Function at 0x5d4680
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x602364
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x138
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0x80
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0x62439c
push 0x627e08
mov ecx, edi
call fcn.005d9660
test eax, eax
je 0x5d4719
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4719
mov ecx, edi
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005db920
mov al, byte [eax + 8]
jmp 0x5d4ceb
mov ecx, edi
call fcn.005dc3a0
cmp eax, 0xa
jle 0x5d48a5
push 0
mov ecx, edi
call fcn.005dc120
cmp word [eax], 0x7b
jne 0x5d48a5
mov ecx, edi
call fcn.005dc3a0
dec eax
mov ecx, edi
push eax
call fcn.005dc120
cmp word [eax], 0x7d
jne 0x5d48a5
push 0
push 1
push 1
push 0
push 0x624a00
mov ecx, edi
call fcn.005daa70
mov dword [ebp - 0x148], eax
test eax, eax
jne 0x5d4781
mov ecx, edi
call fcn.005dc3a0
mov dword [ebp - 0x148], eax
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x124]
movq qword [ebp - 0x124], xmm0
call fcn.005dc5e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
movq qword [ebp - 0x130], xmm0
call fcn.005dc5e0
push 0
push 0
push 0x104
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.005db9a0
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x5d4888
mov eax, dword [ebp - 0x148]
mov ecx, edi
add eax, 0xfffffffe
push eax
push 2
call fcn.005dc190
push eax
lea ecx, [ebp - 0x130]
call fcn.005d9d20
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x130]
call fcn.005dc190
push eax
push str.WindowsApps_
lea ecx, [ebp - 0x124]
call fcn.005da780
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4888
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005db920
lea ecx, [ebp - 0x130]
mov al, byte [eax + 8]
mov byte [ebp - 0x141], al
call fcn.005dc430
jmp 0x5d4cda
lea ecx, [ebp - 0x130]
call fcn.005dc430
lea ecx, [ebp - 0x124]
mov dword [ebp - 4], 0xffffffff
call fcn.005dc430
push 0x7e8
push 0
push 0
push 0x7e8
mov ecx, esi
call fcn.005db9a0
push eax
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d48e2
mov al, 1
jmp 0x5d4ceb
push 8
push 1
push 1
push 0
push str.msiexec
mov ecx, esi
call fcn.005daa70
mov ecx, esi
cmp eax, 1
jne 0x5d492a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MsiExec.exe
lea eax, [ebp - 0x118]
push eax
call fcn.005dc200
mov al, byte [eax + 8]
jmp 0x5d4ceb
push 8
push 1
push 1
push 0
push str.rundll32
call fcn.005daa70
cmp eax, 1
jne 0x5d499a
mov ecx, esi
call fcn.005dc3a0
cmp eax, 0xd
mov ecx, esi
lea eax, [ebp - 0x118]
jge 0x5d497c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627e5c
push eax
call fcn.005dc200
mov al, byte [eax + 8]
jmp 0x5d4ceb
sub esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
push eax
call fcn.005da510
jmp 0x5d49c3
push 0
push 0
push 0
push str.__runtime.system32__
mov ecx, edi
call fcn.005da270
cmp byte [eax + 8], 0
je 0x5d49c3
push 1
mov ecx, edi
call fcn.005e8620
test al, al
jne 0x5d4702
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
lea ecx, [ebp - 0x124]
movq qword [ebp - 0x124], xmm0
call fcn.005dc5e0
push ecx
push 8
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 2
push eax
push str.._._exe_dll_cpl_ocx_exe_ico_ax_mui_dllcplocxexecmd_bat__.
mov ecx, esi
call fcn.005d9870
test al, al
je 0x5d4a34
push 1
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc260
push 2
mov ecx, esi
call fcn.005dadc0
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5d4a7e
push ecx
push 8
lea eax, [ebp - 0x124]
mov ecx, esi
push eax
push str..___.
call fcn.005d9870
test al, al
je 0x5d4a8a
push 1
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc260
push 3
mov ecx, esi
call fcn.005dadc0
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4a8a
mov byte [ebp - 0x141], 1
jmp 0x5d4cda
push 0
mov ecx, esi
call fcn.005dc190
push eax
push 0x104
lea ecx, [ebp - 0x124]
call fcn.005db9a0
push 0
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
test eax, eax
jne 0x5d4b0f
push eax
push 1
push 1
push 1
push 0x624288
mov ecx, esi
call fcn.005daa70
test eax, eax
jne 0x5d4b9d
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x6243cc
mov ecx, esi
call fcn.005dc190
push eax
lea ecx, [ebp - 0x124]
call fcn.005dc200
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4b30
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005db920
mov al, byte [eax + 8]
mov byte [ebp - 0x141], al
jmp 0x5d4cda
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
lea ecx, [ebp - 0x130]
movq qword [ebp - 0x130], xmm0
call fcn.005dc5e0
push 0
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 3
call fcn.005dc190
push eax
push 0x104
lea ecx, [ebp - 0x130]
call fcn.005db9a0
push 0
lea ecx, [ebp - 0x130]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
lea ecx, [ebp - 0x130]
test eax, eax
jne 0x5d4862
mov byte [ebp - 4], 2
call fcn.005dc430
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x124]
call fcn.005dc200
xorps xmm0, xmm0
lea ecx, [ebp - 0x140]
movups xmmword [ebp - 0x140], xmm0
call fcn.005d6b10
lea eax, [ebp - 0x140]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x124]
call fcn.005dc190
mov edx, 0x62439c
mov ecx, eax
call fcn.005d50f0
mov eax, dword [ebp - 0x138]
cmp eax, 2
jne 0x5d4c6a
cmp dword [ebp - 0x13c], 7
jbe 0x5d4ca0
push 0
push 0
push 0x800
lea ecx, [ebp - 0x124]
call fcn.005db9a0
push 0x800
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4ca0
lea ecx, [ebp - 0x124]
jmp 0x5d4e95
cmp eax, 1
jne 0x5d4ca0
cmp dword [ebp - 0x13c], 7
jbe 0x5d4ca0
push dword [ebp - 0x140]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4ca0
push dword [ebp - 0x140]
mov ecx, esi
call fcn.005db920
mov al, byte [eax + 8]
mov byte [ebp - 0x141], al
jmp 0x5d4ccf
mov dl, 1
mov ecx, edi
call fcn.005e7cd0
test al, al
jne 0x5d4e93
mov ecx, esi
call fcn.005dc3a0
mov ecx, esi
test eax, eax
jne 0x5d4d0b
push str._Empty_
call fcn.005db920
mov byte [ebp - 0x141], 0
lea ecx, [ebp - 0x140]
call fcn.005d6b00
lea ecx, [ebp - 0x124]
call fcn.005dc430
mov al, byte [ebp - 0x141]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 1
call fcn.005dc190
push eax
mov ecx, edi
call fcn.005dc260
cmp byte [ebx + 8], 0
je 0x5d4e6f
push 0
push 1
push str.:Program_files__x86__
push str.:Program_files_
mov ecx, esi
call fcn.005da270
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5d4d71
push eax
push 1
push str.WindowsSysWOW64_
push str.WindowsSystem32_
mov ecx, esi
call fcn.005da270
mov ecx, esi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4d7d
mov byte [ebp - 0x141], 1
jmp 0x5d4ccf
lea ecx, [ebp - 0x124]
call fcn.005dc400
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005dc190
push eax
push str.HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x124]
call fcn.005da780
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x124]
call fcn.005dc190
mov edx, 0x62439c
mov ecx, eax
call fcn.005d50f0
test al, al
mov eax, dword [ebp - 0x138]
je 0x5d4e30
cmp eax, 2
jne 0x5d4e30
push 0
push 0
push 0x800
lea ecx, [ebp - 0x124]
call fcn.005db9a0
push 0x800
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x124]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4e60
lea ecx, [ebp - 0x124]
jmp 0x5d4e95
cmp eax, 1
jne 0x5d4e60
push dword [ebp - 0x140]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4e60
push dword [ebp - 0x140]
mov ecx, esi
call fcn.005db920
mov al, byte [eax + 8]
mov byte [ebp - 0x141], al
jmp 0x5d4ccf
mov ecx, edi
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005dc510
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov ecx, edi
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5d4cc8
mov ecx, edi
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005db920
mov al, byte [eax + 8]
mov byte [ebp - 0x141], al
jmp 0x5d4ccf