Function at 0x426454
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5d0
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
mov eax, esp
lea edx, [ebp - 0x54]
mov dword [eax + 4], edx
mov dword [eax], edx
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c8], edx
call fcn.007855bc
mov dword [ebp - 0x28], 0x780834
mov dword [ebp - 0x24], 0x795018
mov eax, ebp
mov dword [ebp - 0x20], eax
mov eax, esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x4270fd
mov dword [ebp - 0x3c], 1
lea eax, [ebp - 0x44]
call fcn.007811a9
mov eax, esp
mov ecx, dword [ebp - 0x4c8]
mov dword [eax], ecx
call fcn.0040ba50
mov byte [ebp - 0x4c9], al
jmp 0x4264ce
mov al, byte [ebp - 0x4c9]
test al, 1
jne 0x4264dd
jmp 0x4267cc
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 2
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], 0x791b24
call fcn.00785588
jmp 0x426502
mov dword [ebp - 0x60], 1
jmp 0x4270b5
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x3c], 4
mov eax, esp
lea ecx, [ebp - 0x64]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426564
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x3c], 5
lea edx, [ebp - 0x64]
call fcn.004bf900
jmp 0x426578
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x3c], 6
mov eax, esp
lea ecx, [ebp - 0x47c]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x42659a
mov word [ebp - 0x476], 0
mov dword [ebp - 0x3c], 7
mov eax, esp
lea ecx, [ebp - 0x476]
mov dword [eax], ecx
mov dword [eax + 4], 0x104
call sub.KERNEL32.DLL_GetWindowsDirectoryW
sub esp, 8
mov dword [ebp - 0x4dc], eax
jmp 0x4265cb
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x3c], 8
mov eax, esp
lea ecx, [ebp - 0x476]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x480]
mov dword [eax], ecx
call fcn.0078574c
jmp 0x4265f6
mov dword [ebp - 0x3c], 9
mov eax, esp
lea ecx, [ebp - 0x480]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x47c]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x4e0], eax
jmp 0x42661d
mov eax, esp
lea ecx, [ebp - 0x480]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x3c], 0xa
mov eax, esp
lea ecx, [ebp - 0x47c]
mov dword [eax], ecx
call fcn.0040ba50
mov byte [ebp - 0x4e1], al
jmp 0x42664a
mov al, byte [ebp - 0x4e1]
and al, 1
mov byte [ebp - 0x49], al
mov al, byte [ebp - 0x49]
test al, 1
jne 0x4268f9
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x3c], 0xb
mov eax, esp
lea ecx, [ebp - 0x484]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426682
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x3c], 0xc
lea edx, [ebp - 0x484]
call fcn.00417800
jmp 0x42669c
mov dword [ebp - 0x3c], 0xd
mov eax, esp
lea ecx, [ebp - 0x484]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x47c]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x4e8], eax
jmp 0x4266c3
mov eax, esp
lea ecx, [ebp - 0x484]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x3c], 0xe
mov eax, esp
lea ecx, [ebp - 0x488]
mov dword [eax], ecx
mov dword [eax + 4], str._SYSDIR_
call fcn.00785588
jmp 0x4266fb
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x3c], 0xf
mov eax, esp
lea ecx, [ebp - 0x490]
mov dword [eax], ecx
mov dword [eax + 4], str.SYSTEM32
call fcn.00785588
jmp 0x426724
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x3c], 0x10
mov eax, esp
lea ecx, [ebp - 0x48c]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426746
mov dword [ebp - 0x3c], 0x11
mov eax, esp
lea ecx, [ebp - 0x490]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x47c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x48c]
mov dword [eax], ecx
call fcn.00785ebc
jmp 0x426770
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x48c]
mov dword [ebp - 0x3c], 0x12
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
lea eax, [ebp - 0x64]
mov dword [edx], eax
call fcn.004279d0
mov byte [ebp - 0x4e9], al
jmp 0x42679d
lea eax, [ebp - 0x48c]
mov dword [esp], eax
call fcn.0078556c
lea eax, [ebp - 0x490]
mov dword [esp], eax
call fcn.0078556c
lea eax, [ebp - 0x488]
mov dword [esp], eax
call fcn.0078556c
jmp 0x4268f9
jmp 0x426548
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x3c], 0x13
mov eax, esp
lea ecx, [ebp - 0x494]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x42691b
mov dword [ebp - 0x3c], 0x14
lea edx, [ebp - 0x494]
mov eax, 0x26
call fcn.0041707c
jmp 0x426934
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x3c], 0x15
mov eax, esp
lea ecx, [ebp - 0x498]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426956
mov dword [ebp - 0x3c], 0x16
lea edx, [ebp - 0x498]
mov eax, 0x1c
call fcn.0041707c
jmp 0x42696f
mov dword [ebp - 0x3c], 0x17
mov eax, esp
lea ecx, [ebp - 0x498]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x494]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x530], eax
jmp 0x426996
mov eax, esp
lea ecx, [ebp - 0x498]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x3c], 0x18
mov eax, esp
lea ecx, [ebp - 0x49c]
mov dword [eax], ecx
mov dword [eax + 4], str._LOCAL_APPDATA_
call fcn.00785588
jmp 0x4269ce
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x3c], 0x19
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
lea eax, [ebp - 0x64]
mov dword [edx], eax
call fcn.004279d0
mov byte [ebp - 0x531], al
jmp 0x4269fb
mov eax, esp
lea ecx, [ebp - 0x49c]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x3c], 0x1a
mov eax, esp
lea ecx, [ebp - 0x4a0]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426a2c
mov dword [ebp - 0x3c], 0x1b
lea edx, [ebp - 0x4a0]
mov eax, 7
call fcn.0041707c
jmp 0x426a45
mov dword [ebp - 0x3c], 0x1c
mov eax, esp
lea ecx, [ebp - 0x4a0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x494]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x538], eax
jmp 0x426a6c
mov eax, esp
lea ecx, [ebp - 0x4a0]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x3c], 0x1d
mov eax, esp
lea ecx, [ebp - 0x4a4]
mov dword [eax], ecx
mov dword [eax + 4], str._STARTUP_
call fcn.00785588
jmp 0x426aa4
mov eax, dword [ebp - 0x4a4]
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x3c], 0x1e
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
lea eax, [ebp - 0x64]
mov dword [edx], eax
call fcn.004279d0
mov byte [ebp - 0x539], al
jmp 0x426ad1
mov eax, esp
lea ecx, [ebp - 0x4a4]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x3c], 0x1f
mov eax, esp
lea ecx, [ebp - 0x4a8]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426b02
mov dword [ebp - 0x3c], 0x20
lea edx, [ebp - 0x4a8]
mov eax, 0xb
call fcn.0041707c
jmp 0x426b1b
mov dword [ebp - 0x3c], 0x21
mov eax, esp
lea ecx, [ebp - 0x4a8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x494]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x540], eax
jmp 0x426b42
mov eax, esp
lea ecx, [ebp - 0x4a8]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4ac], 0
mov dword [ebp - 0x3c], 0x22
mov eax, esp
lea ecx, [ebp - 0x4ac]
mov dword [eax], ecx
mov dword [eax + 4], str._START_MENU_
call fcn.00785588
jmp 0x426b7a
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x3c], 0x23
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
lea eax, [ebp - 0x64]
mov dword [edx], eax
call fcn.004279d0
mov byte [ebp - 0x541], al
jmp 0x426ba7
mov eax, esp
lea ecx, [ebp - 0x4ac]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4b0], 0
mov dword [ebp - 0x3c], 0x24
mov eax, esp
lea ecx, [ebp - 0x4b0]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426bd8
mov dword [ebp - 0x3c], 0x25
lea edx, [ebp - 0x4b0]
mov eax, 0x28
call fcn.0041707c
jmp 0x426bf1
mov dword [ebp - 0x3c], 0x26
mov eax, esp
lea ecx, [ebp - 0x4b0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x494]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x548], eax
jmp 0x426c18
mov eax, esp
lea ecx, [ebp - 0x4b0]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x3c], 0x27
mov eax, esp
lea ecx, [ebp - 0x4b4]
mov dword [eax], ecx
mov dword [eax + 4], str._PROFILE_
call fcn.00785588
jmp 0x426c50
mov eax, dword [ebp - 0x4b4]
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x3c], 0x28
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
lea eax, [ebp - 0x64]
mov dword [edx], eax
call fcn.004279d0
mov byte [ebp - 0x549], al
jmp 0x426c7d
mov eax, esp
lea ecx, [ebp - 0x4b4]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x3c], 0x29
mov eax, esp
lea ecx, [ebp - 0x4b8]
mov dword [eax], ecx
call fcn.00404c44
jmp 0x426cae
mov dword [ebp - 0x3c], 0x2a
lea edx, [ebp - 0x4b8]
mov eax, 0x23
call fcn.0041707c
jmp 0x426cc7
mov dword [ebp - 0x3c], 0x2b
mov eax, esp
lea ecx, [ebp - 0x4b8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x494]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x550], eax
jmp 0x426cee
mov eax, esp
lea ecx, [ebp - 0x4b8]
mov dword [eax], ecx
call fcn.0078556c
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x3c], 0x2c
mov eax, esp
lea ecx, [ebp - 0x4bc]
mov dword [eax], ecx
mov dword [eax + 4], str._COMMON_APPDATA_
call fcn.00785588
jmp 0x426d26
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [ebp - 0x494]
mov dword [ebp - 0x3c], 0x2d
mov edx, esp
mov dword [edx + 8], ecx
mov dword [edx + 4], eax
lea eax, [ebp - 0x64]
mov dword [edx], eax
call fcn.004279d0
mov byte [ebp - 0x551], al
jmp 0x426d53
mov eax, esp
lea ecx, [ebp - 0x4bc]
mov dword [eax], ecx
call fcn.0078556c
mov word [ebp - 0x476], 0
mov dword [ebp - 0x3c], 0x2e
mov eax, esp
lea ecx, [ebp - 0x64]
mov dword [eax], ecx
call fcn.0040826c
mov dword [ebp - 0x558], eax
jmp 0x426d86
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x3c], 0x2f
mov edx, esp
lea esi, [ebp - 0x476]
mov dword [edx + 4], esi
mov dword [edx], ecx
mov dword [edx + 8], 0x208
call sub.KERNEL32.DLL_ExpandEnvironmentStringsW
sub esp, 0xc
mov dword [ebp - 0x55c], eax
jmp 0x426dbd
mov dword [ebp - 0x4c0], 0
mov dword [ebp - 0x3c], 0x30
mov eax, esp
lea ecx, [ebp - 0x476]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x4c0]
mov dword [eax], ecx
call fcn.0078574c
jmp 0x426de8
mov dword [ebp - 0x3c], 0x31
mov eax, esp
lea ecx, [ebp - 0x4c0]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x64]
mov dword [eax], ecx
call fcn.00785cc0
mov dword [ebp - 0x560], eax
jmp 0x426e0c
lea eax, [ebp - 0x4c0]
mov dword [esp], eax
call fcn.0078556c
lea eax, [ebp - 0x494]
mov dword [esp], eax
call fcn.0078556c
jmp 0x427045
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x3c], 0x33
mov ecx, esp
lea edx, [ebp - 0x64]
mov dword [ecx + 4], edx
mov dword [ecx], eax
call fcn.007855bc
jmp 0x427060
lea eax, [ebp - 0x47c]
mov dword [ebp - 0x60], 1
mov dword [esp], eax
call fcn.0078556c
lea eax, [ebp - 0x64]
mov dword [esp], eax
call fcn.0078556c
jmp 0x4270b5
lea eax, [ebp - 0x54]
mov dword [esp], eax
call fcn.0078556c
jmp 0x4270cf
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.007811ca
mov eax, dword [ebp - 0x4c4]
add esp, 0x5d0
pop esi
pop edi
pop ebx
pop ebp
ret