Function at 0x402000
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
push ebx
push ebp
push esi
lea esi, [eax + 0x108]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call edi
cmp eax, 0xffffffff
jne 0x4021bd
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov al, byte [esp + 0x18]
lea ebp, [esp + 0x18]
cmp al, 0x22
jne 0x40205d
lea edx, [esp + 0x19]
push 0x22
push edx
call fcn.0040d6b7
add esp, 8
test eax, eax
je 0x402059
mov byte [eax], 0
lea ebp, [esp + 0x19]
push ebp
call edi
cmp eax, 0xffffffff
jne 0x4020a2
or ecx, eax
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
mov edi, ecx
add edi, ebp
cmp edi, eax
jbe 0x4020a2
mov bl, byte [edi]
cmp bl, 0x20
je 0x402088
cmp bl, 9
jne 0x402099
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4020a2
mov byte [edi], bl
dec edi
lea ecx, [esp + 0x18]
cmp edi, ecx
ja 0x40207c
mov edi, str.SystemRoot_
or ecx, 0xffffffff
xor eax, eax
mov ebx, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push str.SystemRoot_
call fcn.0040d75c
add esp, 0xc
test eax, eax
jne 0x4020de
push 0x104
push ebx
add ebp, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add ebx, eax
mov byte [ebx], 0x5c
inc ebx
jmp 0x40213e
mov edi, str.system32_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push str.system32_
call fcn.0040d75c
add esp, 0xc
test eax, eax
jne 0x402118
push 0x104
push ebx
add ebp, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add ebx, eax
mov byte [ebx], 0x5c
inc ebx
jmp 0x40213e
mov edi, 0x41c298
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebp
push 0x41c298
call fcn.0040d75c
add esp, 0xc
test eax, eax
jne 0x40213e
add ebp, edi
push ebp
push 0x41c294
push ebx
call fcn.0040d5cb
push 0x5c
push esi
call fcn.0040d6b7
add esp, 0x14
test eax, eax
jne 0x4021bd
push 0x2f
push esi
call fcn.0040d6b7
add esp, 8
test eax, eax
jne 0x4021bd
lea edx, [esp + 0x18]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + eax + 0x18]
push esi
push 0x41c290
push edi
call fcn.0040d5cb
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4021aa
push esi
push str._system32_s
push edi
call fcn.0040d5cb
add esp, 0xc
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
call fcn.0040d61d
add esp, 0xc
mov ebx, dword [esp + 0x120]
mov eax, 0x3e88cb3d
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
sub edx, ecx
mov ebp, ecx
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x4022f4
mov esi, dword [ebx + 4]
test esi, esi
je 0x40220b
mov edx, ecx
mov eax, 0x3e88cb3d
sub edx, esi
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
mov edi, edx
ja 0x402210
mov edi, 1
test esi, esi
jne 0x402218
xor edx, edx
jmp 0x40222b
sub ecx, esi
mov eax, 0x3e88cb3d
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [edx + edi]
test eax, eax
mov dword [esp + 0x14], eax
jge 0x402238
xor eax, eax
mov edx, eax
shl edx, 6
add edx, eax
lea eax, [eax + edx*2]
shl eax, 2
push eax
call fcn.0040d74e
mov esi, dword [ebx + 4]
add esp, 4
cmp esi, ebp
mov dword [esp + 0x10], eax
mov edi, eax
je 0x402275
push esi
push edi
call fcn.00402520
add esi, 0x20c
add esp, 8
add edi, 0x20c
cmp esi, ebp
jne 0x40225b
mov ecx, dword [esp + 0x124]
push ecx
push edi
call fcn.00402520
mov edx, dword [ebx + 8]
add esp, 8
add edi, 0x20c
mov ecx, ebx
push edi
push edx
push ebp
call fcn.00402460
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
push eax
push ecx
mov ecx, ebx
call fcn.00402450
mov edx, dword [ebx + 4]
push edx
call fcn.0040a5aa
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ecx, eax
add esp, 4
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
mov ecx, ebx
lea eax, [esi + edx*4]
mov dword [ebx + 0xc], eax
call fcn.00402420
inc eax
mov dword [ebx + 4], esi
mov ecx, eax
pop edi
shl ecx, 6
add ecx, eax
lea edx, [eax + ecx*2]
lea eax, [esi + edx*4]
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov edx, ecx
mov eax, 0x3e88cb3d
sub edx, ebp
imul edx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 1
jae 0x402371
lea edx, [ebp + 0x20c]
push edx
push ecx
push ebp
mov ecx, ebx
call fcn.00402460
mov edi, dword [ebx + 8]
mov eax, dword [esp + 0x124]
mov ecx, edi
push eax
sub ecx, ebp
mov eax, 0x3e88cb3d
imul ecx
sar edx, 7
mov ecx, edx
mov eax, 1
shr ecx, 0x1f
add edx, ecx
mov ecx, ebx
sub eax, edx
push eax
push edi
call fcn.004024a0
mov eax, dword [ebx + 8]
cmp ebp, eax
je 0x4023cc
mov esi, dword [esp + 0x124]
mov edi, ebp
add ebp, 0x20c
mov ecx, 0x83
cmp ebp, eax
rep movsd dword es:[edi], dword [esi]
jne 0x402355
jmp 0x4023cc
push ecx
push ecx
add ecx, 0xfffffdf4
push ecx
mov ecx, ebx
call fcn.00402460
mov edx, dword [ebx + 8]
lea eax, [edx - 0x20c]
cmp ebp, eax
je 0x4023a8
sub eax, 0x20c
sub edx, 0x20c
mov ecx, 0x83
mov esi, eax
mov edi, edx
cmp eax, ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40238e
lea eax, [ebp + 0x20c]
cmp ebp, eax
je 0x4023cc
mov esi, dword [esp + 0x124]
mov edi, ebp
add ebp, 0x20c
mov ecx, 0x83
cmp ebp, eax
rep movsd dword es:[edi], dword [esi]
jne 0x4023b2
mov eax, dword [ebx + 8]
pop edi
add eax, 0x20c
pop esi
mov dword [ebx + 8], eax
pop ebp
pop ebx
add esp, 0x10c
ret 8