Function at 0x443a80
Capabilities:
Access peb ldr_data
Get common file path
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x53326b
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push ebp
push esi
mov esi, ecx
call fcn.005269f5
mov ebx, dword [eax + 4]
push 1
push 0x595d74
push 0x5785f0
mov ecx, ebx
call fcn.00526483
push 1
push 0x595d54
push 0x5785f0
mov ecx, ebx
mov dword [esi + 4], eax
call fcn.00526483
push 0
push 0x595d38
push 0x5785f0
mov ecx, ebx
mov dword [esi + 8], eax
call fcn.00526483
push 1
push 0x595d28
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0xc], eax
call fcn.00526483
push 0
push 0x595d08
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x10], eax
call fcn.00526483
push 0
push 0x595cfc
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x20], eax
call fcn.00526483
push 2
push 0x595ce0
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x14], eax
call fcn.00526483
push 0
push 0x595cc4
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x18], eax
call fcn.00526483
push 0
push 0x595784
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x1c], eax
call fcn.00526483
push 1
push 0x591784
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x34], eax
call fcn.00526483
push 1
push 0x590a44
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x24], eax
call fcn.00526483
push 0
push 0x591800
mov dword [esi + 0x2c], eax
push 0x5785f0
mov ecx, ebx
call fcn.00526483
push 1
push 0x591f84
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x30], eax
call fcn.00526483
push 1
push 0x592158
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x38], eax
call fcn.00526483
push 1
push 0x595cb0
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x3c], eax
call fcn.00526483
push 1
push 0x595bf8
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x40], eax
call fcn.00526483
push 0
push 0x595be0
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x28], eax
call fcn.00526483
push 0
push 0x595bc8
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x74], eax
call fcn.00526483
push 1
push 0x595b98
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x78], eax
call fcn.00526483
push 0xb
push 0x595ca8
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x7c], eax
call fcn.00526483
push 0
push 0x5909ec
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x54], eax
call fcn.00526483
push 0
push 0x5909c8
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x6c], eax
call fcn.00526483
push 1
push 0x595c90
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x70], eax
call fcn.00526483
push 0
push 0x595c78
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x48], eax
call fcn.00526483
push 0
push 0x595c64
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x4c], eax
call fcn.00526483
mov dword [esi + 0x50], eax
push 0
push 0x595c44
push 0x5785f0
mov ecx, ebx
call fcn.00526483
push 0
push 0x595b84
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x44], eax
call fcn.00526483
mov dword [esi + 0x80], eax
mov eax, dword [esi + 0x54]
cmp eax, 0xb
ja case.0x443d05.11
jmp dword [eax*4 + 0x443ed0]
mov dword [esi + 0x58], 0x70
jmp 0x443d76
mov dword [esi + 0x58], 0x71
jmp 0x443d76
mov dword [esi + 0x58], 0x72
jmp 0x443d76
mov dword [esi + 0x58], 0x73
jmp 0x443d76
mov dword [esi + 0x58], 0x74
jmp 0x443d76
mov dword [esi + 0x58], 0x75
jmp 0x443d76
mov dword [esi + 0x58], 0x76
jmp 0x443d76
mov dword [esi + 0x58], 0x77
jmp 0x443d76
mov dword [esi + 0x58], 0x78
jmp 0x443d76
mov dword [esi + 0x58], 0x79
jmp 0x443d76
mov dword [esi + 0x58], 0x7a
jmp 0x443d76
mov dword [esi + 0x58], 0x7b
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x443d9c
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00433ca0
add esp, 8
lea edx, [esp + 0x10]
push 0x57c790
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 0x57c760
push 0x5785f0
push ecx
mov ecx, ebx
call fcn.005264ef
lea ebp, [esi + 0x5c]
push eax
mov ecx, ebp
mov dword [esp + 0x224], 0
call fcn.00512024
lea ecx, [esp + 0xc]
mov dword [esp + 0x220], 0xffffffff
call fcn.00511eeb
mov edx, dword [ebp]
mov eax, dword [edx - 8]
test eax, eax
je 0x443e4a
mov al, byte [0x5a17b0]
push edi
mov byte [esp + 0x118], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x118]
push 0x104
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
pop edi
jbe 0x443e4a
cmp eax, 0x104
jae 0x443e4a
lea edx, [esp + 0x114]
mov ecx, ebp
push edx
call fcn.00512074
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x443e60
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.00512074
push 0
push 0x57c778
push 0x5785f0
mov ecx, ebx
call fcn.00526483
push 0x1770
push 0x57c744
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x60], eax
call fcn.00526483
push 1
push 0x595c1c
push 0x5785f0
mov ecx, ebx
mov dword [esi + 0x64], eax
call fcn.00526483
mov dword [esi + 0x68], eax
mov eax, dword [0x5a1fcc]
test eax, eax
je 0x443eb5
mov dword [esi + 0x10], 0
mov ecx, dword [esp + 0x218]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x218
ret