Function at 0x443ac0
Capabilities:
Check os version
Get common file path
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c4
mov eax, dword [0x488180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x5b4]
push ecx
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5b4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x443b15
push 0x10
push str.tcsh
push str.GetVersionEx_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x5b0]
cmp eax, 6
mov dword [0x48b130], eax
jae 0x443b2a
call fcn.00401843
cmp dword [0x4a9aa0], 0
push esi
push edi
je 0x443c2c
push 1
lea edx, [ebp - 0x5bc]
push edx
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004011cc
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
add esp, 0x10
test eax, eax
je 0x443c75
cmp dword [ebp - 0x5b8], 0
je 0x443ee6
mov eax, dword [ebp - 0x5bc]
test eax, eax
je 0x443ee6
push eax
call edi
mov ecx, dword [ebp - 0x5b8]
push 0xc350
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x443ee6
cmp dword [0x4a9d18], eax
je 0x443ee6
mov eax, dword [0x4a9d1c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
add eax, 0xffef0004
push 0x110000
push eax
call esi
test eax, eax
je 0x443c9a
push 4
push 0x1000
push 0x110000
push eax
call esi
test eax, eax
je 0x443c9a
add eax, 0x110000
mov dword [ebp - 0x5c0], eax
mov esp, dword [ebp - 0x5c0]
push eax
call fcn.00401172
mov edx, dword [ebp - 0x5bc]
add esp, 4
push edx
call edi
mov eax, dword [ebp - 0x5b8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x5bc]
push ecx
call esi
cmp dword [0x4a9aa0], 0
jne 0x443c31
call fcn.00401884
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
push 0x104
lea edx, [ebp - 0x520]
push edx
push str.HOME
call esi
test eax, eax
je 0x443cd9
cmp eax, 0x104
jge 0x443cd9
lea eax, [ebp - 0x520]
push eax
call fcn.00401a64
add esp, 4
lea ecx, [ebp - 0x520]
push ecx
jmp 0x443e6c
cmp dword [0x4a9d18], 0
jne 0x443baa
push 4
push 0x1000
push 0x110000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x443cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044c66d
mov esp, ebp
pop ebp
ret
add eax, 0x10fffc
mov dword [ebp - 0x5c0], eax
mov dword [0x4a9d1c], eax
mov esp, dword [ebp - 0x5c0]
push eax
call fcn.00401172
add esp, 4
call fcn.00401884
jmp 0x443c23
push 0x104
lea edx, [ebp - 0x108]
push 0
push edx
call fcn.0044c680
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.0044c680
push 0x104
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.0044c680
mov eax, dword [ebp - 0x5a4]
add esp, 0x24
cmp eax, 2
jne 0x443de3
push 0x104
lea edx, [ebp - 0x108]
push edx
push str.USERPROFILE
call esi
push 0x104
lea eax, [ebp - 0x310]
push eax
push str.HOMEDRIVE
call esi
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push str.HOMEPATH
call esi
cmp byte [ebp - 0x108], 0
mov byte [ebp - 0x109], 0
mov byte [ebp - 0x20d], 0
mov byte [ebp - 5], 0
je 0x443da2
cmp dword [ebp - 0x5b0], 4
jb 0x443da2
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x41c]
push 0x47cde4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x443e56
cmp byte [ebp - 0x20c], 0
lea ecx, [ebp - 0x20c]
jne 0x443db6
mov ecx, 0x4835f0
cmp byte [ebp - 0x310], 0
lea eax, [ebp - 0x310]
jne 0x443dca
mov eax, 0x4835ec
push ecx
push eax
lea ecx, [ebp - 0x41c]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x443e56
cmp eax, 1
jne 0x443e42
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jle 0x443e20
push 0x10
push str.tcsh
push str.This_should_never_happen
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x108]
push eax
push 0x47cde4
lea ecx, [ebp - 0x41c]
push 0x109
push ecx
call fcn.0046fe5d
add esp, 0x10
jmp 0x443e56
push 0x10
push str.tcsh
push str.Unknown_platform
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [ebp - 0x41c]
push edx
call fcn.00401a64
add esp, 4
lea eax, [ebp - 0x41c]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.HOME
call ebx
mov ecx, dword [ebp - 0x5a4]
push 0
push 0
push str.Path
mov dword [0x48b140], ecx
call esi
mov edi, eax
test edi, edi
je 0x443ed6
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
mov esi, eax
push esi
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push str.Path
call ebx
push esi
push str.PATH
call ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x5c4]
push edx
call fcn.00451a7e
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044c66d
mov esp, ebp
pop ebp
ret