Function at 0x405120
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push edi
push str.1B4E6440_0EC8_11d8_B0FE_00C026A19B93
xor ebx, ebx
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ebx
call fcn.00409600
add esp, 8
test eax, eax
jne 0x40514d
pop edi
pop ebx
add esp, 0x10
ret
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x274]
cmp eax, ebx
je 0x40521c
test al, 1
je 0x40516f
mov dword [esp + 8], 1
mov edi, dword [esp + 8]
test al, 2
je 0x405178
inc edi
mov dword [esp + 8], edi
test al, 4
je 0x405181
inc edi
mov dword [esp + 8], edi
test al, 8
je 0x40518a
inc edi
mov dword [esp + 8], edi
test al, 0x40
je 0x405193
inc edi
mov dword [esp + 8], edi
test al, 0x20
je 0x40519e
add edi, 2
mov dword [esp + 8], edi
test al, al
jns 0x4051a7
inc edi
mov dword [esp + 8], edi
test eax, 0x100
je 0x4051b3
inc edi
mov dword [esp + 8], edi
test eax, 0x200
je 0x4051bf
inc edi
mov dword [esp + 8], edi
test eax, 0x400
je 0x4051cb
inc edi
mov dword [esp + 8], edi
test eax, 0x800
je 0x4051d7
inc edi
mov dword [esp + 8], edi
test eax, 0x1000
je 0x4051e3
inc edi
mov dword [esp + 8], edi
test eax, 0x2000
je 0x4051ef
inc edi
mov dword [esp + 8], edi
test eax, 0x4000
je 0x4051fb
inc edi
mov dword [esp + 8], edi
test eax, 0x8000
je 0x405207
inc edi
mov dword [esp + 8], edi
test eax, 0x10000
je 0x405213
inc edi
mov dword [esp + 8], edi
mov eax, edi
shl eax, 5
mov dword [esp + 0x10], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov dword [esp + 0x14], ebx
cmp byte [ecx + 0x278], bl
je 0x4052dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x4818
push ebx
mov byte [ecx + 0x278], bl
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x4052dd
mov ebx, eax
lea ecx, [ebx + 0x4018]
mov dword [ebx], 0x4000
mov eax, dword [0x425c18]
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x24]
push ebx
push ecx
push eax
call edx
cmp eax, 1
je 0x405293
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4052dd
add edi, dword [ebx + 4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], edi
xor edi, edi
mov byte [eax + 0x278], 1
lea esi, [ebx + 0xc]
cmp dword [ebx + 4], edi
jbe 0x4052d9
nop
cmp byte [esi], 0
je 0x4052d9
mov ecx, dword [esp + 0x1c]
push 0x7d0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add dword [esp + 0x18], eax
push esi
call ebp
inc edi
mov edx, ebx
lea esi, [esi + eax + 1]
cmp edi, dword [edx + 4]
jb 0x4052b0
mov edi, dword [esp + 0x10]
test edi, edi
je 0x405304
mov ecx, dword [esp + 0x18]
lea eax, [edi + edi*4]
lea esi, [ecx + eax*2]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x425c00], eax
test eax, eax
jne 0x40530e
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0x10
ret
push esi
push 0xff
push eax
call fcn.0040a320
mov esi, dword [0x425c00]
mov edx, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi*4]
mov dword [0x425c08], esi
add esi, eax
mov dword [0x425c0c], esi
add esp, 0xc
add esi, eax
xor edi, edi
test byte [edx + 0x274], 2
je 0x405376
push str..DRIVESREMOVABLE
push esi
call ebx
mov eax, dword [0x425c08]
push esi
mov dword [eax], esi
call ebp
mov ecx, dword [0x425c0c]
lea esi, [esi + eax + 1]
mov dword [ecx], 1
mov edi, 1
mov edx, dword [esp + 0x28]
test byte [edx + 0x274], 1
je 0x4053a8
push str..DRIVESFIXED
push esi
call ebx
mov eax, dword [0x425c08]
mov dword [eax + edi*4], esi
mov ecx, dword [0x425c0c]
push esi
mov dword [ecx + edi*4], 1
call ebp
lea esi, [esi + eax + 1]
inc edi
mov edx, dword [esp + 0x28]
test byte [edx + 0x274], 4
je 0x4053da
push str..DRIVESREMOTE
push esi
call ebx
mov eax, dword [0x425c08]
mov dword [eax + edi*4], esi
mov ecx, dword [0x425c0c]
push esi
mov dword [ecx + edi*4], 1
call ebp
lea esi, [esi + eax + 1]
inc edi
mov edx, dword [esp + 0x28]
test byte [edx + 0x274], 8
je 0x405413
push str..SHAREDFOLDERS
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x425c08]
mov dword [eax + edi*4], esi
mov ecx, dword [0x425c0c]
add esp, 8
push esi
mov dword [ecx + edi*4], 1
call ebp
lea esi, [esi + eax + 1]
inc edi
mov edx, dword [esp + 0x28]
test byte [edx + 0x274], 0x20
je 0x405472
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x425c08]
push esi
mov dword [eax + edi*4], esi
call ebp
mov ecx, dword [0x425c0c]
lea esi, [esi + eax + 1]
push 0x104
mov dword [ecx + edi*4], 0
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test byte [ecx + 0x274], 0x80
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
je 0x4054ab
push 0
push 0x23
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x100
je 0x4054e1
push 0
push 0x2e
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x200
je 0x405517
push 0
push 0x17
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x400
je 0x40554d
push 0
push 0x26
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x800
je 0x405583
push 0
push 0x2b
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x1000
je 0x4055bc
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x2000
je 0x4055f5
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 0
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x4000
je 0x40562b
push 0
push 0x1c
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x8000
je 0x405661
push 0
push 0x1a
push esi
push 0
call ebx
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
test dword [ecx + 0x274], 0x10000
je 0x40569a
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x425c08]
push esi
mov dword [edx + edi*4], esi
call ebp
lea esi, [esi + eax + 1]
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
mov ecx, dword [esp + 0x28]
cmp byte [ecx + 0x278], 0
je 0x405718
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
add ebx, 0xc
cmp dword [edx + 4], 0
mov dword [esp + 0x18], 0
jbe 0x405718
cmp byte [ebx], 0
je 0x405718
mov eax, dword [esp + 0x1c]
push 0x7d0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [0x425c08]
mov dword [edx + edi*4], esi
mov eax, dword [0x425c0c]
mov dword [eax + edi*4], 1
inc edi
cmp edi, dword [esp + 0x10]
jge 0x405718
push esi
call ebp
mov ecx, dword [esp + 0x14]
inc eax
add esi, eax
add ebx, eax
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [ecx + 4]
jb 0x4056c0
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
add esp, 0x10
ret