Function at 0x402f40
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x80cc
mov ebp, esp
push edi
push esi
push ebx
call fcn.00406960
mov esi, dword [ebp + 0x14]
mov ecx, pe_nt_image_headers32
lea edx, [ebp - 0x98]
mov dword [esp + 8], ecx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp], edx
mov dword [ebp - 0x809c], esi
xor esi, esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 4], esi
mov eax, 0x7fff
lea ecx, [ebp - 0x8098]
mov dword [esp + 8], eax
mov dword [esp], ecx
call sub.msvcrt.dll_memset
cmp byte [edi], 0
je 0x403120
nop
mov dword [esp], edi
mov edx, 0x25
mov dword [esp + 4], edx
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
je 0x403208
lea ebx, [eax + 1]
mov ecx, 0x25
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x80a0], eax
test eax, eax
je 0x403125
mov dword [esp + 4], edi
mov ecx, dword [ebp + 8]
mov eax, esi
sub eax, edi
mov dword [esp + 8], eax
mov dword [esp], ecx
call sub.msvcrt.dll_strncat
mov dword [esp + 4], ebx
mov edi, dword [ebp - 0x80a0]
lea edx, [ebp - 0x98]
mov dword [esp], edx
mov byte [ebp - 0x98], 0
sub edi, esi
dec edi
mov dword [esp + 8], edi
call sub.msvcrt.dll_strncat
mov eax, dword [ebp + 8]
mov edi, str.EXEDIR
lea esi, [ebp - 0x98]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cld
mov ebx, dword [ebp + 8]
add eax, ebx
mov dword [ebp - 0x80a4], eax
mov ebx, 7
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x403157
cld
mov edi, str.EXEFILE
lea esi, [ebp - 0x98]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
je 0x403175
cld
mov edi, 0x408311
lea esi, [ebp - 0x98]
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x403190
cld
mov edi, str.OLDPWD
lea esi, [ebp - 0x98]
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x4031ae
cld
mov edi, str.JREHOMEDIR
lea esi, [ebp - 0x98]
mov ecx, 0xb
repe cmpsb byte [esi], byte es:[edi]
je 0x4031c7
mov edx, str.HKEY
lea ebx, [ebp - 0x98]
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x4031ce
mov edx, 0x7fff
lea ecx, [ebp - 0x98]
lea ebx, [ebp - 0x8098]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], ecx
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
jne 0x4031ee
lea esi, [esi]
mov eax, dword [0x409090]
test eax, eax
jne 0x403130
mov edi, dword [ebp - 0x80a0]
mov esi, dword [ebp - 0x80a0]
inc edi
cmp byte [esi + 1], 0
jne 0x402fa0
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
mov edx, dword [ebp - 0x80a4]
lea ebx, [ebp - 0x98]
mov dword [esp + 8], ebx
mov ecx, str.Substitute:_t_s___s_n
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_fprintf
jmp 0x403109
mov edx, dword [ebp - 0x809c]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strncat
jmp 0x403100
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x403100
mov dword [esp], 0x104
mov edx, dword [ebp - 0x80a4]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
jmp 0x403100
mov eax, 0x411570
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x403100
mov eax, 0x411464
jmp 0x4031b3
mov dword [esp], ecx
mov esi, dword [ebp - 0x80a4]
mov eax, 0x400
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call fcn.00402390
jmp 0x403100
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x8098]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strcat
jmp 0x403100
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, 1
jmp 0x403125