Function at 0x403100
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x80cc
mov ebp, esp
push edi
push esi
push ebx
call fcn.00406c70
mov esi, dword [ebp + 0x14]
mov ecx, pe_nt_image_headers32
lea edx, [ebp - 0x98]
mov dword [esp + 8], ecx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp], edx
mov dword [ebp - 0x809c], esi
xor esi, esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 4], esi
mov eax, 0x7fff
lea ecx, [ebp - 0x8098]
mov dword [esp + 8], eax
mov dword [esp], ecx
call sub.msvcrt.dll_memset
cmp byte [edi], 0
je 0x4032e0
nop
mov dword [esp], edi
mov edx, 0x25
mov dword [esp + 4], edx
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
je 0x4033cc
lea ebx, [eax + 1]
mov ecx, 0x25
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x80a0], eax
test eax, eax
je 0x4032e5
mov dword [esp + 4], edi
mov ecx, dword [ebp + 8]
mov eax, esi
sub eax, edi
mov dword [esp + 8], eax
mov dword [esp], ecx
call sub.msvcrt.dll_strncat
mov dword [esp + 4], ebx
mov edi, dword [ebp - 0x80a0]
lea edx, [ebp - 0x98]
mov dword [esp], edx
mov byte [ebp - 0x98], 0
sub edi, esi
dec edi
mov dword [esp + 8], edi
call sub.msvcrt.dll_strncat
mov eax, dword [ebp + 8]
mov edi, str.EXEDIR
lea esi, [ebp - 0x98]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cld
mov ebx, dword [ebp + 8]
add eax, ebx
mov dword [ebp - 0x80a4], eax
mov ebx, 7
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x403317
cld
mov edi, str.EXEFILE
lea esi, [ebp - 0x98]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
je 0x403335
cld
mov edi, 0x409311
lea esi, [ebp - 0x98]
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x403350
cld
mov edi, str.OLDPWD
lea esi, [ebp - 0x98]
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40336e
cld
mov edi, str.JREHOMEDIR
lea esi, [ebp - 0x98]
mov ecx, 0xb
repe cmpsb byte [esi], byte es:[edi]
je 0x403387
lea eax, [ebp - 0x98]
mov edi, str.HKEY
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strstr
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x403392
lea eax, [ebp - 0x8098]
mov edi, 0x7fff
lea ecx, [ebp - 0x98]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ecx
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
jne 0x4033b2
lea esi, [esi]
mov eax, dword [0x40a090]
test eax, eax
jne 0x4032f0
mov edi, dword [ebp - 0x80a0]
mov esi, dword [ebp - 0x80a0]
inc edi
cmp byte [esi + 1], 0
jne 0x403160
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
mov edi, dword [ebp - 0x80a4]
lea ecx, [ebp - 0x98]
mov dword [esp + 8], ecx
mov edx, str.Substitute:_t_s___s_n
mov dword [esp + 4], edx
mov dword [esp + 0xc], edi
call sub.msvcrt.dll_fprintf
jmp 0x4032c9
mov edx, dword [ebp - 0x809c]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strncat
jmp 0x4032c0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x4032c0
mov dword [esp], 0x104
mov edx, dword [ebp - 0x80a4]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
jmp 0x4032c0
mov eax, 0x412770
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.msvcrt.dll_strcat
jmp 0x4032c0
mov ebx, 0x412664
mov dword [esp + 4], ebx
jmp 0x403377
mov dword [esp], ecx
mov ebx, dword [ebp - 0x80a4]
mov edx, 0x400
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
call fcn.004023b0
jmp 0x4032c0
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x8098]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strcat
jmp 0x4032c0
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, 1
jmp 0x4032e5