Function at 0x4248c0
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ef16
mov eax, dword fs:[0]
push eax
sub esp, 0x6bc
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x6c4], ebx
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x424949
xor eax, eax
mov dword [ebx + 0x14], 7
push eax
mov dword [ebx + 0x10], 0
push 0x619488
mov word [ebx], ax
call fcn.00403d10
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x42531c
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00404090
jmp 0x42531c
push 0x61bd9c
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x4249cf
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00576f50
add esp, 8
lea edx, [ebp - 0x218]
push 0x26
call fcn.004254f0
lea edi, [ebp - 0x218]
add esp, 8
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x424990
mov eax, dword [0x61970c]
mov ecx, ebx
mov dword [edi], eax
lea eax, [ebp - 0x218]
push eax
call fcn.004039f0
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x42531c
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00404090
jmp 0x42531c
push 0x61bd94
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424a36
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00576f50
add esp, 8
lea edx, [ebp - 0x218]
push 5
call fcn.004254f0
lea edi, [ebp - 0x218]
add esp, 8
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x424a10
mov eax, dword [0x61970c]
mov dword [edi], eax
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.004039f0
jmp 0x425314
push str.desktop
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424a87
push eax
push eax
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x424a61
mov eax, dword [0x61970c]
mov ecx, ebx
mov dword [edi], eax
lea eax, [ebp - 0x428]
push eax
call fcn.004039f0
jmp 0x425314
push 0x61bda4
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424ac1
push eax
push 6
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x428]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x424ab3
jmp 0x424a6d
push str.program
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424b80
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00576f50
add esp, 8
lea edx, [ebp - 0x218]
push 0x26
call fcn.004254f0
lea ecx, [ebp - 0x218]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424b04
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jl 0x424a23
push 0x208
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x218]
push 3
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0058502d
lea edi, [ebp - 0x428]
add esp, 0xc
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x424b53
mov ecx, 7
lea eax, [ebp - 0x428]
mov esi, str.Program_Files_
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
movsw word es:[edi], word [esi]
call fcn.004039f0
jmp 0x425314
push str.curr
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424be4
push 0x208
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x428]
push 0x5c
push eax
call fcn.00575fd0
xor ecx, ecx
add esp, 8
mov word [eax + 2], cx
lea eax, [ebp - 0x428]
push eax
mov ecx, ebx
call fcn.004039f0
jmp 0x425314
push str.temp
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424cff
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x208
push 0
push eax
call fcn.00576f50
add esp, 0xc
call fcn.00425340
test al, al
je 0x424c90
push ecx
push 0x1c
lea edx, [ebp - 0x218]
call fcn.004254f0
add esp, 8
test eax, eax
je 0x424cec
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x424c50
mov eax, dword [str.Temp_]
mov dword [ecx], eax
mov eax, dword [0x61be14]
mov dword [ecx + 4], eax
mov eax, dword [0x61be18]
mov dword [ecx + 8], eax
mov ax, word [0x61be1c]
mov word [ecx + 0xc], ax
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.004039f0
jmp 0x425314
lea eax, [ebp - 0x428]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424cc4
sub ecx, edx
sar ecx, 1
jne 0x424cec
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.004039f0
jmp 0x425314
push str.recirle
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424d48
push 0x208
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00576f50
add esp, 8
lea edx, [ebp - 0x428]
push 0xa
call fcn.004254f0
add esp, 8
lea eax, [ebp - 0x428]
mov ecx, ebx
push eax
call fcn.004039f0
jmp 0x425314
push str.downloads
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x424e9e
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00576f50
add esp, 8
lea edx, [ebp - 0x218]
push 0x10
call fcn.004254f0
lea ecx, [ebp - 0x218]
add esp, 8
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424d90
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
je 0x424e11
push 0x5c
push eax
call fcn.00575fd0
xor ecx, ecx
add esp, 8
mov word [eax + 2], cx
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x424dc1
mov eax, dword [0x61be5c]
mov dword [ecx], eax
mov eax, dword [0x61be60]
mov dword [ecx + 4], eax
mov eax, dword [0x61be64]
mov dword [ecx + 8], eax
mov eax, dword [0x61be68]
mov dword [ecx + 0xc], eax
mov eax, dword [0x61be6c]
mov dword [ecx + 0x10], eax
mov ax, word [0x61be70]
mov word [ecx + 0x14], ax
lea eax, [ebp - 0x218]
push eax
mov ecx, ebx
call fcn.004039f0
jmp 0x425314
push 0x104
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424e30
sub ecx, edx
sar ecx, 1
je 0x424e8b
lea ecx, [ebp - 0x218]
add ecx, 0xfffffffe
nop word [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x424e50
mov eax, dword [str.Downloads_]
mov dword [ecx], eax
mov eax, dword [0x61bea0]
mov dword [ecx + 4], eax
mov eax, dword [0x61bea4]
mov dword [ecx + 8], eax
mov eax, dword [0x61bea8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x61beac]
mov dword [ecx + 0x10], eax
mov eax, dword [0x61beb0]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.004039f0
jmp 0x425314
xor eax, eax
mov dword [ebp - 0x634], 7
mov dword [ebp - 0x638], 0
mov word [ebp - 0x648], ax
push 0x208
push eax
lea eax, [ebp - 0x630]
mov byte [ebp - 4], 1
push eax
call fcn.00576f50
add esp, 0xc
lea eax, [ebp - 0x630]
push 0x104
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edi, [ebp - 0x630]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x424ef4
mov ecx, 9
lea eax, [ebp - 0x630]
mov esi, str.AppDataLocalLow_
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x648]
movsw word es:[edi], word [esi]
call fcn.00403920
push str.locallow
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x425008
push ecx
push 0x1a
lea edx, [ebp - 0x630]
call fcn.004254f0
add esp, 8
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x690]
call fcn.004039f0
push str.LocalLow
lea ecx, [ebp - 0x678]
mov byte [ebp - 4], 2
call fcn.004039f0
push str.Roaming
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 3
call fcn.004039f0
lea eax, [ebp - 0x678]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x660]
lea ecx, [ebp - 0x690]
call fcn.00429730
add esp, 4
lea ecx, [ebp - 0x660]
call fcn.00402d00
lea ecx, [ebp - 0x678]
mov byte [ebp - 4], 2
call fcn.00402d00
cmp dword [ebp - 0x67c], 8
lea eax, [ebp - 0x690]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x690]
push eax
call esi
test eax, eax
je 0x424ffd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0x648]
call fcn.00403e10
lea ecx, [ebp - 0x690]
jmp 0x42529d
push str.roaming
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
je 0x4251ab
push str.Roaming
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
je 0x4251ab
push str.local
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x42513e
push ecx
push 0x1c
lea edx, [ebp - 0x630]
call fcn.004254f0
add esp, 8
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x630]
push eax
call esi
test eax, eax
je 0x42508f
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x648]
call fcn.00403920
jmp 0x4252a6
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x6a8]
call fcn.00403a50
push str.Local
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 8
call fcn.004039f0
push str.LocalLow
lea ecx, [ebp - 0x678]
mov byte [ebp - 4], 9
call fcn.004039f0
lea eax, [ebp - 0x660]
mov byte [ebp - 4], 0xa
push eax
lea edx, [ebp - 0x678]
lea ecx, [ebp - 0x6a8]
call fcn.00429730
add esp, 4
lea ecx, [ebp - 0x678]
call fcn.00402d00
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 8
call fcn.00402d00
cmp dword [ebp - 0x694], 8
lea eax, [ebp - 0x6a8]
cmovae eax, dword [ebp - 0x6a8]
push eax
call esi
test eax, eax
je 0x425133
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x648]
call fcn.00403e10
lea ecx, [ebp - 0x6a8]
jmp 0x42529d
push str.system
lea ecx, [ebp + 8]
call fcn.0040c060
test eax, eax
jne 0x42519b
push ecx
push 0x29
lea edx, [ebp - 0x630]
call fcn.004254f0
add esp, 8
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x630]
push eax
call esi
test eax, eax
je 0x4252a6
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x648]
call fcn.00403920
jmp 0x4252a6
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.00404b00
jmp 0x425309
push ecx
push 0x1a
lea edx, [ebp - 0x630]
call fcn.004254f0
add esp, 8
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x630]
push eax
call esi
test eax, eax
je 0x4251f3
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x648]
call fcn.00403920
jmp 0x4252a6
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.00403a50
push str.Roaming
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 5
call fcn.004039f0
push str.LocalLow
lea ecx, [ebp - 0x678]
mov byte [ebp - 4], 6
call fcn.004039f0
lea eax, [ebp - 0x660]
mov byte [ebp - 4], 7
push eax
lea edx, [ebp - 0x678]
lea ecx, [ebp - 0x6c0]
call fcn.00429730
add esp, 4
lea ecx, [ebp - 0x678]
call fcn.00402d00
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 5
call fcn.00402d00
cmp dword [ebp - 0x6ac], 8
lea eax, [ebp - 0x6c0]
cmovae eax, dword [ebp - 0x6c0]
push eax
call esi
test eax, eax
je 0x425297
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0x648]
call fcn.00403e10
lea ecx, [ebp - 0x6c0]
mov byte [ebp - 4], 1
call fcn.00402d00
cmp dword [ebp - 0x634], 8
lea eax, [ebp - 0x648]
cmovae eax, dword [ebp - 0x648]
push eax
call esi
test eax, eax
je 0x4252fd
push ecx
push str.system32
lea ecx, [ebp - 0x648]
call fcn.004038c0
cmp eax, 0xffffffff
jne 0x4252fd
push ecx
push str.systemprofile
lea ecx, [ebp - 0x648]
call fcn.004038c0
cmp eax, 0xffffffff
jne 0x4252fd
lea eax, [ebp - 0x648]
mov ecx, ebx
push eax
call fcn.00404b00
jmp 0x425309
push 0x619488
mov ecx, ebx
call fcn.004039f0
lea ecx, [ebp - 0x648]
call fcn.00402d00
lea ecx, [ebp + 8]
call fcn.00402d00
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret