Function at 0x40c5f0
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
sub esp, 0x210
push ebx
push ebp
mov ebp, dword [esp + 0x21c]
push esi
push edi
push 4
push 0x442114
push ebp
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x40c62f
mov eax, dword [esp + 0x22c]
mov ebx, dword [esp + 0x228]
add ebp, 4
push eax
push ebp
push ebx
jmp 0x40c82c
push 0x20
push ebp
call dword [sym.imp.MSVCRT.dll__mbschr]
mov ebx, dword [esp + 0x230]
mov dword [esp + 0x18], eax
mov al, byte [ebp]
add esp, 8
cmp al, 0x22
mov esi, ebx
jne 0x40c688
lea edi, [ebp + 1]
push 0x22
push edi
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x40c679
sub eax, ebp
cmp eax, 2
jl 0x40c679
mov ecx, dword [esp + 0x22c]
dec eax
cmp eax, ecx
jle 0x40c686
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
mov ebp, edi
mov al, byte [ebp + 1]
lea edi, [ebp + 1]
cmp al, 0x3a
je 0x40c7fa
mov esi, dword [sym.imp.MSVCRT.dll__mbsnbicmp]
push 0xc
push 0x4428c8
push ebp
call esi
add esp, 0xc
test eax, eax
jne 0x40c6dd
mov ecx, dword [esp + 0x22c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
add esi, ebx
cmp esi, ebx
jne 0x40c6d1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
mov byte [esi], 0x5c
inc esi
add ebp, 0xc
jmp 0x40c7fa
push 0xc
push 0x4428b8
push ebp
call esi
add esp, 0xc
test eax, eax
jne 0x40c712
mov edx, dword [esp + 0x22c]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
add esi, ebx
cmp esi, ebx
jne 0x40c6d5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
mov al, byte [ebp]
cmp al, 0x5c
je 0x40c679
cmp al, 0x25
jne 0x40c7d2
push 0x25
push edi
call dword [sym.imp.MSVCRT.dll__mbschr]
mov edx, eax
add esp, 8
test edx, edx
mov dword [esp + 0x14], edx
jne 0x40c746
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__mbsnbcpy]
sub edx, ebp
stosw word es:[edi], ax
inc edx
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x1c]
push ebp
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x18]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x11c]
push eax
push ecx
push ebx
call esi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x14]
not ecx
dec ecx
lea ebp, [edx + 1]
mov esi, ecx
add esi, ebx
jmp 0x40c7fa
mov eax, dword [esp + 0x22c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, eax
add esi, ebx
cmp esi, ebx
jne 0x40c7f6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
mov byte [esi], 0x5c
inc esi
mov edi, dword [esp + 0x22c]
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
add eax, edi
test ecx, ecx
je 0x40c829
sub ecx, ebp
cmp ecx, 2
jge 0x40c823
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
cmp ecx, eax
jae 0x40c829
mov eax, ecx
push eax
push ebp
push esi
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
pop edi
and eax, 2
pop esi
pop ebp
dec eax
pop ebx
add esp, 0x210
ret