Function at 0x40d3f0
Capabilities:
Get common file path
Get disk information
Get process image filename
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc38
mov eax, dword [0x440008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
push 0x436fb0
push ebx
mov dword [ebp - 0xc38], ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40d6c9
lea ecx, [ebp - 0x20c]
mov esi, ebx
mov eax, ecx
mov edx, 0x82
sub esi, eax
lea eax, [edx + 0x7fffff7c]
test eax, eax
je 0x40d453
movzx eax, word [esi + ecx]
test ax, ax
je 0x40d453
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40d435
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x20c]
call fcn.0040d290
mov esi, 0x82
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x40d484
add eax, 2
sub esi, 1
jne 0x40d476
mov ecx, 0x82
test esi, esi
je 0x40d49b
mov eax, ecx
sub eax, esi
add eax, eax
neg esi
sbb esi, esi
and esi, eax
jmp 0x40d49d
xor esi, esi
cmp edi, 0xffffffff
jne 0x40d4d2
test ebx, ebx
je 0x40d4d0
mov edi, ecx
mov eax, ebx
nop word [eax + eax]
cmp word [eax], 0
je 0x40d4be
add eax, 2
sub edi, 1
jne 0x40d4b0
test edi, edi
je 0x40d4d0
mov eax, ecx
sub eax, edi
add eax, eax
neg edi
sbb edi, edi
and edi, eax
jmp 0x40d4d2
xor edi, edi
push 0x104
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x824]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x436fac
lea ecx, [ebp - 0x824]
call fcn.0040ea90
mov ebx, 0x82
lea eax, [ebp - 0x824]
cmp word [eax], 0
je 0x40d522
add eax, 2
sub ebx, 1
jne 0x40d514
test ebx, ebx
je 0x40d537
mov eax, 0x82
sub eax, ebx
add eax, eax
neg ebx
sbb ebx, ebx
and ebx, eax
jmp 0x40d539
xor ebx, ebx
push 0x104
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
lea ecx, [ebp - 0xa2c]
call fcn.0040d290
mov ecx, 0x82
lea eax, [ebp - 0xa2c]
cmp word [eax], 0
je 0x40d576
add eax, 2
sub ecx, 1
jne 0x40d568
push 0x104
lea eax, [ebp - 0xc34]
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40d6b6
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40d6b6
push str.WindowsSystem32_
lea ecx, [ebp - 0x414]
call fcn.0040ea90
mov ecx, 0x82
lea eax, [ebp - 0x414]
cmp word [eax], 0
je 0x40d5df
add eax, 2
sub ecx, 1
jne 0x40d5d1
test ecx, ecx
je 0x40d5f4
mov eax, 0x82
sub eax, ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
jmp 0x40d5f6
xor ecx, ecx
cmp ecx, edi
lea eax, [ebp - 0x414]
cmovb edi, ecx
shr edi, 1
push edi
push dword [ebp - 0xc38]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push eax
call edi
test eax, eax
je 0x40d6c9
push 0x436fac
lea ecx, [ebp - 0x61c]
call fcn.0040ea90
mov ecx, 0x82
lea eax, [ebp - 0x61c]
cmp word [eax], 0
je 0x40d644
add eax, 2
sub ecx, 1
jne 0x40d636
test ecx, ecx
je 0x40d659
mov eax, 0x82
sub eax, ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
jmp 0x40d65b
xor ecx, ecx
cmp ecx, esi
mov eax, esi
cmovb eax, ecx
shr eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call edi
test eax, eax
je 0x40d6c9
call fcn.00411ce0
test eax, eax
je 0x40d69e
cmp ebx, esi
lea eax, [ebp - 0x20c]
cmovb esi, ebx
shr esi, 1
push esi
push eax
lea eax, [ebp - 0x824]
push eax
call edi
test eax, eax
je 0x40d6c9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40d6c9
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041396d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041396d
mov esp, ebp
pop ebp
ret