Function at 0x40f99a
Capabilities:
Check if file exists
Get disk information
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x2870]
mov eax, 0x2870
call fcn.004b8880
push 0xffffffffffffffff
push 0x4dfa53
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x56f710]
xor eax, ebp
mov dword [ebp + 0x286c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov eax, dword [esi]
mov dword [ebp - 0x34], ecx
mov ecx, dword [eax - 0xc]
cmp ecx, 4
mov dword [ebp - 0x30], esi
jl 0x410ca7
test ecx, ecx
jge 0x40f9fe
push 0x80070057
call fcn.00402977
movzx edx, word [eax]
cmp dx, 0x2e
jne 0x40fa1a
cmp ecx, 1
jl 0x40f9f4
movzx eax, word [eax + 2]
cmp ax, 0x5c
je 0x410ca7
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410ca7
call fcn.0049219b
push eax
lea ecx, [ebp - 0x40]
call fcn.00402802
and dword [ebp - 4], 0
mov eax, dword [esi]
lea ecx, [ebp - 0x40]
push ecx
push eax
mov ecx, 0x57925c
call fcn.004a059e
test eax, eax
jne 0x410c9c
mov byte [ebp - 4], 1
call fcn.0049219b
push eax
lea ecx, [ebp - 0x14]
call fcn.00402802
mov byte [ebp - 4], 2
call fcn.0049219b
push eax
lea ecx, [ebp - 0x24]
call fcn.00402802
mov byte [ebp - 4], 3
call fcn.0049219b
push eax
lea ecx, [ebp - 0x18]
call fcn.00402802
mov byte [ebp - 4], 4
call fcn.0049219b
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402802
mov byte [ebp - 4], 5
call fcn.0049219b
push eax
lea ecx, [ebp - 0x20]
call fcn.00402802
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.004025ee
lea edi, [ebp - 0x14]
call fcn.00411ec6
mov ebx, edi
call fcn.0040c913
call fcn.0040c8c6
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fb2f
push dword [esi]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebx - 0x10]
call fcn.00402845
jmp 0x410c9c
cmp dword [ebx - 0xc], 4
jl 0x40fade
xor edi, edi
mov dword [ebp - 0x2c], edi
cmp edi, 4
jge 0x40fb81
mov eax, edi
sub eax, 0
je 0x40fb64
dec eax
je 0x40fb5d
dec eax
je 0x40fb56
dec eax
jne 0x40fb7e
push str.architecture
jmp 0x40fb69
push str.token
jmp 0x40fb69
push str.version
jmp 0x40fb69
push str.type
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, 0xffffffff
je 0x40fb7b
inc dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
inc edi
jmp 0x40fb3a
cmp dword [ebp - 0x2c], 1
jle 0x40fbdc
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
setne al
test al, al
jne 0x40fade
cmp dword [ebx - 0xc], 0
jl 0x40f9f4
movzx eax, word [ebx]
push eax
call fcn.004b3fc3
pop ecx
test eax, eax
je 0x40fade
cmp dword [ebp - 0x2c], 2
jg 0x40fade
xor edi, edi
push edi
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
jne 0x40fc41
cmp edi, 4
jg 0x40fade
push str.rundll32
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
mov esi, eax
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
je 0x40fc49
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebx - 0x10]
call fcn.00402845
mov bl, 1
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402845
mov al, bl
jmp 0x410ca9
inc edi
inc eax
push eax
jmp 0x40fbc4
test esi, esi
je 0x410be2
cmp esi, 1
jne 0x40fc6d
cmp dword [ebx - 0xc], 0
jl 0x40f9f4
movzx eax, word [ebx]
cmp ax, 0x22
je 0x410be2
push 0x531498
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
mov esi, eax
lea eax, [esi - 3]
cmp eax, 3
ja 0x40fd31
mov ecx, dword [ebp - 0x30]
push esi
lea eax, [ebp - 0x44]
push eax
call fcn.00407990
lea edi, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00411ec6
push 0x5314a0
mov ecx, edi
call fcn.0040ca34
xor edi, edi
cmp eax, edi
je 0x40fcf1
push str.file
lea ecx, [ebp - 0x44]
call fcn.0040ca34
cmp eax, edi
je 0x40fcf1
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00402845
jmp 0x40fbf9
push edi
lea ecx, [ebp - 0x14]
lea eax, [esi + 3]
push ecx
call fcn.00407277
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], edi
jl 0x40f9f4
movzx eax, word [eax]
cmp ax, 0x2f
je 0x40fd62
push 0x5c
push 0x2f
lea ebx, [ebp - 0x14]
call fcn.00411cbb
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.00402845
mov ebx, dword [ebp - 0x14]
push 0
push 0x3b
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x40fd6c
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
jmp 0x40fbf9
lea eax, [ebp - 0x14]
push edi
push eax
xor eax, eax
inc eax
jmp 0x40fcf9
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x40fbf9
push eax
push 0x2a
lea ecx, [ebp - 0x14]
call fcn.00411e72
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
je 0x40fe2e
mov edi, dword [ebx - 0xc]
push 0x5314b4
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
add edi, 0xfffffffe
cmp eax, edi
je 0x40fdc2
mov edi, dword [ebx - 0xc]
push 0x5314bc
xor ecx, ecx
call fcn.00407898
add edi, 0xfffffffe
cmp eax, edi
jne 0x40fdd6
mov ebx, dword [ebx - 0xc]
dec ebx
push ebx
lea eax, [ebp - 0x14]
push eax
xor eax, eax
inc eax
call fcn.00407277
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x38]
inc esi
push esi
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00411e72
or edi, 0xffffffff
cmp eax, edi
jne 0x40fd42
push esi
push 0x2a
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, edi
jne 0x40fd42
push 0
push 0x3f
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, edi
jne 0x40fd42
push 0x5314c4
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, edi
jne 0x40fd42
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x40fbf9
mov edx, dword [ebx - 0xc]
xor edi, edi
cmp edx, edi
jl 0x40f9f4
movzx eax, word [ebx]
cmp ax, 0x40
jne 0x40fe91
cmp edx, 1
jl 0x40f9f4
movzx eax, word [ebx + 2]
movzx ecx, ax
cmp cx, 0x25
je 0x40fe81
cmp edx, 1
jl 0x40f9f4
movzx eax, ax
push eax
call fcn.004b3fc3
pop ecx
test eax, eax
je 0x40fe91
push edi
lea eax, [ebp - 0x14]
push eax
xor eax, eax
inc eax
call fcn.00407277
mov ebx, dword [ebp - 0x14]
cmp byte [ebp + 0x2890], 0
jne 0x40feb9
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x40fbf9
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x40fd42
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x40fbf9
cmp byte [ebp + 0x287c], al
je 0x40fee2
lea eax, [ebp - 0x14]
push eax
call fcn.0040edce
test al, al
jne 0x40fd42
cmp byte [ebp + 0x288c], 0
je 0x410111
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022fa
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
je 0x40ff16
lea ecx, [edi - 0x10]
jmp 0x40fce7
push edi
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040272d
mov edi, dword [ebp - 0x2c]
cmp dword [edi - 0xc], 0
je 0x40ffbd
push edi
call fcn.004110fe
test eax, eax
jge 0x40ff02
push edi
call fcn.0040f1b8
pop ecx
lea edi, [ebp - 0x2c]
mov byte [ebp - 0x25], al
call fcn.00411ec6
push str..exe
xor ecx, ecx
mov esi, edi
call fcn.00407898
test eax, eax
jg 0x40ff71
push 0x52f454
xor ecx, ecx
call fcn.00407898
test eax, eax
jge 0x40feff
cmp byte [ebp - 0x25], 0
jne 0x40feff
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebx - 0x10]
call fcn.00402845
xor bl, bl
jmp 0x40fc2f
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x40ff0e
push 0x5314cc
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x25], 1
test eax, eax
jne 0x410015
xor ecx, ecx
push 0x5314cc
inc ecx
call fcn.00407898
mov dword [ebp - 0x3c], eax
cmp eax, 0xffffffff
je 0x410015
mov ecx, eax
inc ecx
push 0x5314cc
call fcn.00407898
mov dword [ebp - 0x3c], eax
cmp eax, 0xffffffff
jne 0x410015
mov byte [ebp - 0x25], 0
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x40ff0e
cmp byte [ebp - 0x25], al
je 0x410100
mov ecx, dword [ebp - 0x3c]
inc ecx
push 0x5314cc
lea esi, [ebp - 0x14]
mov dword [ebp - 0x38], ecx
call fcn.00407898
cmp eax, dword [ebp - 0x3c]
jle 0x410100
sub eax, dword [ebp - 0x3c]
mov ecx, esi
dec eax
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x34]
push eax
call fcn.00407912
mov byte [ebp - 4], 9
push dword [ebp - 0x34]
call fcn.004110fe
test eax, eax
setge byte [ebp - 0x25]
cmp byte [ebp - 0x25], 0
jne 0x4100b1
push dword [ebp - 0x34]
call fcn.0040f1b8
pop ecx
mov byte [ebp - 0x25], al
test al, al
je 0x4100b1
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00402845
jmp 0x40ff0e
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [edi - 0x10]
call fcn.00402845
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebx - 0x10]
call fcn.00402845
mov bl, byte [ebp - 0x25]
jmp 0x40fc2f
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 6
call fcn.00402845
jmp 0x4101a4
push str..exe
lea ecx, [ebp - 0x5c]
call fcn.0040254f
push str..dll
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.0040254f
push str..ocx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xb
call fcn.0040254f
push 0x5314d0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xc
call fcn.0040254f
push 0x5314d8
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
call fcn.0040254f
mov byte [ebp - 4], 0xe
cmp edi, 5
jae 0x41018e
push ecx
lea eax, [ebp + edi*4 - 0x5c]
mov dword [ebp - 0x38], esp
mov ecx, esp
push eax
call fcn.004022fa
lea ecx, [ebp - 0x14]
call fcn.0040f942
mov ebx, dword [ebp - 0x14]
pop ecx
test al, al
jne 0x41018e
inc edi
jmp 0x410166
push 0x40283b
push 5
push 4
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 6
call fcn.004b2e63
cmp dword [ebx - 0xc], 0
jl 0x40f9f4
movzx eax, word [ebx]
cmp ax, 0x22
jne 0x4101ea
push 1
push 0x22
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x40fd42
push 0
push 0x22
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x4101ea
push 0x20
push eax
lea ecx, [ebp - 0x14]
call fcn.00411f20
jmp 0x4101cc
lea ebx, [ebp - 0x14]
call fcn.0040c913
call fcn.0040c8c6
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
je 0x41023a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
jmp 0x40fc28
mov edi, dword [ebp - 0x14]
xor ebx, ebx
cmp byte [ebp + 0x2878], bl
je 0x4102a1
push edi
call fcn.00430993
pop ecx
test al, al
jne 0x4102a1
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [edi - 0x10]
jmp 0x40fc28
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x41026d
push ebx
push 0x25
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x410322
inc eax
push eax
push 0x25
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x410322
xor eax, eax
push 0xffe
mov word [ebp + 0x104c], ax
lea eax, [ebp + 0x104e]
push ebx
push eax
call fcn.004b62d0
add esp, 0xc
mov esi, 0x800
push esi
lea eax, [ebp + 0x104c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x410322
cmp eax, esi
jae 0x410322
lea eax, [ebp + 0x104c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040272d
lea edi, [ebp - 0x14]
call fcn.00411ec6
mov edi, dword [ebp - 0x14]
push str.rundll32
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, ebx
jne 0x41038a
push 7
push 0x20
mov ecx, esi
call fcn.00411e72
cmp eax, 0xffffffff
je 0x41038a
push ebx
mov ecx, esi
push ecx
call fcn.00407277
mov ebx, esi
call fcn.0040c913
push 0
push 0x2c
mov ecx, esi
call fcn.00411e72
mov ecx, eax
cmp ecx, 0xffffffff
je 0x410378
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
push ecx
sub eax, ecx
mov ecx, esi
push ecx
call fcn.00407277
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410252
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x41026d
lea edi, [ebp - 0x14]
call fcn.00411ec6
mov edi, dword [ebp - 0x14]
mov eax, dword [edi - 0xc]
mov ebx, 0x40f
cmp eax, ebx
jle 0x41044f
push 0
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00411e72
test eax, eax
jl 0x410252
inc eax
push eax
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00411e72
test eax, eax
jl 0x410252
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x410252
push edi
call fcn.004110fe
test eax, eax
setge bl
test bl, bl
je 0x410416
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [edi - 0x10]
call fcn.00402845
jmp 0x40fc2f
cmp eax, 0x104
jg 0x410252
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x41026d
push 0x82c
push eax
lea eax, [ebp]
push eax
call fcn.004b62d0
add esp, 0xc
push edi
lea eax, [ebp]
mov byte [ebp - 4], 0xf
call fcn.0040cbd2
push 0x820
lea eax, [ebp + 0x204c]
push 0
push eax
call fcn.004b62d0
add esp, 0xc
push 0x530c68
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, 0xffffffff
je 0x410733
lea eax, [ebp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4104bd
sub eax, edx
sar eax, 1
je 0x410554
lea eax, [ebp - 0x2c]
push eax
call fcn.00411c45
push eax
lea eax, [ebp + 4]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x10
call fcn.0040c9b1
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00402845
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00402845
cmp dword [0x5722a0], 0
je 0x410554
cmp esi, 3
je 0x410554
mov eax, dword [ebp - 0x30]
push dword [eax]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
push 0x82c
lea eax, [ebp]
push 0
push eax
call fcn.004b62d0
add esp, 0xc
jmp 0x41026d
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebx
test eax, eax
je 0x410583
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
push 0x52eb84
push eax
mov ecx, 0x57925c
call fcn.004122ec
lea ecx, [ebp]
call fcn.0040cbbb
jmp 0x41026d
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410576
mov edx, edi
lea ecx, [ebp + 0x204c]
movzx eax, word [edx]
inc edx
mov word [ecx], ax
inc edx
inc ecx
inc ecx
test ax, ax
jne 0x410597
push 0
lea eax, [ebp + 0x204c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
test eax, eax
jne 0x410561
call fcn.0045d184
test al, al
je 0x4105e6
cmp byte [ebp + 0x2884], 0
je 0x4105e6
push str.program_files
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, 0xffffffff
je 0x4105e6
mov byte [ebp + 0x2884], 0
call fcn.0045d184
test al, al
je 0x410606
cmp byte [ebp + 0x2884], 0
jne 0x410606
push dword [ebp + 0x2888]
push edi
call fcn.0040f05a
jmp 0x41060c
push edi
call fcn.004110fe
mov esi, eax
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410576
cmp esi, 0xffffffff
jne 0x41066e
push edi
call fcn.0040f1b8
pop ecx
test al, al
jne 0x410561
lea ecx, [ebp]
call fcn.0040cbbb
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [edi - 0x10]
jmp 0x40ffb1
test esi, esi
jne 0x410561
push esi
push 0x2e
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
jne 0x410703
push edi
call ebx
test eax, eax
jne 0x410561
push str..exe
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040217c
add esp, 0xc
mov byte [ebp - 4], 0x11
push dword [ebp - 0x38]
call ebx
test eax, eax
je 0x4106d8
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
push 0x52eb84
push eax
mov ecx, 0x57925c
call fcn.004122ec
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00402845
jmp 0x410576
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040263b
push str._system32
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, 0xffffffff
jne 0x4106b3
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00402845
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410576
push edi
call ebx
test eax, eax
jne 0x410724
push edi
call fcn.0040f4f9
mov bl, al
jmp 0x410726
mov bl, 1
lea ecx, [ebp]
call fcn.0040cbbb
jmp 0x410416
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410576
lea edi, [ebp - 0x14]
call fcn.00411ec6
mov edi, dword [ebp - 0x14]
mov edx, edi
lea ecx, [ebp + 0x204c]
xor esi, esi
movzx eax, word [edx]
inc edx
mov word [ecx], ax
inc edx
inc ecx
inc ecx
cmp ax, si
jne 0x410758
push esi
lea eax, [ebp + 0x204c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
test eax, eax
je 0x410793
lea eax, [ebp + 0x204c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410724
lea eax, [ebp + 0x204c]
push eax
jmp 0x41071b
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410576
push 0x81e
mov word [ebp + 0x82c], ax
lea eax, [ebp + 0x82e]
push esi
push eax
call fcn.004b62d0
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x82c]
push eax
push ebx
lea eax, [ebp + 0x41a]
push eax
lea eax, [ebp + 0x212]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x410561
push str..dll
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
or ebx, 0xffffffff
cmp eax, ebx
jne 0x410832
push str..ocx
xor ecx, ecx
call fcn.00407898
cmp eax, ebx
jne 0x410832
push str..exe
xor ecx, ecx
call fcn.00407898
cmp eax, ebx
jne 0x410832
push 0x5314d0
xor ecx, ecx
call fcn.00407898
cmp eax, ebx
je 0x410bab
push 0x52d4f4
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
cmp eax, ebx
jne 0x410bab
mov eax, dword [ebp - 0x34]
add eax, 0x202c
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402318
xor esi, esi
push esi
push 0x5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x12
call fcn.00411e72
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4108d7
lea esi, [ebx + 1]
push esi
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x4108a2
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
push 0x52eb84
push eax
mov ecx, 0x57925c
call fcn.004122ec
mov ecx, dword [ebp - 0x2c]
jmp 0x4106cb
cmp esi, dword [edi - 0xc]
jl 0x4108a9
mov esi, ebx
push esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x14]
call fcn.004078ef
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x13
call fcn.0040263b
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00402845
mov edi, dword [ebp - 0x14]
xor esi, esi
push esi
push 0x2f
lea ecx, [ebp - 0x14]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x41096d
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x41089a
lea ecx, [ebp - 0x38]
call fcn.00402827
mov ebx, 0x104
push ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x14
call fcn.0040294d
push ebx
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathSearchAndQualifyW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
test eax, eax
je 0x41095d
call fcn.004123c7
mov esi, dword [ebp - 0x38]
push esi
call fcn.004110fe
test eax, eax
jge 0x410943
push esi
call fcn.0040f1b8
test al, al
pop ecx
setne bl
jmp 0x410945
mov bl, 1
lea ecx, [esi - 0x10]
call fcn.00402845
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00402845
jmp 0x410726
call fcn.004123c7
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00402845
push 0x82c
lea eax, [ebp + 0x1820]
push esi
push eax
call fcn.004b62d0
add esp, 0xc
cmp edi, esi
je 0x410993
push edi
lea eax, [ebp + 0x1820]
push eax
call fcn.0040cba7
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x15
call fcn.00402318
lea eax, [ebp + 0x41a]
mov byte [ebp - 4], 0x16
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4109b0
sub eax, edx
sar eax, 1
je 0x410a4c
lea eax, [ebp + 0x1c3a]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040274a
push esi
push 0x20
lea ecx, [ebp - 0x3c]
call fcn.00411e72
cmp eax, 0xffffffff
je 0x4109f8
push esi
push 0x20
lea ecx, [ebp - 0x3c]
call fcn.00411e72
xor ecx, ecx
mov word [ebp + eax*2 + 0x1c3a], cx
lea eax, [ebp + 0x1c3a]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x410a01
sub eax, edx
sar eax, 1
mov ebx, eax
lea eax, [ebp + 0x1c3a]
push eax
xor ecx, ecx
lea esi, [ebp - 0x14]
call fcn.00407898
add eax, ebx
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.00407990
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x17
call fcn.0040263b
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.00402845
lea ebx, [ebp - 0x3c]
call fcn.0040c913
call fcn.0040c8c6
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
je 0x410a80
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebp + 0x1820]
call fcn.0040cbbb
jmp 0x41089a
lea ecx, [ebp - 0x3c]
call fcn.0040f50b
test al, al
je 0x410aa3
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
push 0x52eb84
push eax
mov ecx, 0x57925c
call fcn.004122ec
jmp 0x410a65
push ecx
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
call fcn.00402318
lea ecx, [ebp - 0x2c]
call fcn.00406dfa
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x410b86
call fcn.0045d184
test al, al
je 0x410b14
push 0x579258
lea ecx, [ebp - 0x2c]
call fcn.0040263b
push ecx
lea eax, [ebp - 0x3c]
mov ecx, esp
mov dword [ebp - 0x38], esp
push eax
call fcn.00402318
lea ecx, [ebp - 0x2c]
call fcn.00406dfa
push dword [ebp - 0x2c]
call esi
test eax, eax
jne 0x410a8c
push dword [ebp - 0x2c]
call fcn.0040f1b8
pop ecx
test al, al
jne 0x410a8c
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp + 0x204c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
test ax, ax
jne 0x410b1d
push 0
lea eax, [ebp + 0x204c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
test eax, eax
je 0x410b79
lea eax, [ebp + 0x204c]
push eax
call esi
test eax, eax
jne 0x410b5c
lea eax, [ebp + 0x204c]
push eax
call fcn.0040f4f9
mov bl, al
jmp 0x410b5e
mov bl, 1
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebp + 0x1820]
call fcn.0040cbbb
jmp 0x41094d
mov ebx, dword [ebp - 0x2c]
push ebx
call esi
test eax, eax
jne 0x410b5c
push ebx
jmp 0x410b53
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebp + 0x1820]
call fcn.0040cbbb
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00402845
mov eax, dword [ebp - 0x34]
call fcn.0040d171
test eax, eax
jne 0x410576
cmp byte [ebp + 0x2890], al
je 0x410561
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
je 0x410561
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x410716
push dword [ebp + 0x2890]
mov esi, dword [ebp - 0x30]
push dword [ebp + 0x288c]
push dword [ebp + 0x2888]
push dword [ebp + 0x2884]
push dword [ebp + 0x2880]
push dword [ebp + 0x287c]
push dword [ebp + 0x2878]
push ecx
mov dword [ebp - 0x48], esp
mov ecx, esp
push esi
call fcn.004022fa
push dword [ebp - 0x34]
call fcn.0040f1ca
mov byte [ebp - 0x25], al
test al, al
je 0x410c42
push dword [esi]
mov ecx, 0x57925c
call fcn.004a071a
push 0x52eb84
mov ecx, eax
call fcn.0040272d
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebx - 0x10]
call fcn.00402845
mov bl, byte [ebp - 0x25]
jmp 0x40fc2f
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.00402845
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x286c]
xor ecx, ebp
call fcn.004b228f
add ebp, 0x2870
leave
ret 0x1c