Function at 0x1075143
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x440
mov eax, 0x10b8eb8
call fcn.010aac8f
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1019f14
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x434], edi
call fcn.010ab82f
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
cmp edi, ebx
jne 0x10751f0
mov eax, dword [section..data]
cmp eax, section..data
je 0x10751d5
test byte [eax + 0x1c], 4
je 0x10751d5
push 0x1019d30
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102fe95
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.010ab876
mov eax, esi
call fcn.010aad21
ret 4
lea eax, [ebp - 0x428]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1075239
mov eax, dword [section..data]
cmp eax, section..data
je 0x1075254
test byte [eax + 0x1c], 8
je 0x1075254
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079041
jmp 0x1075254
push edi
lea eax, [ebp - 0x428]
push eax
call fcn.01074fcc
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x1075452
and dword [ebp - 0x430], 0
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringW]
mov dword [ebp - 0x444], 0x1019f04
mov dword [ebp - 0x440], 0x1019ef4
mov dword [ebp - 0x43c], 0x1019ecc
mov dword [ebp - 0x438], 0x1019ea4
xor eax, eax
mov word [ebp - 0x21c], ax
mov eax, dword [ebp - 0x430]
mov esi, dword [ebp + eax*4 - 0x444]
push ebx
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10752e5
mov eax, dword [section..data]
cmp eax, section..data
je 0x107531a
test byte [eax + 0x1c], 8
je 0x107531a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push esi
push 0x1019d30
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01094f12
jmp 0x107531a
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 1
push 0x7f
call edi
cmp eax, 2
je 0x107531a
push dword [ebp - 0x434]
lea eax, [ebp - 0x21c]
push eax
call fcn.01074fcc
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 1
je 0x1075336
inc dword [ebp - 0x430]
cmp dword [ebp - 0x430], 4
jl 0x1075289
xor ebx, ebx
cmp dword [ebp - 0x42c], ebx
jne 0x1075452
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push ebx
push 0x1c
lea eax, [ebp - 0x21c]
push eax
push ebx
call esi
test eax, eax
jne 0x1075395
mov eax, dword [section..data]
cmp eax, section..data
je 0x10753f7
test byte [eax + 0x1c], 8
je 0x10753f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079041
jmp 0x10753f7
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp eax, ebx
je 0x10753be
xor ecx, ecx
mov word [eax], cx
push 0x1019e98
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 1
push 0x7f
call edi
cmp eax, 2
je 0x10753f7
push dword [ebp - 0x434]
lea eax, [ebp - 0x21c]
push eax
call fcn.01074fcc
mov dword [ebp - 0x42c], eax
cmp eax, ebx
jne 0x1075452
push ebx
push 0x20
lea eax, [ebp - 0x428]
push eax
push ebx
call esi
test eax, eax
jne 0x107543a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1075452
test byte [eax + 0x1c], 8
je 0x1075452
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x1019d30
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079041
jmp 0x1075452
push dword [ebp - 0x434]
lea eax, [ebp - 0x428]
push eax
call fcn.01074fcc
mov dword [ebp - 0x42c], eax
mov esi, dword [ebp - 0x42c]
jmp 0x10751d7