As an alternative to the environment variable, there's a Win32 API call you can use: GetWindowsDirectory, and there's also its sibling GetSystemDirectory. You can call these by using the Win32::API module.

# Old Skool calls
use Win32::API;
my $getwindir = new Win32::API(kernel32 => GetWindowsDirectoryA => [qw
+(P N)], "N")
  or die "Can't locate function: $!";
# ... or use 'PN' for the 3rd parameter, if Win32::API is recent enoug
+h (version?)
my $buffer = "\0" x 300;
my $length = $getwindir->Call($buffer, length $buffer);
print substr $buffer, 0, $length;
[download]

The following crashes for me, if I don't delete $func->{proto}... Surely that must be a bug? Otherwise, I must be misunderstanding something really badly...

# New Skool calls ($Win32::API::VERSION >= 0.40)
use Win32::API;
my $getwindir = new Win32::API(kernel32 => 'LONG GetWindowsDirectoryA(
+ LPSTR buffer, LONG maxlength )')
   or die "Can't locate function: $!";
# Do this, or bear the consequences:
delete $getwindir->{proto};
my $buffer = "\0" x 200;
my $length = $getwindir->Call($buffer, length $buffer);
print substr $buffer, 0, $length;
[download]

And of course, you can replace "GetWindowsDirectory"/"GetWindowsDirectoryA" everywhere with "GetSystemDirectory"/"GetSystemDirectoryA", to get the Windows/System subdirectory