Function at 0x5d0cc0
Capabilities:
Get common file path
Get hostname
Get session user name
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2e4]
push ebx
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
mov eax, 1
lea edx, [ebp - 0x27c]
lea ecx, [ebp - 0x264]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5d14d4
mov eax, dword [ebp - 4]
call fcn.005d1aa0
push 0x104
lea eax, [ebp - 0x210]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x5d0de8
mov eax, dword [ebp - 4]
mov edx, 0x6bcd04
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, 0x6bcd18
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
push 0x104
lea eax, [ebp - 0x210]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x5d0fb8
mov eax, dword [ebp - 4]
mov edx, 0x6bcd2c
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, 0x6bcd40
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov edx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, str.SYSNATIVE
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x284]
push eax
push 1
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov eax, dword [ebp - 0x288]
mov ecx, str._sysnative
mov edx, str._system32
call fcn.00419d30
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x214]
call fcn.0040ab30
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x28c]
call fcn.0040bb40
mov eax, dword [ebp - 0x28c]
call fcn.00421700
test al, al
jne 0x5d0f1c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
mov cl, 1
mov edx, 0x104
call fcn.0040c140
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x288]
xor dx, dx
call fcn.0040aab0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x210]
mov cl, 1
mov edx, 0x104
call fcn.0040c040
mov eax, dword [ebp - 0x290]
lea edx, [ebp - 0x28c]
call fcn.00415800
mov eax, dword [ebp - 0x28c]
lea edx, [ebp - 0x218]
call fcn.0040bb10
mov eax, dword [ebp - 4]
mov edx, 0x6bcd9c
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x288]
xor dx, dx
call fcn.0040aab0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
lea eax, [ebp - 0x210]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x5d1010
mov eax, dword [ebp - 4]
mov edx, 0x6bcdb4
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
nop
call sub.kernel32.dll_GetEnvironmentStringsW
mov dword [ebp - 0x248], eax
test eax, eax
je 0x5d140c
mov edx, 1
mov eax, 0x6399f0
call fcn.00442f70
mov dword [ebp - 0x250], eax
mov eax, 1
lea edx, [ebp - 0x2b4]
lea ecx, [ebp - 0x29c]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5d13f1
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x24c], eax
jmp 0x5d10c9
lea edx, [ebp - 0x244]
mov eax, dword [ebp - 0x24c]
call fcn.0040abb0
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x288]
xor dx, dx
call fcn.0040aab0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x250]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x5d10be
mov eax, dword [eax - 4]
shr eax, 1
add eax, 1
shl eax, 1
add dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x2bc]
call fcn.0040abb0
mov eax, dword [ebp - 0x2bc]
mov edx, 0x6bcdc0
call fcn.0040b010
test eax, eax
je 0x5d1101
mov eax, dword [ebp - 0x24c]
call fcn.00404b00
test eax, eax
jg 0x5d1070
mov eax, dword [ebp - 4]
mov edx, 0x6bcdd0
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov edx, 1
mov eax, 0x6399f0
call fcn.00442f70
mov dword [ebp - 0x254], eax
mov eax, 1
lea edx, [ebp - 0x2e0]
lea ecx, [ebp - 0x2c8]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5d11f4
mov eax, dword [ebp - 0x254]
mov byte [eax + 0x29], 1
mov eax, dword [ebp - 0x254]
mov dl, 0x3b
call fcn.00441780
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, 0x6bcdd0
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x254]
call fcn.00441fa0
mov eax, dword [ebp - 0x254]
mov edx, dword [ebp - 0x254]
mov edx, dword [edx]
call dword [edx + pe_nt_image_headers32]
lea ebx, [eax - 1]
test ebx, ebx
jl 0x5d11f4
mov dword [ebp - 0x258], 0xffffffff
add dword [ebp - 0x258], 1
mov edx, dword [ebp - 0x258]
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x288]
mov esi, dword [ebp - 0x254]
mov esi, dword [esi]
call dword [esi + 0x78]
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 0x258]
cmp eax, ebx
jl 0x5d11b0
lea esi, [esi]
call fcn.0040ec50
mov eax, dword [ebp - 0x254]
call fcn.0040dd50
pop eax
test eax, eax
je 0x5d120e
call fcn.0040ed80
mov eax, dword [ebp - 4]
mov edx, 0x6bcc48
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, 0x6bcc48
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, 0x6bcde4
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, 0x6bcde4
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, 0x6bcdb4
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, 0x6bcdb4
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, 0x6bce00
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, 0x6bce10
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, str.USERPROFILE
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, str.COMMONPROFILE
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, str.ALLUSERSPROFILE
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 4]
mov edx, 0x6bce74
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, str.CommonProgramFiles
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, str.CommonProgramFiles_x86_
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x288]
mov edx, str.CommonProgramFilesW6432
call fcn.00441dc0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 2
call fcn.005d1f90
call fcn.0040ec50
mov eax, dword [ebp - 0x250]
call fcn.0040dd50
pop eax
test eax, eax
je 0x5d140b
call fcn.0040ed80
nop
mov dword [ebp - 0x240], 0x10
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x5d1470
mov eax, dword [ebp - 4]
mov edx, str.COMPUTER
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x238]
xor cx, cx
mov edx, 0xf
call fcn.0040c0a0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
nop
mov dword [ebp - 0x240], 0x104
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x5d14d4
mov eax, dword [ebp - 4]
mov edx, str.USER
call fcn.005d1a00
mov dword [ebp - 0x23c], eax
push 1
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x210]
xor cx, cx
mov edx, 0x104
call fcn.0040c0a0
mov edx, dword [ebp - 0x288]
mov eax, dword [ebp - 0x23c]
mov cl, 1
call fcn.005d1f90
nop
call fcn.0040ec50
lea eax, [ebp - 0x2bc]
call fcn.0040a950
lea eax, [ebp - 0x290]
call fcn.0040b910
lea eax, [ebp - 0x28c]
call fcn.0040b910
lea eax, [ebp - 0x288]
call fcn.00403ec0
lea eax, [ebp - 0x284]
call fcn.00403ec0
lea eax, [ebp - 0x214]
call fcn.0040a950
lea eax, [ebp - 0x218]
call fcn.0040a950
lea eax, [ebp - 0x244]
call fcn.0040a950
pop eax
test eax, eax
je 0x5d153b
call fcn.0040ed80
pop esi
pop ebx
mov esp, ebp
pop ebp
ret