Function at 0x402fe0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x80cc
mov ebp, esp
push edi
push esi
push ebx
call fcn.004050a0
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x809c], eax
cmp byte [edi], 0
je 0x403170
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
mov edx, 0x25
mov dword [esp + 4], edx
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
je 0x403240
lea ebx, [eax + 1]
mov ecx, 0x25
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x80a0], eax
test eax, eax
je 0x403175
mov dword [esp + 4], edi
mov ecx, dword [ebp + 8]
mov edx, esi
sub edx, edi
mov dword [esp + 8], edx
mov dword [esp], ecx
call sub.msvcrt.dll_strncat
mov dword [esp + 4], ebx
mov edi, dword [ebp - 0x80a0]
lea eax, [ebp - 0x98]
mov byte [ebp - 0x98], 0
mov dword [esp], eax
sub edi, esi
dec edi
mov dword [esp + 8], edi
call sub.msvcrt.dll_strncat
mov ebx, dword [ebp + 8]
mov edi, str.EXEDIR
lea esi, [ebp - 0x98]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
cld
mov edx, dword [ebp + 8]
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
lea ebx, [eax + edx]
je 0x4031c0
cld
mov edi, str.EXEFILE
lea esi, [ebp - 0x98]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
je 0x4031e1
cld
mov edi, 0x4072b0
lea esi, [ebp - 0x98]
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x4031f5
cld
mov edi, str.OLDPWD
lea esi, [ebp - 0x98]
mov ecx, 7
repe cmpsb byte [esi], byte es:[edi]
je 0x40320d
mov esi, str.HKEY
lea edi, [ebp - 0x98]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_strstr
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x403226
mov dword [esp + 4], ebx
lea ecx, [ebp - 0x98]
mov edi, 0x7fff
mov dword [esp + 8], edi
mov dword [esp], ecx
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
jne 0x40317d
lea esi, [esi]
lea edi, [edi]
mov eax, dword [0x410c20]
test eax, eax
jne 0x403199
mov edi, dword [ebp - 0x80a0]
mov ecx, dword [ebp - 0x80a0]
inc edi
cmp byte [ecx + 1], 0
jne 0x403010
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov esi, dword [ebp + 8]
mov dword [esp], esi
call sub.msvcrt.dll_strcat
lea esi, [esi]
mov eax, dword [0x410c20]
test eax, eax
je 0x403159
mov dword [esp + 0xc], ebx
lea edx, [ebp - 0x98]
mov ebx, str.Substitute:_t_s___s_n
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x403159
mov edi, dword [ebp - 0x809c]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strncat
jmp 0x403150
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strcat
jmp 0x403190
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
jmp 0x403150
mov edx, dword [ebp + 8]
mov eax, 0x410260
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strcat
jmp 0x403190
mov dword [esp + 4], ebx
mov eax, 0x400
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.00402060
jmp 0x403150
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, 1
jmp 0x403175