Function at 0x4770b0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x53c160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x4773d4
cmp dword [edi + 0x10], 0
je 0x4770ee
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret
xor esi, esi
test byte [edi + 0x18], 0x10
je 0x4773a9
push 0x1000
call fcn.004d22f2
mov esi, eax
add esp, 4
mov eax, dword [edi + 0x14]
mov byte [esi], 0
test eax, eax
je 0x477135
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515da4
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515da8
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
test eax, eax
je 0x477186
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515dac
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x477233
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4771b0
sub ecx, edx
lea eax, [ebp + ecx - 0x409]
lea ecx, [ebp - 0x408]
cmp eax, ecx
jb 0x4771f1
nop word [eax + eax]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x4771ee
cmp cl, 0x2f
je 0x4771ee
cmp cl, 0x3a
je 0x4771ee
dec eax
lea ecx, [ebp - 0x408]
cmp eax, ecx
jae 0x4771d0
jmp 0x4771f1
mov byte [eax], 0
lea ecx, [ebp - 0x408]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x477200
sub ecx, edx
je 0x477233
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515db0
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea eax, [ebp - 0x408]
push 0x400
push eax
push str._NT_SYMBOL_PATH
call ebx
test eax, eax
je 0x477278
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515dc4
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push eax
push str._NT_ALTERNATE_SYMBOL_PATH
call ebx
test eax, eax
je 0x4772b7
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515de4
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push eax
push str.SYSTEMROOT
call ebx
test eax, eax
je 0x477337
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515df4
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
lea eax, [ebp - 0x408]
push str._system32
push 0x400
push eax
call fcn.004d771e
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push 0x515e04
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
test byte [edi + 0x18], 0x10
je 0x4773a9
push 0x400
lea eax, [ebp - 0x408]
push eax
push str.SYSTEMDRIVE
call ebx
test eax, eax
je 0x477396
push str.SRV
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push str.websymbols
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
push str.http:__msdl.microsoft.com_download_symbols_
jmp 0x47739b
push str.SRVc:websymbolshttp:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.004d771e
add esp, 0xc
mov ecx, dword [edi + 4]
push esi
call fcn.00476560
mov ebx, eax
test esi, esi
je 0x4773c1
push esi
call fcn.004d217e
add esp, 4
test ebx, ebx
jne 0x4773f2
mov eax, dword [edi]
mov ecx, edi
push ebx
push ebx
push ebx
push str.Error_while_initializing_dbghelp.dll
call dword [eax + 0x10]
push 0x45a
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret
push dword [edi + 0xc]
mov ecx, dword [edi + 4]
push dword [edi + 8]
call fcn.00476b60
test eax, eax
je 0x47740b
mov dword [edi + 0x10], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3ba1
mov esp, ebp
pop ebp
ret