Function at 0x49d750
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca961
mov eax, dword fs:[0]
push eax
mov eax, 0x26b8
call fcn.0055b970
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x26b4], ecx
mov ecx, dword [ebp + 8]
call fcn.00404b70
test eax, eax
jne 0x49d796
jmp 0x49dc75
push 0
push str.rundll32.exe
mov ecx, dword [ebp + 8]
call fcn.004b5100
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x49d7b9
mov eax, dword [ebp - 0x10]
add eax, 0xd
mov dword [ebp - 0x10], eax
jmp 0x49d7da
push 0
push 0x608aa8
mov ecx, dword [ebp + 8]
call fcn.004b5100
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x49d7da
mov ecx, dword [ebp - 0x10]
add ecx, 9
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jl 0x49d89e
mov edx, dword [ebp - 0x10]
push edx
push 0x2c
mov ecx, dword [ebp + 8]
call fcn.004b4ed0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x49d851
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x26a4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004b6620
mov dword [ebp - 0x26b8], eax
mov eax, dword [ebp - 0x26b8]
mov dword [ebp - 0x26bc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x26bc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b3890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26a4]
call fcn.004b3860
jmp 0x49d89e
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x26b0]
push eax
mov ecx, dword [ebp + 8]
call fcn.004b64e0
mov dword [ebp - 0x26c0], eax
mov ecx, dword [ebp - 0x26c0]
mov dword [ebp - 0x26c4], ecx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x26c4]
push edx
mov ecx, dword [ebp + 8]
call fcn.004b3890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26b0]
call fcn.004b3860
push 0x5feb54
mov ecx, dword [ebp + 8]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x49d93f
push 1
push 0x5feb54
mov ecx, dword [ebp + 8]
call fcn.004b5060
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x49d8f2
mov ecx, dword [ebp + 8]
call fcn.00404b70
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b5a90
push 1
push 0
mov ecx, dword [ebp + 8]
call fcn.004b5a90
mov ecx, dword [ebp + 8]
call fcn.00404b70
test eax, eax
jle 0x49d93a
push 0
mov ecx, dword [ebp + 8]
call fcn.004b3df0
movzx edx, ax
cmp edx, 0x25
jne 0x49d93a
push 0x400
lea eax, [ebp - 0x81c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b38f0
jmp 0x49da15
push 0
push str._globalroot
mov ecx, dword [ebp + 8]
call fcn.004b68a0
movzx edx, al
test edx, edx
je 0x49d966
push 0xe
push 0
mov ecx, dword [ebp + 8]
call fcn.004b5a90
jmp 0x49da15
push 0x604bf0
mov ecx, dword [ebp + 8]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x49d98b
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.004b5a90
jmp 0x49da15
mov ecx, dword [ebp + 8]
call fcn.00404b70
test eax, eax
jle 0x49da15
push 0
mov ecx, dword [ebp + 8]
call fcn.004b3df0
movzx ecx, ax
cmp ecx, 0x25
jne 0x49d9d3
push 0x400
lea edx, [ebp - 0x101c]
push edx
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x101c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004b38f0
push 0x5c
mov ecx, dword [ebp + 8]
call fcn.004b5770
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x49da15
mov ecx, dword [ebp - 0x10]
push ecx
push 0x20
mov ecx, dword [ebp + 8]
call fcn.004b4ed0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x49da15
mov ecx, dword [ebp + 8]
call fcn.00404b70
sub eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.004b5a90
push 0
push str.system32_
mov ecx, dword [ebp + 8]
call fcn.004b68a0
movzx eax, al
test eax, eax
je 0x49da60
push 0x104
lea ecx, [ebp - 0x1224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x49da5e
push 8
push 0
mov ecx, dword [ebp + 8]
call fcn.004b5a90
lea edx, [ebp - 0x1224]
push edx
push 0
mov ecx, dword [ebp + 8]
call fcn.004b54e0
jmp 0x49daa9
push 0
push str.SystemRoot_
mov ecx, dword [ebp + 8]
call fcn.004b68a0
movzx eax, al
test eax, eax
je 0x49daa9
push 0x104
lea ecx, [ebp - 0x142c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x49daa9
push 0xb
push 0
mov ecx, dword [ebp + 8]
call fcn.004b5a90
lea edx, [ebp - 0x142c]
push edx
push 0
mov ecx, dword [ebp + 8]
call fcn.004b54e0
push 0x5c
mov ecx, dword [ebp + 8]
call fcn.004b5770
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x49db7c
push 0x2e
mov ecx, dword [ebp + 8]
call fcn.004b5770
mov dword [ebp - 0x1430], eax
mov eax, dword [ebp - 0x1430]
cmp eax, dword [ebp - 0x10]
jge 0x49db7c
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x143c]
call fcn.004b34d0
mov dword [ebp - 4], 2
push 0x608adc
lea ecx, [ebp - 0x143c]
call fcn.004b3b40
lea edx, [ebp - 0x1694]
push edx
lea ecx, [ebp - 0x143c]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1440], eax
cmp dword [ebp - 0x1440], 0xffffffff
je 0x49db6a
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.00404b70
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b5a90
lea edx, [ebp - 0x1668]
push edx
mov ecx, dword [ebp + 8]
call fcn.004b3b40
mov eax, dword [ebp - 0x1440]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x143c]
call fcn.004b3860
push 0x604560
mov ecx, dword [ebp + 8]
call fcn.004b45e0
movzx ecx, al
test ecx, ecx
je 0x49dbbe
push 0x400
lea edx, [ebp - 0x1e94]
push edx
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x49dbbe
lea eax, [ebp - 0x1e94]
push eax
mov ecx, dword [ebp + 8]
call fcn.004b38f0
push 0x5c
mov ecx, dword [ebp + 8]
call fcn.004b45b0
movzx ecx, al
test ecx, ecx
jne 0x49dc75
push 0x5fc5b0
mov ecx, dword [ebp + 8]
call fcn.004b45e0
movzx edx, al
test edx, edx
jne 0x49dbf4
push str..exe
mov ecx, dword [ebp + 8]
call fcn.004b3b40
lea eax, [ebp - 0x2698]
push eax
lea ecx, [ebp - 0x2694]
push ecx
push 0x400
push 0
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x49dc66
push 0x400
lea edx, [ebp - 0x2694]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x5fc5a0
push 0x400
lea eax, [ebp - 0x2694]
push eax
call fcn.0054eb7c
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.004553f0
push eax
push 0x400
lea ecx, [ebp - 0x2694]
push ecx
call fcn.0054eb7c
add esp, 0xc
lea edx, [ebp - 0x2694]
push edx
mov ecx, dword [ebp + 8]
call fcn.004b38f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret 4