Function at 0x404450
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x690
mov eax, dword [0x493008]
xor eax, esp
mov dword [esp + 0x688], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [0x560388], 0
je 0x404567
push 0x48d624
push 0x560388
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4044b6
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x688]
xor ecx, esp
call fcn.00422d0c
add esp, 0x690
ret
lea edx, [esp + 0x218]
mov ecx, 0x560388
call fcn.00404160
test eax, eax
jne 0x40454a
push 0x138
lea eax, [esp + 0x424]
push eax
push 0x560388
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4044ff
push 0x104
lea eax, [esp + 0x424]
push eax
push 0x560388
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x560388
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x40454a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x560388
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
push eax
push 0x560388
call esi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x688]
xor ecx, esp
call fcn.00422d0c
add esp, 0x690
ret
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea eax, [esp + 0x218]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
lea eax, [esp + 0x14]
push eax
call esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
lea eax, [esp + 0x10]
push str..ini
push eax
call ebx
lea edx, [esp + 0x218]
lea ecx, [esp + 0x10]
call fcn.00404160
test eax, eax
jne 0x4045e8
push str.minipath.ini
lea eax, [esp + 0x14]
push eax
call esi
lea edx, [esp + 0x218]
lea ecx, [esp + 0x10]
call fcn.00404160
test eax, eax
jne 0x4045e8
lea eax, [esp + 0x218]
push eax
push 0x560388
call esi
push str..ini
push 0x560388
call ebx
jmp 0x404636
lea eax, [esp + 0x218]
mov edx, str.minipath.ini
push eax
lea eax, [esp + 0x14]
mov ecx, str.minipath
push eax
call fcn.00404320
add esp, 8
test eax, eax
je 0x40462a
lea eax, [esp + 0x218]
mov edx, str.minipath.ini
push eax
lea eax, [esp + 0x14]
mov ecx, str.minipath
push eax
call fcn.00404320
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0x560388
call esi
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x48d654
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x218]
push eax
call edi
push eax
lea eax, [esp + 0x14]
push eax
call esi
push str..ini
lea eax, [esp + 0x14]
push eax
call ebx
lea edx, [esp + 0x218]
lea ecx, [esp + 0x10]
call fcn.00404160
mov edi, eax
test edi, edi
jne 0x4046ca
push str.notepad3.ini
lea eax, [esp + 0x14]
push eax
call esi
lea edx, [esp + 0x218]
lea ecx, [esp + 0x10]
call fcn.00404160
mov edi, eax
test edi, edi
jne 0x4046ca
lea eax, [esp + 0x218]
push eax
push 0x560180
call esi
push str..ini
push 0x560180
call ebx
jmp 0x404718
lea eax, [esp + 0x218]
mov edx, str.notepad3.ini
push eax
lea eax, [esp + 0x14]
mov ecx, str.notepad3
push eax
call fcn.00404320
add esp, 8
test eax, eax
je 0x40470c
lea eax, [esp + 0x218]
mov edx, str.notepad3.ini
push eax
lea eax, [esp + 0x14]
mov ecx, str.notepad3
push eax
call fcn.00404320
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0x560180
call esi
mov ecx, dword [esp + 0x694]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.00422d0c
add esp, 0x690
ret