Function at 0x40cbf0
Capabilities:
Get common file path
Get program files directory
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x448b3c
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0x370], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0x38c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x39c]
mov dword [esp + 0x18], ecx
xor edx, edx
mov ecx, 7
mov dword [esp + 0x24], eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], edx
mov word [esp + 0x48], dx
mov dword [esp + 0x394], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x74], edx
mov word [esp + 0x64], dx
lea ebx, [eax + 0xc]
mov byte [esp + 0x394], 1
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov esi, eax
test ebx, ebx
mov edi, dword [ebx + 4]
je 0x40cc7f
cmp ebx, ebx
je 0x40cc84
call fcn.004228be
cmp esi, edi
je 0x40cd99
test ebx, ebx
jne 0x40cc95
call fcn.004228be
cmp esi, dword [ebx + 4]
jne 0x40cc9f
call fcn.004228be
mov eax, dword [esi + 0x20]
lea ebp, [esi + 0xc]
push 0x44d410
mov edi, 0xa
mov ecx, ebp
call fcn.00403c20
test eax, eax
jne 0x40ccda
mov edx, 0x44d40c
call fcn.004015c0
test eax, eax
je 0x40ccda
mov ecx, 0x44d40c
call fcn.00401690
push eax
push str._installDir_
jmp 0x40cd2d
cmp esi, dword [ebx + 4]
jne 0x40cce4
call fcn.004228be
mov edi, 8
cmp dword [ebp + 0x18], edi
jb 0x40ccf3
mov ebp, dword [ebp + 4]
jmp 0x40ccf6
add ebp, 4
push ebp
lea eax, [esp + 0x288]
push str.___s__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp esi, dword [ebx + 4]
jne 0x40cd17
call fcn.004228be
cmp dword [esi + 0x40], edi
jb 0x40cd21
mov eax, dword [esi + 0x2c]
jmp 0x40cd24
lea eax, [esi + 0x2c]
push eax
lea ecx, [esp + 0x288]
push ecx
mov edx, dword [esp + 0x20]
push edx
call fcn.00420f70
add esp, 0xc
cmp byte [esi + 0x45], 0
je 0x40cd4a
call fcn.004228be
jmp 0x40cc74
mov eax, dword [esi + 8]
cmp byte [eax + 0x45], 0
jne 0x40cd70
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
jne 0x40cc74
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
je 0x40cd61
jmp 0x40cc74
mov eax, dword [esi + 4]
cmp byte [eax + 0x45], 0
jne 0x40cc72
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x40cc72
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x45], 0
je 0x40cd80
jmp 0x40cc72
mov edx, dword [esp + 0x18]
push 0x44e7a4
mov ebx, 1
xor eax, eax
call fcn.00412330
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40d28d
lea esp, [esp]
mov esi, dword [esp + 0x18]
lea eax, [ebp + 1]
push 0x44e7a4
mov ebx, 1
mov edx, esi
call fcn.00412330
sub eax, ebp
lea edi, [eax + 1]
push edi
push esi
mov ecx, ebp
lea esi, [esp + 0x30]
mov dword [esp + 0x24], edi
call fcn.00410c00
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x39c], 2
call fcn.00403460
mov byte [esp + 0x394], bl
cmp dword [esp + 0x40], 8
jb 0x40ce1e
mov eax, dword [esp + 0x2c]
push eax
call fcn.00422b32
add esp, 4
push 0x44e7a8
xor eax, eax
lea edx, [esp + 0x48]
call fcn.00412330
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x40ceaa
mov esi, eax
add esi, ebx
push 0x44e7ac
mov eax, esi
lea edx, [esp + 0x48]
call fcn.00412330
mov edi, eax
sub edi, dword [esp + 0x20]
lea edx, [esp + 0x44]
lea ecx, [edi - 1]
push ecx
mov ecx, esi
push edx
lea esi, [esp + 0x30]
call fcn.00410c00
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x68]
mov byte [esp + 0x39c], 3
call fcn.00403460
mov byte [esp + 0x394], 1
cmp dword [esp + 0x40], 8
jb 0x40ce96
mov eax, dword [esp + 0x2c]
push eax
call fcn.00422b32
add esp, 4
mov ebx, dword [esp + 0x20]
lea eax, [edi + 1]
lea esi, [esp + 0x44]
call fcn.00403630
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x44]
call fcn.00421250
mov eax, dword [esp + 0x58]
cmp eax, 7
mov esi, eax
jb 0x40cec3
mov esi, 7
cmp dword [esp + 0x5c], 8
mov edx, dword [esp + 0x48]
jae 0x40ced2
lea edx, [esp + 0x48]
test esi, esi
mov ecx, 0x44e7b0
jbe 0x40cf05
jmp 0x40cee0
mov bx, word [edx]
cmp bx, word [ecx]
jne 0x40cef5
add edx, 2
add ecx, 2
sub esi, 1
jne 0x40cee0
jmp 0x40cf05
mov dx, bx
cmp dx, word [ecx]
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 1
jne 0x40cf12
cmp eax, 7
jb 0x40cf56
xor ecx, ecx
cmp eax, 7
setne cl
test ecx, ecx
jne 0x40cf56
push 0x104
push 0x45a020
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x45a020
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cf30
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
push 0x45a020
push edi
mov esi, ebp
call fcn.00412130
jmp 0x40d26d
mov ebx, 8
push str._source_
mov edi, ebx
lea ecx, [esp + 0x48]
call fcn.00403c20
test eax, eax
jne 0x40cfa6
mov edx, dword [esp + 0x24]
add edx, 0x3c
mov eax, edx
lea esi, [eax + 2]
jmp 0x40cf80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cf80
mov ebx, dword [esp + 0x18]
sub eax, esi
sar eax, 1
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
mov esi, ebp
call fcn.00412130
jmp 0x40d26d
mov eax, dword [esp + 0x58]
push str._system_
lea ecx, [esp + 0x48]
call fcn.00403c20
test eax, eax
jne 0x40d000
push 0x104
lea ecx, [esp + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x40cfe6
push 0x104
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cff0
jmp 0x40d0cb
mov eax, dword [esp + 0x58]
push str._windir_
lea ecx, [esp + 0x48]
call fcn.00403c20
test eax, eax
jne 0x40d040
push 0x104
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d030
jmp 0x40d0cb
mov eax, dword [esp + 0x58]
push str._root_
mov edi, 6
lea ecx, [esp + 0x48]
call fcn.00403c20
test eax, eax
jne 0x40d08d
push 0x104
lea edx, [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0x7c]
mov word [esp + 0x82], 0
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d080
jmp 0x40d0cb
mov eax, dword [esp + 0x58]
push str._progfilesdir_
mov edi, 0xe
lea ecx, [esp + 0x48]
call fcn.00403c20
test eax, eax
jne 0x40d0ed
lea edx, [esp + 0x7c]
push edx
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x7c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d0c0
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x80]
push eax
push ecx
mov esi, ebp
call fcn.00412130
jmp 0x40d26d
mov eax, dword [esp + 0x58]
push str._progfilesdir64_
mov edi, 0x10
lea ecx, [esp + 0x48]
call fcn.00403c20
test eax, eax
jne 0x40d125
push 0x104
lea edx, [esp + 0x80]
push edx
push str.ProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x40d1cc
mov esi, str._startmenu_
lea ecx, [esp + 0x44]
call fcn.00415d80
test al, al
je 0x40d166
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
lea edx, [esp + 0x88]
call fcn.00410bd0
jmp 0x40d26d
mov esi, str._commonappsdir_
lea ecx, [esp + 0x44]
call fcn.00415d80
test al, al
je 0x40d1a7
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
lea edx, [esp + 0x88]
call fcn.00410bd0
jmp 0x40d26d
mov esi, str._commondesktop_
lea ecx, [esp + 0x44]
call fcn.00415d80
test al, al
je 0x40d1e8
lea edx, [esp + 0x7c]
push edx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ebp
lea edx, [esp + 0x84]
push ecx
call fcn.00410bd0
jmp 0x40d26d
mov esi, str._getswitch_
lea ecx, [esp + 0x44]
call fcn.00415d80
test al, al
je 0x40d238
cmp dword [esp + 0x78], ebx
mov edx, dword [esp + 0x64]
jae 0x40d208
lea edx, [esp + 0x64]
call fcn.004015c0
test eax, eax
je 0x40d25e
cmp dword [esp + 0x78], ebx
mov ecx, dword [esp + 0x64]
jae 0x40d21f
lea ecx, [esp + 0x64]
call fcn.00401690
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov edx, eax
push ecx
call fcn.00410bd0
jmp 0x40d26d
cmp dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x48]
jae 0x40d246
lea eax, [esp + 0x48]
push eax
push str.Unknown_variable___s___ignoring
push 0x4575e0
mov eax, 1
call fcn.00419140
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, ebp
call fcn.00403630
mov edx, dword [esp + 0x18]
push 0x44e7a4
mov ebx, 1
xor eax, eax
call fcn.00412330
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40cdc0
mov esi, 8
cmp dword [esp + 0x78], esi
jb 0x40d2a5
mov edx, dword [esp + 0x64]
push edx
call fcn.00422b32
add esp, 4
xor eax, eax
cmp dword [esp + 0x5c], esi
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], eax
mov word [esp + 0x64], ax
jb 0x40d2cb
mov eax, dword [esp + 0x48]
push eax
call fcn.00422b32
add esp, 4
mov ecx, dword [esp + 0x38c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x370]
xor ecx, esp
call fcn.00422b23
add esp, 0x384
ret 4