Function at 0x403360
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x720
mov eax, dword [ebp + 8]
push eax
call fcn.00403173
add esp, 4
mov dword [ebp - 0x10c], eax
push 0x41b448
lea ecx, [ebp - 0x720]
push ecx
call fcn.0040dddb
add esp, 8
mov edx, dword [ebp - 0x10c]
push edx
lea eax, [ebp - 0x720]
push eax
call fcn.0040dc80
add esp, 8
lea ecx, [ebp - 0x31c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x720]
push edx
mov eax, dword [0x41b0b8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403462
mov dword [ebp - 0x318], 0x104
lea ecx, [ebp - 0x318]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push 0x104
call fcn.0040db27
add esp, 4
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x318], 0x104
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
push 0
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x403446
mov eax, dword [ebp - 0x31c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x320]
jmp 0x403734
mov ecx, dword [ebp - 0x320]
push ecx
call fcn.0040da3e
add esp, 4
mov edx, dword [ebp - 0x31c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040dc70
add esp, 8
lea edx, [ebp - 0x210]
push edx
call fcn.00416f6c
add esp, 4
push 0x41b480
call fcn.0040dd60
add esp, 4
push eax
push 0x41b488
lea eax, [ebp - 0x210]
push eax
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x4034d7
push 0x41b490
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp - 0x10c]
add ecx, eax
push ecx
lea edx, [ebp - 0x314]
push edx
call fcn.0040dc70
add esp, 8
jmp 0x403576
push 0x41b498
call fcn.0040dd60
add esp, 4
push eax
push 0x41b4a8
lea eax, [ebp - 0x210]
push eax
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x403560
push 0x104
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x41b4b8
lea edx, [ebp - 0x104]
push edx
call fcn.0040dc80
add esp, 8
push 0x41b4bc
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp - 0x10c]
add ecx, eax
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.0040dc80
add esp, 8
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.0040dc70
add esp, 8
jmp 0x403576
mov edx, dword [ebp - 0x10c]
push edx
lea eax, [ebp - 0x314]
push eax
call fcn.0040dc70
add esp, 8
push 0x104
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x314]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00403016
add esp, 8
movsx edx, byte [ebp - 0x104]
test edx, edx
je 0x403732
push 0x104
call fcn.0040db27
add esp, 4
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
call fcn.0040dc70
add esp, 8
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
jne 0x4036e1
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x104
push 0
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4036e1
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040dc70
add esp, 8
push 0x41b4cc
lea edx, [ebp - 0x210]
push edx
call fcn.0040dc80
add esp, 8
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x104
push 0
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4036e1
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040dc70
add esp, 8
push 0x41b4d4
lea edx, [ebp - 0x210]
push edx
call fcn.0040dc80
add esp, 8
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0x104
push 0
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x4036e1
lea eax, [ebp - 0x104]
push eax
push 0x41b4dc
mov ecx, dword [ebp - 0x320]
push ecx
call fcn.0040dddb
add esp, 0xc
mov eax, dword [ebp - 0x320]
jmp 0x403734
cmp dword [0x420a9c], 0
je 0x403705
push 0x104
mov edx, dword [ebp - 0x320]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [0x420a9c]
jmp 0x40371b
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x320]
push edx
call fcn.0040dc70
add esp, 8
mov eax, dword [ebp - 0x320]
push eax
call fcn.004170a0
add esp, 4
mov eax, dword [ebp - 0x320]
jmp 0x403734
xor eax, eax
mov esp, ebp
pop ebp
ret