Function at 0x43ef70
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, 0x50d4
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x50d0], eax
cmp byte [0x54ba54], 0
push ebx
push esi
mov esi, dword [esp + 0x50e0]
mov ebx, ecx
jne 0x43efcc
cmp word [esi], 0x2e
jne 0x43efcc
movzx eax, word [esi + 2]
push eax
call fcn.0047d2d0
test al, al
je 0x43efbb
add esi, 4
cmp word [esi], 0x2e
je 0x43efa2
jmp 0x43efcc
cmp word [esi], 0x2e
jne 0x43efcc
cmp word [esi + 2], 0
je 0x43f44b
push 0x800
lea eax, [esp + 0x3014]
push eax
push esi
call fcn.0047cc90
mov ecx, 0x517828
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43f00c
test dx, dx
je 0x43f008
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43f00c
add eax, 4
add ecx, 4
test dx, dx
jne 0x43efe6
xor eax, eax
jmp 0x43f011
sbb eax, eax
or eax, 1
push edi
test eax, eax
push esi
sete byte [esp + 0x13]
call fcn.0047d800
mov edi, eax
movzx ecx, word [edi]
push ecx
call fcn.0047d2d0
test al, al
je 0x43f074
cmp byte [esp + 0xf], 0
jne 0x43f074
lea ecx, [esp + 0x3014]
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43f066
test dx, dx
je 0x43f062
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43f066
add eax, 4
add ecx, 4
test dx, dx
jne 0x43f040
xor eax, eax
jmp 0x43f06b
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f074
xor eax, eax
mov word [edi], ax
push ebp
xor ebp, ebp
mov edi, esi
cmp word [esi], bp
je 0x43f0b8
mov edi, edi
cmp word [edi], 0x2e
jne 0x43f0b8
cmp word [edi + 2], 0x2e
jne 0x43f0b8
movzx eax, word [edi + 4]
push eax
call fcn.0047d2d0
test al, al
jne 0x43f0a2
cmp word [edi + 4], 0
jne 0x43f0b8
xor eax, eax
cmp word [edi + 4], ax
setne al
inc ebp
lea edi, [edi + eax*2]
add edi, 4
cmp word [edi], 0
jne 0x43f080
cmp byte [0x54ba54], 0
je 0x43f0dc
cmp byte [esp + 0x50ec], 0
je 0x43f0dc
push esi
call fcn.0047d1a0
test al, al
je 0x43f0dc
mov ecx, ebx
call fcn.0043f4c0
cmp byte [ebx + 0x1046], 0
je 0x43f111
mov ecx, dword [ebx + 0x2148]
mov eax, ebp
cmp ebp, ecx
jl 0x43f0f3
mov eax, ecx
cmp byte [esp + 0x13], 0
je 0x43f0fc
mov eax, ecx
test eax, eax
je 0x43f111
push 0
push eax
mov ecx, ebx
call fcn.004405d0
push 0
jmp 0x43f442
mov byte [ebx + 0x1046], 0
cmp byte [0x54ba54], 0
je 0x43f20a
push 0
push 0x51885c
push str.FileList
call fcn.004a5d50
test eax, eax
je 0x43f142
test ebp, ebp
je 0x43f449
push 0x800
lea eax, [esp + 0x201c]
mov ecx, 0x56e128
push eax
call fcn.00405420
mov ecx, 0x517828
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43f186
test dx, dx
je 0x43f182
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43f186
add eax, 4
add ecx, 4
test dx, dx
jne 0x43f160
xor eax, eax
jmp 0x43f18b
sbb eax, eax
or eax, 1
test eax, eax
je 0x43f1bc
push esi
mov ecx, 0x56e128
call fcn.00406d00
test al, al
je 0x43f1bc
xor eax, eax
lea ecx, [esp + 0x2018]
test ebp, ebp
setle al
dec eax
and eax, ecx
mov ecx, ebx
push eax
call fcn.00443a00
jmp 0x43f449
push 0x800
lea eax, [esp + 0x1c]
mov ecx, 0x56e128
push eax
call fcn.00405080
push 0x800
lea eax, [esp + 0x1c]
push eax
lea esi, [ebx + 0x1048]
push esi
call fcn.004947d0
push esi
call fcn.0047d890
mov ecx, ebx
call fcn.0043f4c0
test al, al
je 0x43f449
lea eax, [esp + 0x18]
push eax
call fcn.0047d830
jmp 0x43f441
push 0x800
lea edi, [ebx + 0x1048]
push edi
lea eax, [esp + 0x2020]
push eax
call fcn.004947d0
xor eax, eax
mov word [esp + 0x18], ax
test ebp, ebp
jle 0x43f2f5
cmp byte [ebx + 0x1046], 0
jne 0x43f2f5
push edi
call fcn.0047d170
test al, al
je 0x43f2b1
movzx eax, word [ebx + 0x104c]
push eax
call fcn.0047d2d0
test al, al
je 0x43f2b1
cmp word [ebx + 0x104e], 0
jne 0x43f2b1
cmp dword [ebx + 0x2148], 0
jle 0x43f276
mov byte [ebx + 0x1046], 1
jmp 0x43f2cd
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
push 0
push 0x11
push dword [ebx + 0x30]
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
push dword [esp + 0x14]
mov ecx, 0x570db0
call fcn.00445c60
mov eax, dword [0x5ac874]
push dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x43f2cd
push 0x800
push edi
call fcn.0047d830
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004947d0
push edi
call fcn.0047d890
dec ebp
cmp word [esi], 0x2e
jne 0x43f2dd
add esi, 2
cmp word [esi], 0x2e
je 0x43f2d4
movzx eax, word [esi]
push eax
call fcn.0047d2d0
test al, al
je 0x43f2ed
add esi, 2
test ebp, ebp
jg 0x43f232
cmp byte [esp + 0x13], 0
je 0x43f324
push 0x800
lea eax, [esp + 0x101c]
push eax
push edi
call fcn.0047cc90
push 0x800
lea eax, [esp + 0x101c]
push eax
push edi
call fcn.004947d0
jmp 0x43f359
push esi
call fcn.0047d1a0
test al, al
je 0x43f33c
push 0x800
push esi
push edi
call fcn.004947d0
jmp 0x43f359
cmp word [esi], 0
je 0x43f359
push 0x800
push edi
call fcn.0047bc90
push 0x800
push esi
push edi
call fcn.00494790
push edi
call fcn.0047cc50
mov ebp, eax
cmp ebp, 0xffffffff
je 0x43f390
call fcn.004cc020
mov edx, 1
mov ecx, ebp
shl edx, cl
test edx, eax
jne 0x43f390
push 0x800
lea eax, [esp + 0x201c]
push eax
push edi
call fcn.004947d0
jmp 0x43f449
cmp byte [ebx + 0x1046], 0
jne 0x43f432
push edi
call fcn.0046cad0
test al, al
jne 0x43f432
push 0x800
lea eax, [esp + 0x101c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43f3e4
cmp eax, 0x800
jae 0x43f3e4
lea eax, [esp + 0x1018]
push eax
call fcn.0046cad0
test al, al
je 0x43f3e4
lea eax, [esp + 0x1018]
jmp 0x43f426
push edi
push 0x6c
call fcn.0048e4c0
push eax
lea eax, [esp + 0x4020]
push 0x864
push eax
call fcn.00402720
add esp, 0x10
push 0x10
push 0x66
call fcn.0048e4c0
push eax
lea eax, [esp + 0x4020]
push eax
push dword [0x54b9c8]
call fcn.004cd560
lea eax, [esp + 0x2018]
push 0x800
push eax
push edi
call fcn.004947d0
movzx eax, word [esp + 0x18]
lea ecx, [esp + 0x18]
neg eax
sbb eax, eax
and eax, ecx
push eax
mov ecx, ebx
call fcn.004444e0
pop ebp
pop edi
mov ecx, dword [esp + 0x50d8]
pop esi
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x50d4
ret 8