Function at 0x40a3e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x40a704
cmp dword [edi + 0x10], 0
je 0x40a40d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
test byte [edi + 0x18], 0x10
je 0x40a6d9
push 0x1000
call fcn.0040c753
mov esi, eax
add esp, 4
test esi, esi
jne 0x40a43d
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x40a469
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f890
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40a4be
lea eax, [esp + 0x10]
mov byte [esp + 0x40f], 0
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x400
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a557
lea ecx, [esp + 0x10]
mov byte [esp + 0x40f], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a4e7
sub ecx, edx
lea eax, [esp + ecx + 0xf]
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x40a51f
lea esp, [esp]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x40a51c
cmp cl, 0x2f
je 0x40a51c
cmp cl, 0x3a
je 0x40a51c
dec eax
lea ecx, [esp + 0x10]
cmp eax, ecx
jae 0x40a500
jmp 0x40a51f
mov byte [eax], 0
lea ecx, [esp + 0x10]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a526
sub ecx, edx
je 0x40a557
lea eax, [esp + 0x10]
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x10]
push 0x400
push eax
push str._NT_SYMBOL_PATH
call ebx
test eax, eax
je 0x40a5a0
lea eax, [esp + 0x10]
mov byte [esp + 0x40f], 0
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x400
lea eax, [esp + 0x14]
push eax
push str._NT_ALTERNATE_SYMBOL_PATH
call ebx
test eax, eax
je 0x40a5e3
lea eax, [esp + 0x10]
mov byte [esp + 0x40f], 0
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x400
lea eax, [esp + 0x14]
push eax
push str.SYSTEMROOT
call ebx
test eax, eax
je 0x40a663
lea eax, [esp + 0x10]
mov byte [esp + 0x40f], 0
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
lea eax, [esp + 0x10]
push str._system32
push 0x400
push eax
call fcn.00423f98
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push 0x42f88c
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
test byte [edi + 0x18], 0x10
je 0x40a6d9
push 0x400
lea eax, [esp + 0x14]
push eax
push str.SYSTEMDRIVE
call ebx
test eax, eax
je 0x40a6c6
push str.SRV
push 0x1000
push esi
mov byte [esp + 0x41b], 0
call fcn.00423f98
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push str.websymbols
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
push str.http:__msdl.microsoft.com_download_symbols_
jmp 0x40a6cb
push str.SRVc:websymbolshttp:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.00423f98
add esp, 0xc
mov ecx, dword [edi + 4]
push esi
call fcn.00409970
mov ebx, eax
test esi, esi
je 0x40a6f1
push esi
call fcn.0040b4d0
add esp, 4
test ebx, ebx
jne 0x40a718
mov eax, dword [edi]
mov ecx, edi
push ebx
push ebx
push ebx
push str.Error_while_initializing_dbghelp.dll
call dword [eax + 0x10]
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0xc]
mov esi, dword [edi + 8]
mov ebx, dword [edi + 4]
mov ecx, ebx
push esi
call fcn.00409ce0
test eax, eax
je 0x40a73c
mov eax, 1
mov dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, ebx
call fcn.00409e10
test eax, eax
je 0x40a74f
mov dword [edi + 0x10], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret