Function at 0x43a170
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51bab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x928
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x70], 7
xor edi, edi
mov dword [ebp - 0x74], edi
xor eax, eax
mov word [ebp - 0x84], ax
push 4
mov eax, 0x52c480
lea esi, [ebp - 0x84]
call fcn.00412b10
mov dword [ebp - 4], edi
mov ebx, 1
mov byte [ebp - 4], bl
mov dword [ebp - 0x30], 0x400
mov ecx, esi
push ecx
mov eax, str._bin_
call fcn.0040fb40
push 0x5727e0
mov eax, str.:_recycle.bin
call fcn.0040fb40
push 0x5727fc
mov eax, str.:_recycler
call fcn.0040fb40
mov edx, esi
push edx
mov eax, str.GetWinDir
call fcn.0040fb40
lea eax, [ebp - 0x2c]
push eax
call fcn.00418940
add esp, 4
mov byte [ebp - 4], 2
mov edi, eax
mov esi, 0x572690
call fcn.00411aa0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x2c]
call fcn.004150b0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004189e0
add esp, 4
mov byte [ebp - 4], 3
mov edi, eax
mov esi, 0x5726ac
call fcn.00411aa0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x2c]
call fcn.004150b0
lea edx, [ebp - 0x84]
push edx
mov eax, str.Is64
call fcn.0040fb40
cmp dword [0x572ac8], 0
je 0x43a292
lea eax, [ebp - 0x4c]
push eax
call fcn.004621c0
add esp, 4
cmp dword [ebp - 0x38], 8
jb 0x43a28c
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov word [ebp - 0x4c], dx
mov al, byte [0x15797cd]
mov byte [0x1579730], al
lea ecx, [ebp - 0x84]
push ecx
mov eax, str.Users
call fcn.0040fb40
push 0x5726c8
mov eax, str.C:Users
call fcn.0040fb40
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x930]
push eax
call dword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryW]
test eax, eax
je 0x43a31a
lea eax, [ebp - 0x930]
lea ecx, [ebp - 0x4c]
call fcn.0040fae0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.004407a0
add esp, 8
mov byte [ebp - 4], 5
mov edi, eax
mov esi, 0x5726c8
call fcn.00411aa0
mov byte [ebp - 4], 4
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x4c]
call fcn.004150b0
lea eax, [ebp - 0x84]
push eax
mov eax, str.ProgramData
call fcn.0040fb40
push 0x5726e4
mov eax, str.C:ProgramData
call fcn.0040fb40
push 0x400
lea ecx, [ebp - 0x930]
push ecx
push str._ProgramData_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43a365
push 0x5726e4
lea eax, [ebp - 0x930]
call fcn.0040fb40
cmp dword [0x5726f4], 0
jne 0x43a3cc
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x930]
push eax
call dword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
test eax, eax
je 0x43a3cc
lea eax, [ebp - 0x930]
lea ecx, [ebp - 0x4c]
call fcn.0040fae0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.004407a0
add esp, 8
mov byte [ebp - 4], 7
mov edi, eax
mov esi, 0x5726e4
call fcn.00411aa0
mov byte [ebp - 4], 6
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x4c]
call fcn.004150b0
lea eax, [ebp - 0x84]
push eax
mov eax, str.Program_Files
call fcn.0040fb40
push 0x572700
mov eax, str.C:Program_Files
call fcn.0040fb40
push 0x400
lea ecx, [ebp - 0x930]
push ecx
push str._PROGRAMFILES_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43a417
push 0x572700
lea eax, [ebp - 0x930]
call fcn.0040fb40
push 0
push 0x572700
mov edx, str.__x96_
call fcn.0040fba0
cmp eax, 0xffffffff
je 0x43a4a4
mov eax, 0x528928
lea ecx, [ebp - 0xa4]
call fcn.0040fae0
mov byte [ebp - 4], 8
mov eax, str.__x96_
lea ecx, [ebp - 0x4c]
call fcn.0040fae0
mov byte [ebp - 4], 9
lea edx, [ebp - 0xa4]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0x572700
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004f0670
add esp, 0x10
mov byte [ebp - 4], 0xa
mov edi, eax
mov esi, 0x572700
call fcn.00411aa0
mov byte [ebp - 4], 9
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], 8
lea esi, [ebp - 0x4c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0xa4]
call fcn.004150b0
push 0xffffffffffffffff
lea edx, [ebp - 0x68]
push edx
mov ecx, ebx
mov edx, 0x572700
call fcn.0040fbe0
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x2c]
push eax
mov edx, 0x52cbb4
call fcn.00413910
add esp, 8
mov byte [ebp - 4], 0xc
mov edi, eax
mov esi, 0x57271c
call fcn.00411aa0
mov byte [ebp - 4], 0xb
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x68]
call fcn.004150b0
push 0xffffffffffffffff
lea ecx, [ebp - 0x68]
push ecx
mov ecx, ebx
mov edx, 0x572700
call fcn.0040fbe0
mov byte [ebp - 4], 0xd
push eax
lea edx, [ebp - 0x2c]
push edx
mov edx, 0x533a70
call fcn.00413910
add esp, 8
mov byte [ebp - 4], 0xe
mov edi, eax
mov esi, 0x572738
call fcn.00411aa0
mov byte [ebp - 4], 0xd
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x68]
call fcn.004150b0
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
mov ecx, ebx
mov edx, 0x572700
call fcn.0040fbe0
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, 0x533a74
call fcn.00413910
add esp, 8
mov byte [ebp - 4], 0x10
mov edi, eax
mov esi, 0x572754
call fcn.00411aa0
mov byte [ebp - 4], 0xf
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x68]
call fcn.004150b0
lea edx, [ebp - 0x84]
push edx
mov eax, 0x533a78
call fcn.0040fb40
push 0x572770
mov eax, 0x528928
call fcn.0040fb40
push 0x57278c
mov eax, 0x528928
call fcn.0040fb40
push 0x5727a8
mov eax, 0x528928
call fcn.0040fb40
push 0x5727c4
mov eax, 0x528928
call fcn.0040fb40
cmp byte [0x1579730], 0
je 0x43a745
push 0x572770
mov eax, str.C:Program_Files__x86_
call fcn.0040fb40
push 0x400
lea eax, [ebp - 0x930]
push eax
push str._PROGRAMFILES_x86__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43a627
push 0x572770
lea eax, [ebp - 0x930]
call fcn.0040fb40
jmp 0x43a658
push str.__x96_
push 0x572700
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00413af0
add esp, 0xc
mov byte [ebp - 4], 0x11
mov edi, eax
mov esi, 0x572770
call fcn.00411aa0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x2c]
call fcn.004150b0
push 0xffffffffffffffff
lea edx, [ebp - 0x68]
push edx
mov ecx, ebx
mov edx, 0x572770
call fcn.0040fbe0
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x2c]
push eax
mov edx, 0x52cbb4
call fcn.00413910
add esp, 8
mov byte [ebp - 4], 0x13
mov edi, eax
mov esi, 0x57278c
call fcn.00411aa0
mov byte [ebp - 4], 0x12
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x68]
call fcn.004150b0
push 0xffffffffffffffff
lea ecx, [ebp - 0x68]
push ecx
mov ecx, ebx
mov edx, 0x572770
call fcn.0040fbe0
mov byte [ebp - 4], 0x14
push eax
lea edx, [ebp - 0x2c]
push edx
mov edx, 0x533a70
call fcn.00413910
add esp, 8
mov byte [ebp - 4], 0x15
mov edi, eax
mov esi, 0x5727a8
call fcn.00411aa0
mov byte [ebp - 4], 0x14
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x68]
call fcn.004150b0
push 0xffffffffffffffff
lea eax, [ebp - 0x68]
push eax
mov ecx, ebx
mov edx, 0x572770
call fcn.0040fbe0
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, 0x533a74
call fcn.00413910
add esp, 8
mov byte [ebp - 4], 0x17
mov edi, eax
mov esi, 0x5727c4
call fcn.00411aa0
mov byte [ebp - 4], 0x16
lea esi, [ebp - 0x2c]
call fcn.004150b0
mov byte [ebp - 4], bl
lea esi, [ebp - 0x68]
call fcn.004150b0
mov byte [0x56feff], 0
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x84]
call fcn.004150b0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret