Function at 0x1005df10
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x1005e1cd
cmp word [0x100a30a8], 0
push esi
push edi
jne 0x1005e0e2
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x208
push 0x100a30a8
push str.SystemRoot
call edi
mov ecx, 0x100a30a8
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005df50
mov esi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100a30a6], 0x5c
je 0x1005df84
push 0x1007d9c8
push 0x208
push 0x100a30a8
call esi
add esp, 0xc
push 0x208
push 0x100a34b8
push str.ProgramFiles
call edi
mov ecx, 0x100a34b8
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005dfa0
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100a34b6], 0x5c
je 0x1005dfce
push 0x1007d9c8
push 0x208
push 0x100a34b8
call esi
add esp, 0xc
push 0x208
push 0x100a38c8
push str.windir
call edi
mov ecx, 0x100a38c8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005dfe7
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100a38c6], 0x5c
je 0x1005e015
push 0x1007d9c8
push 0x208
push 0x100a38c8
call esi
add esp, 0xc
mov edi, dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x100a30a8
push 0x208
push 0x100a3cd8
call edi
push 0x100a30a8
push 0x208
push 0x100a40e8
call edi
push 0x100a30a8
push 0x208
push 0x100a44f8
call edi
add esp, 0x24
push 0x208
push 0x100a4908
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x100a4908
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e070
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100a4906], 0x5c
je 0x1005e09e
push 0x1007d9c8
push 0x208
push 0x100a4908
call esi
add esp, 0xc
push 0x100a4908
push 0x208
push 0x100a4d18
call edi
mov ecx, 0x100a4d18
add esp, 0xc
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e0c0
sub ecx, edx
sar ecx, 1
xor eax, eax
mov dword [ecx*2 + 0x100a4d12], 0x5c
mov word [0x100a5128], ax
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll__wcsnicmp]
xor esi, esi
jmp 0x1005e0f0
mov edx, dword [esi*4 + 0x100a18d8]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005e100
sub eax, edi
mov edi, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x1005e130
inc esi
cmp esi, 9
jb 0x1005e0f0
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi*4 + 0x100a18d8]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e140
sub ecx, edx
sar ecx, 1
imul esi, esi, 0x410
lea ebx, [esi + 0x100a30a8]
mov edx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1005e160
sub edx, esi
mov esi, edi
sar edx, 1
lea eax, [esi + 2]
mov dword [ebp - 4], eax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005e177
sub esi, dword [ebp - 4]
sar esi, 1
sub esi, ecx
lea eax, [esi*2 + 2]
mov esi, dword [sym.imp.MSVCR110.dll_memmove]
push eax
lea eax, [edi + ecx*2]
push eax
lea eax, [edi + edx*2]
push eax
call esi
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e1b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push edi
call esi
add esp, 0xc
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret