Function at 0x413805
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x218
mov eax, dword [0x47e5d0]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x220]
and dword [esp + 8], 0
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
mov esi, dword [esp + 0x228]
push edi
push 0x207
mov dword [esp + 0x18], eax
lea eax, [esp + 0x21]
push 0
push eax
mov dword [esp + 0x1c], esi
mov byte [esp + 0x28], 0
call fcn.00452e00
add esp, 0xc
test ebp, ebp
je 0x413860
mov byte [ebp], 0
test esi, esi
je 0x413df1
cmp byte [esi], 0
je 0x413df1
test ebp, ebp
je 0x413df1
mov ebx, dword [esp + 0x238]
cmp ebx, 1
jl 0x413df1
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
cmp eax, 0x104
jl 0x4138ba
push esi
call edi
inc eax
cmp ebx, eax
jge 0x4138a5
mov eax, ebx
jmp 0x4138a9
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
inc eax
jmp 0x413df3
push 0x467bd0
push esi
call fcn.004526d0
pop ecx
pop ecx
test eax, eax
jne 0x4138dc
push 0x466844
push esi
call fcn.004526d0
pop ecx
pop ecx
test eax, eax
je 0x4138e6
push esi
call fcn.00410370
test eax, eax
jne 0x413899
lea eax, [ebx + 0x10000]
mov ecx, 0x1000
cmp eax, ecx
jg 0x4138f7
mov eax, ecx
push 1
push eax
call fcn.00452b24
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x413df1
push dword [esp + 0x10]
mov eax, ebx
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_sPath
dec eax
push eax
push ebp
push 0
push 3
call fcn.0044ad45
add esp, 0x18
push ebp
call fcn.00410370
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x41393b
mov byte [ebp], 0
jmp 0x41397a
push 0
push 0x466428
push ebp
call fcn.0044937b
push ebp
call edi
cmp byte [eax + ebp - 1], 0x5c
je 0x41395a
push 0x4648e0
push ebp
call ebx
push dword [esp + 0x10]
call edi
cmp eax, dword [esp + 0x238]
jge 0x413970
push dword [esp + 0x10]
push ebp
call ebx
cmp byte [ebp], 0
jne 0x413bfa
push esi
push 0x102
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
je 0x413998
push 0x4648e0
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x4139cc
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x4139bf
mov eax, dword [esp + 0x238]
jmp 0x4139c3
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp], 0
jne 0x413bfa
cmp dword [esp + 0x14], 0
je 0x4139ea
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4139ed
mov byte [esi], 0
push 3
push 0x4648e0
push esi
call fcn.0044937b
push 0x4648e0
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x413a36
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413a29
mov eax, dword [esp + 0x238]
jmp 0x413a2d
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp], 0
jne 0x413bfa
push 0x102
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 3
push 0x4648e0
push esi
call fcn.0044937b
push 0x4648e0
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x413a9e
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413a91
mov eax, dword [esp + 0x238]
jmp 0x413a95
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp], 0
jne 0x413bfa
push 0x102
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
je 0x413ac6
push 0x4648e0
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x413afa
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413aed
mov eax, dword [esp + 0x238]
jmp 0x413af1
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp], 0
jne 0x413bfa
push 0x102
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
je 0x413b22
push 0x4648e0
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x413b56
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413b49
mov eax, dword [esp + 0x238]
jmp 0x413b4d
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp], 0
jne 0x413bfa
push str.IEXPLORE.EXE
push dword [esp + 0x14]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x413b9b
push str.Internet_Explore
push dword [esp + 0x14]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x413b9b
push 0x467b58
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x413bfa
push 0x102
push esi
push 0x467b48
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
je 0x413bbe
push 0x4648e0
push esi
call ebx
push str.Internet_Explorer_
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x413bfa
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413bed
mov eax, dword [esp + 0x238]
jmp 0x413bf1
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
and dword [esp + 0x14], 0
cmp byte [ebp], 0
jne 0x413c57
mov eax, dword [esp + 0x14]
push esi
inc eax
push eax
call fcn.004116b1
push esi
call edi
cmp byte [eax + esi - 1], 0x5c
je 0x413c23
push 0x4648e0
push esi
call ebx
push dword [esp + 0x10]
push esi
call ebx
push esi
call fcn.00410370
test eax, eax
je 0x413c57
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413c4a
mov eax, dword [esp + 0x238]
jmp 0x413c4e
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x413bff
cmp byte [ebp], 0
jne 0x413dbe
mov eax, dword [esp + 0x238]
add eax, 0xfffffc00
push eax
push esi
push 0x467b2c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
and dword [esp + 0x14], 0
push 0
push 1
push 0x103
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x24]
push 0x466428
push esi
call fcn.0044cdae
test eax, eax
je 0x413d24
cmp byte [esp + 0x1c], 0
je 0x413d24
lea eax, [esp + 0x1c]
push eax
call edi
lea ecx, [esp + 0x1c]
cmp byte [eax + ecx - 1], 0x5c
je 0x413cce
push 0x4648e0
mov eax, ecx
push eax
call ebx
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call ebx
lea eax, [esp + 0x1c]
push eax
call fcn.00410370
test eax, eax
je 0x413d16
lea eax, [esp + 0x1c]
push eax
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413d01
mov eax, dword [esp + 0x238]
jmp 0x413d09
lea eax, [esp + 0x1c]
push eax
call edi
inc eax
push eax
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
inc dword [esp + 0x14]
cmp byte [ebp], 0
je 0x413c8a
cmp byte [ebp], 0
jne 0x413dbe
mov ebx, dword [esp + 0x10]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4677dc
push 0
push esi
call fcn.00449673
push esi
call fcn.00410370
test eax, eax
je 0x413d74
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413d67
mov eax, dword [esp + 0x238]
jmp 0x413d6b
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [ebp], 0
jne 0x413dc2
lea eax, [esp + 0x18]
push eax
push esi
push 0x102
push 0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x413dc2
cmp byte [esi], 0
je 0x413dc2
push esi
call edi
inc eax
cmp dword [esp + 0x238], eax
jge 0x413daf
mov eax, dword [esp + 0x238]
jmp 0x413db3
push esi
call edi
inc eax
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x413dc2
mov ebx, dword [esp + 0x10]
push esi
call fcn.00452756
cmp byte [ebp], 0
pop ecx
jne 0x4138b2
push ebx
call edi
lea ecx, [eax + 1]
mov eax, dword [esp + 0x238]
cmp eax, ecx
jl 0x413de8
push ebx
call edi
inc eax
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00452dee
add esp, 0x218
ret 0x10