Function at 0x46ac40
Capabilities:
Get common file path
Link many functions at runtime
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0046b6d0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x4c0e9c
push 0x4afa34
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [0x4ea038], eax
test eax, eax
jne 0x46acbf
push 0x4c0eb8
lea eax, [ebp - 0x20c]
push 0x4c0e18
push eax
call fcn.00426350
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x10
push 0x4b0220
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c0ef8
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea048], eax
test eax, eax
jne 0x46acde
push 0x4c0f18
jmp 0x46ac83
push 0x4c0f58
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea050], eax
test eax, eax
jne 0x46acfd
push 0x4c0f70
jmp 0x46ac83
push 0x4c0fac
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea03c], eax
test eax, eax
jne 0x46ad32
push 0x4c0fc8
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1008
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea040], eax
test eax, eax
jne 0x46ad67
push 0x4c1020
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1058
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea044], eax
test eax, eax
jne 0x46ad9c
push 0x4c1068
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1090
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea064], eax
test eax, eax
jne 0x46add1
push 0x4c10b0
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c10f0
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4e5fec], eax
test eax, eax
jne 0x46ae06
push 0x4c1108
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1144
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea054], eax
test eax, eax
jne 0x46ae3b
push 0x4c1158
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c0fac
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea03c], eax
test eax, eax
je 0x46ad15
push 0x4c1188
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea058], eax
test eax, eax
jne 0x46ae8c
push 0x4c1198
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c11c4
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea05c], eax
test eax, eax
jne 0x46aec1
push 0x4c11d4
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c11fc
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea060], eax
test eax, eax
jne 0x46aef6
push 0x4c120c
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1234
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea074], eax
test eax, eax
jne 0x46af2b
push 0x4c1244
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1270
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea070], eax
test eax, eax
jne 0x46af60
push 0x4c1280
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c12ac
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea080], eax
test eax, eax
jne 0x46af95
push 0x4c12bc
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c12e4
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea068], eax
test eax, eax
jne 0x46afca
push 0x4c1300
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1340
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea06c], eax
test eax, eax
jne 0x46afff
push 0x4c1358
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1390
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea088], eax
test eax, eax
jne 0x46b034
push 0x4c13b0
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c13f0
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea08c], eax
test eax, eax
jne 0x46b069
push 0x4c1410
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c145c
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea090], eax
test eax, eax
jne 0x46b09e
push 0x4c1478
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c14bc
push 0x4afa34
call edi
push eax
call esi
mov dword [0x4ea04c], eax
test eax, eax
jne 0x46b0d3
push 0x4c14d0
call fcn.0046c510
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x4c1504
push 0x4c1518
call ebx
push eax
call esi
mov dword [0x4e5fe4], eax
test eax, eax
jne 0x46b198
push 0x4c152c
push 0x4c1548
call ebx
push eax
call esi
mov dword [0x4ea094], eax
test eax, eax
jne 0x46b12c
push 0x4c1560
call fcn.0046c510
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c15a4
push 0x4c1548
call edi
push eax
call esi
mov dword [0x4ea09c], eax
test eax, eax
jne 0x46b162
push 0x4c15b8
call fcn.0046c510
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c15f0
push 0x4c1548
call edi
push eax
call esi
mov dword [0x4ea098], eax
test eax, eax
jne 0x46b198
push 0x4c1604
call fcn.0046c510
add esp, 4
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x4c1638
push 0x4c1650
call ebx
push eax
call esi
push 0x4c1668
push 0x4c1674
mov dword [0x4ea1b0], eax
call ebx
push eax
call esi
push 0x4c1690
push 0x4c1674
mov dword [0x4ea13c], eax
call ebx
push eax
call esi
push 0x4c169c
push 0x4c1674
mov dword [0x4ea140], eax
call ebx
push eax
call esi
push 0x4c16c0
push 0x4c1674
mov dword [0x4ea120], eax
call ebx
push eax
call esi
push 0x4c16e4
push 0x4c1674
mov dword [0x4ea124], eax
call ebx
push eax
call esi
push 0x4c16f8
push 0x4c1674
mov dword [0x4ea134], eax
call ebx
push eax
call esi
push 0x4c170c
push 0x4c1674
mov dword [0x4ea138], eax
call ebx
push eax
call esi
push 0x4c1730
push 0x4c1674
mov dword [0x4ea12c], eax
call ebx
push eax
call esi
push 0x4c1754
push 0x4bc54c
mov dword [0x4ea128], eax
call ebx
push eax
call esi
push 0x4c1764
push 0x4c1774
mov dword [0x4e602c], eax
call ebx
push eax
call esi
push 0x4c1788
push 0x4c1774
mov dword [0x4ea0e4], eax
call ebx
push eax
call esi
push 0x4c179c
push 0x4c1774
mov dword [0x4e6034], eax
call ebx
push eax
call esi
push 0x4c17b4
push 0x4afa4c
mov dword [0x4ea104], eax
call ebx
push eax
call esi
push 0x4c17cc
push 0x4bc54c
mov dword [0x4ea110], eax
call ebx
push eax
call esi
push 0x4c17dc
push 0x4bc54c
mov dword [0x4ea148], eax
call ebx
push eax
call esi
push 0x4c17f8
push 0x4afa4c
mov dword [0x4ea1c0], eax
call ebx
push eax
call esi
push 0x4c1818
push 0x4afa4c
mov dword [0x4f6890], eax
call ebx
push eax
call esi
push 0x4c183c
push 0x4afa4c
mov dword [0x4ea154], eax
call ebx
push eax
call esi
push 0x4c1854
push 0x4c186c
mov dword [0x4ea158], eax
call ebx
push eax
call esi
push 0x4c1888
push 0x4c186c
mov dword [0x4ea15c], eax
call ebx
push eax
call esi
push 0x4c18a0
push 0x4c18b4
mov dword [0x4ea160], eax
call ebx
push eax
call esi
push 0x4c18cc
push 0x4c18b4
mov dword [0x4ea168], eax
call ebx
push eax
call esi
push 0x4c18e0
push 0x4c186c
mov dword [0x4ea16c], eax
call ebx
push eax
call esi
push 0x4c18f4
push 0x4c186c
mov dword [0x4ea178], eax
call ebx
push eax
call esi
push 0x4c1904
push 0x4c186c
mov dword [0x4ea17c], eax
call ebx
push eax
call esi
push 0x4c1914
push 0x4c186c
mov dword [0x4ea180], eax
call ebx
push eax
call esi
mov dword [0x4ea170], eax
push 0x4c1930
push 0x4afa4c
call ebx
push eax
call esi
push 0x4c1950
push 0x4bc54c
mov dword [0x4ea174], eax
call ebx
push eax
call esi
push 0x4c195c
push 0x4bc54c
mov dword [0x4f6898], eax
call ebx
push eax
call esi
push 0x4e45e4
mov dword [0x4f6894], eax
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x46b51f
lea eax, [ebp - 0x218]
push eax
push 0x4c1968
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x46b501
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
push 0x4e45e4
push 0
push 0
push 0x4c19ac
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x4c19bc
push 0x104
push 0x4e45e4
call fcn.00493457
add esp, 0xc
push 0x4e45e4
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x46b51f
push 0x4c19d4
push 0x104
push 0x4e45e4
call fcn.004911bd
add esp, 0xc
push 0x4e45e4
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x46b51f
push 0x104
push 0x4e45e4
push str._ProgramFiles_Debugging_Tools_for_Windows__x86_dbghelp.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x4e45e4
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x46b51f
push 0x4e45e4
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4c1a84
push 0x104
push 0x4e45e4
call fcn.00493457
add esp, 0xc
push 0x4e45e4
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x46b51f
push 0x4c0dd0
call ebx
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x46b51f
push 0x4c0de8
call ebx
mov dword [ebp - 0x210], eax
push 0x104
push 0x4e45e4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4e45e4
call fcn.0048a2b0
add esp, 4
cmp dword [0x4ea0fc], 0
jne 0x46b55a
push 0x4c0d08
push 0x4c0de8
call ebx
push eax
call esi
mov dword [0x4ea0fc], eax
push 0x4c1aa0
push dword [ebp - 0x210]
call esi
mov dword [0x4ea10c], eax
test eax, eax
je 0x46b57c
mov dword [0x4ea108], 0x467160
jmp 0x46b5a2
push 0x4c1ab8
push 0x4c0de8
call ebx
push eax
call esi
xor ecx, ecx
mov dword [0x4ea100], eax
test eax, eax
mov edx, 0x467180
cmovne ecx, edx
mov dword [0x4ea108], ecx
push 0x4c1acc
push 0x4afa34
call edi
push eax
call esi
push 0x4c1ae0
push 0x4afa34
mov dword [0x4ea078], eax
call edi
push eax
call esi
push 0x4c1af0
push 0x4afa4c
mov dword [0x4ea07c], eax
call edi
push eax
call esi
push 0x4c1b08
push 0x4afa4c
mov dword [0x4ea11c], eax
call edi
push eax
call esi
push 0x4c1b24
push 0x4afa4c
mov dword [0x4ea188], eax
call edi
push eax
call esi
push 0x4c1b3c
push 0x4afe00
mov dword [0x4ea14c], eax
call edi
push eax
call esi
push 0x4c1b50
push 0x4afa4c
mov dword [0x4ea144], eax
call edi
push eax
call esi
push 0x4c1b64
push 0x4bc54c
mov dword [0x4ea18c], eax
call edi
push eax
call esi
push 0x4c1b80
push 0x4afdb0
mov dword [0x4ea190], eax
call ebx
push eax
call esi
push 0x4c1b98
push 0x4c1ba8
mov dword [0x4e6030], eax
call ebx
push eax
call esi
push 0x4c1bbc
push 0x4afa4c
mov dword [0x4ea194], eax
call ebx
push eax
call esi
push 0x4c1bd8
push 0x4afa4c
mov dword [0x4ea130], eax
call ebx
push eax
call esi
push 0x4c1bf4
push 0x4bc54c
mov dword [0x4ea084], eax
call ebx
push eax
call esi
push 0x4c1c08
push 0x4afa4c
mov dword [0x4f687c], eax
call ebx
push eax
call esi
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [0x4ea198], eax
xor ecx, ebp
mov al, 1
pop esi
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret