Function at 0x10014f86
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x1004899b
call fcn.100464e0
sub esp, 0x21c
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push 1
lea eax, [ebp + 0xc]
pop ebx
lea ecx, [ebp - 0x20]
push eax
mov dword [ebp - 4], ebx
call fcn.100460c4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString_1
and word [ebp - 0x228], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x226]
rep stosd dword es:[edi], eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
stosw word es:[edi], ax
call sub.MFC42u.DLL_CString::MakeUpper
mov esi, str._APPDATA_ALL_USER_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x10015017
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push 0x104
push eax
push str._ALLUSERSPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x100151f2
mov esi, str._APPDATA_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jge 0x1001503b
mov esi, str._TEMP_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x10015053
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push 0x104
push eax
push esi
jmp 0x1001500c
mov esi, str._SYSTEM_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x10015085
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x100151f2
mov esi, str._WINDOWS_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x100150b7
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x100151f2
mov esi, str._QQ_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x100150f7
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push 0x104
push eax
call fcn.10015263
pop ecx
pop ecx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x100151f2
mov esi, str._CUR_MODULE_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x10015191
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
push str.Kernel32.dll
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString_2
lea eax, [ebp - 0x18]
push ebx
push eax
mov byte [ebp - 4], 4
call fcn.10001217
pop ecx
mov esi, eax
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
call sub.MFC42u.DLL_CString::CString
push str.GetModuleHandleExW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [ebp - 0x14], 0
test eax, eax
je 0x10015162
lea ecx, [ebp - 0x14]
push ecx
push fcn.10014f86
push 6
call eax
lea eax, [ebp - 0x228]
push 0x104
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test esi, esi
jne 0x100151f2
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100151f2
mov esi, str._CUR_EXE_MODULE_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x100151c5
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x100150e5
mov esi, str._CUR_DIR_
lea ecx, [ebp + 0xc]
push esi
call sub.MFC42u.DLL_CString::Find
test eax, eax
jl 0x100151f2
push esi
lea ecx, [ebp - 0x10]
call sub.MFC42u.DLL_CString::operator
lea eax, [ebp - 0x228]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x1001521f
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
test eax, eax
pop ecx
jbe 0x1001521f
lea eax, [ebp - 0x228]
lea ecx, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call sub.MFC42u.DLL_CString::Replace
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.100460c4
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call sub.MFC42u.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret