Function at 0x404520
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x40482d
cmp word [0x44b818], 0
push esi
push edi
jne 0x40473e
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x44b818
push str.SystemRoot
call edi
mov ecx, 0x44b818
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404560
mov esi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x44b816], 0x5c
je 0x404594
push 0x436b24
push 0x104
push 0x44b818
call esi
add esp, 0xc
push 0x104
push 0x44ba20
push str.ProgramFiles
call edi
mov ecx, 0x44ba20
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4045b0
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x44ba1e], 0x5c
je 0x4045de
push 0x436b24
push 0x104
push 0x44ba20
call esi
add esp, 0xc
push 0x104
push 0x44bc28
push str.windir
call edi
mov ecx, 0x44bc28
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4045f7
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x44bc26], 0x5c
je 0x404625
push 0x436b24
push 0x104
push 0x44bc28
call esi
add esp, 0xc
mov edi, dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x44b818
push 0x104
push 0x44be30
call edi
push 0x44b818
push 0x104
push 0x44c038
call edi
push 0x44b818
push 0x104
push 0x44c240
call edi
add esp, 0x24
push 0x104
push 0x44c448
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x44c448
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404680
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x44c446], 0x5c
je 0x4046ae
push 0x436b24
push 0x104
push 0x44c448
call esi
add esp, 0xc
push 0x44c448
push 0x104
push 0x44c650
call edi
mov ecx, 0x44c650
add esp, 0xc
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4046d0
sub ecx, edx
sar ecx, 1
push 0x104
xor eax, eax
mov dword [ecx*2 + 0x44c64a], 0x5c
push 0x44ca60
mov word [0x44c858], ax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov ecx, 0x44ca60
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404710
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x44ca5e], 0x5c
je 0x40473e
push 0x436b24
push 0x104
push 0x44ca60
call esi
add esp, 0xc
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll__wcsnicmp]
xor esi, esi
jmp 0x404750
mov edx, dword [esi*4 + 0x449dc8]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404760
sub eax, edi
mov edi, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x404790
inc esi
cmp esi, 0xa
jb 0x404750
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi*4 + 0x449dc8]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4047a0
sub ecx, edx
sar ecx, 1
imul esi, esi, 0x208
lea ebx, [esi + 0x44b818]
mov edx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4047c0
sub edx, esi
mov esi, edi
sar edx, 1
lea eax, [esi + 2]
mov dword [ebp - 4], eax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4047d7
sub esi, dword [ebp - 4]
sar esi, 1
sub esi, ecx
lea eax, [esi*2 + 2]
mov esi, dword [sym.imp.MSVCR110.dll_memmove]
push eax
lea eax, [edi + ecx*2]
push eax
lea eax, [edi + edx*2]
push eax
call esi
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404810
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push edi
call esi
add esp, 0xc
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret