Function at 0x410260
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push edi
lea edi, [eax + 0x108]
push edi
call esi
cmp eax, 0xffffffff
jne 0x41042d
lea ecx, [esp + 0x18]
push 0x104
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
mov al, byte [esp + 0x18]
lea ebp, [esp + 0x18]
cmp al, 0x22
jne 0x4102be
lea edx, [esp + 0x19]
push 0x22
push edx
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
je 0x4102ba
mov byte [eax], 0
lea ebp, [esp + 0x19]
push ebp
call esi
cmp eax, 0xffffffff
jne 0x4102ff
or ecx, eax
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
mov edi, ecx
add edi, ebp
cmp edi, eax
jbe 0x4102ff
mov bl, byte [edi]
cmp bl, 0x20
je 0x4102e9
cmp bl, 9
jne 0x4102f6
push ebp
mov byte [edi], 0
call esi
cmp eax, 0xffffffff
jne 0x4102ff
mov byte [edi], bl
dec edi
lea ecx, [esp + 0x18]
cmp edi, ecx
ja 0x4102dd
mov edi, str.SystemRoot_
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.MSVCRT.dll__mbsnbicmp]
dec ecx
mov edi, ecx
lea ebx, [edx + 0x108]
push edi
push ebp
push str.SystemRoot_
call esi
add esp, 0xc
test eax, eax
jne 0x410349
push 0x104
push ebx
add ebp, edi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
add ebx, eax
mov byte [ebx], 0x5c
inc ebx
jmp 0x4103a3
mov edi, str.system32_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push str.system32_
call esi
add esp, 0xc
test eax, eax
jne 0x410380
push 0x104
push ebx
add ebp, edi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
add ebx, eax
mov byte [ebx], 0x5c
inc ebx
jmp 0x4103a3
mov edi, 0x437f60
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push 0x437f60
call esi
add esp, 0xc
test eax, eax
jne 0x4103a3
add ebp, edi
push ebp
push 0x437f5c
push ebx
mov ebx, dword [sym.imp.ntdll.dll_sprintf]
call ebx
mov eax, dword [esp + 0x130]
mov edi, dword [sym.imp.MSVCRT.dll__mbschr]
push 0x5c
lea esi, [eax + 0x108]
push esi
call edi
add esp, 0x14
test eax, eax
jne 0x41042d
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x41042d
lea ecx, [esp + 0x18]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea edi, [esp + eax + 0x18]
push esi
push 0x437f58
push edi
call ebx
add esp, 0xc
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410419
push esi
push str._system32_s
push edi
call ebx
add esp, 0xc
lea eax, [esp + 0x18]
push 0x104
push eax
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov ebx, dword [esp + 0x120]
mov eax, 0x3e88cb3d
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
sub edx, ecx
mov ebp, ecx
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x410564
mov esi, dword [ebx + 4]
test esi, esi
je 0x41047b
mov edx, ecx
mov eax, 0x3e88cb3d
sub edx, esi
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
mov edi, edx
ja 0x410480
mov edi, 1
test esi, esi
jne 0x410488
xor edx, edx
jmp 0x41049b
sub ecx, esi
mov eax, 0x3e88cb3d
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [edx + edi]
test eax, eax
mov dword [esp + 0x14], eax
jge 0x4104a8
xor eax, eax
mov edx, eax
shl edx, 6
add edx, eax
lea eax, [eax + edx*2]
shl eax, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, dword [ebx + 4]
add esp, 4
cmp esi, ebp
mov dword [esp + 0x10], eax
mov edi, eax
je 0x4104e5
push esi
push edi
call fcn.004107c0
add esi, 0x20c
add esp, 8
add edi, 0x20c
cmp esi, ebp
jne 0x4104cb
mov ecx, dword [esp + 0x124]
push ecx
push edi
call fcn.004107c0
mov edx, dword [ebx + 8]
add esp, 8
add edi, 0x20c
mov ecx, ebx
push edi
push edx
push ebp
call fcn.00410700
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
push ecx
mov ecx, ebx
call fcn.0042a500
mov edx, dword [ebx + 4]
push edx
call fcn.0042d5f4
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, eax
add esp, 4
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
mov ecx, ebx
lea eax, [esi + edx*4]
mov dword [ebx + 0xc], eax
call fcn.004106d0
inc eax
mov dword [ebx + 4], esi
mov ecx, eax
pop edi
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
lea eax, [esi + edx*4]
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov edx, ecx
mov eax, 0x3e88cb3d
sub edx, ebp
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x4105e1
lea edx, [ebp + 0x20c]
push edx
push ecx
push ebp
mov ecx, ebx
call fcn.00410700
mov edi, dword [ebx + 8]
mov eax, dword [esp + 0x124]
mov ecx, edi
push eax
sub ecx, ebp
mov eax, 0x3e88cb3d
imul ecx
sar edx, 7
mov ecx, edx
mov eax, 1
shr ecx, 0x1f
add edx, ecx
mov ecx, ebx
sub eax, edx
push eax
push edi
call fcn.00410740
mov eax, dword [ebx + 8]
cmp ebp, eax
je 0x41063c
mov esi, dword [esp + 0x124]
mov edi, ebp
add ebp, 0x20c
mov ecx, 0x83
cmp ebp, eax
rep movsd dword es:[edi], dword [esi]
jne 0x4105c5
jmp 0x41063c
push ecx
push ecx
add ecx, 0xfffffdf4
push ecx
mov ecx, ebx
call fcn.00410700
mov edx, dword [ebx + 8]
lea eax, [edx - 0x20c]
cmp ebp, eax
je 0x410618
sub eax, 0x20c
sub edx, 0x20c
mov ecx, 0x83
mov esi, eax
mov edi, edx
cmp eax, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4105fe
lea eax, [ebp + 0x20c]
cmp ebp, eax
je 0x41063c
mov esi, dword [esp + 0x124]
mov edi, ebp
add ebp, 0x20c
mov ecx, 0x83
cmp ebp, eax
rep movsd dword es:[edi], dword [esi]
jne 0x410622
mov eax, dword [ebx + 8]
pop edi
add eax, 0x20c
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
add esp, 0x10c
ret 8