi
mov dword [ebp - 0x10c], ecx
movzx ecx, byte [ebp - 0x81]
test ecx, ecx
je 0x403fa9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
cmp eax, dword [ebp - 0x10c]
jne 0x403ffc
cmp dword [ebp - 0x10c], 0x48c7e
jne 0x403ffc
cmp dword [ebp - 0x10c], 0
jne 0x403ffc
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
sub esi, edx
movzx eax, word [ebp - 0xac]
add esi, eax
sub esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esi, dword [ebp - 0x10c]
add eax, esi
movzx ecx, word [ebp - 0xac]
and eax, ecx
movzx edx, byte [ebp - 0x81]
or eax, edx
mov byte [ebp - 0x81], al
jmp 0x404019
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub eax, dword [ebp - 0x10c]
or eax, 0x74b31
mov dword [ebp - 0x10c], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, dword [ebp - 0x10c]
sub esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub esi, eax
add esi, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], esi
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret