Function at 0x4ff6b0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
jne 0x4ff6d4
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x10], 0
je 0x4ff6e4
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
test byte [ebx + 0x18], 0x10
push edi
je 0x4ff9b0
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4ff717
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4ff740
push eax
push 0x1000
push esi
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
add esp, 0x18
push 0x61b25c
push 0x1000
push esi
call fcn.00523192
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4ff792
lea ecx, [ebp - 0x404]
push ecx
push 0x1000
push esi
mov byte [ebp - 5], 0
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
add esp, 0x18
push 0x400
lea edx, [ebp - 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4ff837
lea eax, [ebp - 0x404]
mov byte [ebp - 5], 0
lea edx, [eax + 1]
jmp 0x4ff7c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ff7c0
sub eax, edx
lea ecx, [ebp + eax - 0x405]
lea eax, [ebp - 0x404]
cmp ecx, eax
jb 0x4ff7fe
lea ebx, [ebx]
mov al, byte [ecx]
cmp al, 0x5c
je 0x4ff7fb
cmp al, 0x2f
je 0x4ff7fb
cmp al, 0x3a
je 0x4ff7fb
dec ecx
lea edx, [ebp - 0x404]
cmp ecx, edx
jae 0x4ff7e0
jmp 0x4ff7fe
mov byte [ecx], 0
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ff807
sub eax, edx
je 0x4ff837
lea eax, [ebp - 0x404]
push eax
push 0x1000
push esi
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
add esp, 0x18
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push str._NT_SYMBOL_PATH
call edi
test eax, eax
je 0x4ff87d
lea edx, [ebp - 0x404]
push edx
push 0x1000
push esi
mov byte [ebp - 5], 0
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
add esp, 0x18
push 0x400
lea eax, [ebp - 0x404]
push eax
push str._NT_ALTERNATE_SYMBOL_PATH
call edi
test eax, eax
je 0x4ff8bd
lea ecx, [ebp - 0x404]
push ecx
push 0x1000
push esi
mov byte [ebp - 5], 0
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
add esp, 0x18
push 0x400
lea edx, [ebp - 0x404]
push edx
push str.SYSTEMROOT
call edi
test eax, eax
je 0x4ff935
lea eax, [ebp - 0x404]
push eax
push 0x1000
push esi
mov byte [ebp - 5], 0
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
push str._system32
lea ecx, [ebp - 0x404]
push 0x400
push ecx
call fcn.00523192
lea edx, [ebp - 0x404]
push edx
push 0x1000
push esi
call fcn.00523192
push 0x61b260
push 0x1000
push esi
call fcn.00523192
add esp, 0x3c
test byte [ebx + 0x18], 0x20
je 0x4ff9b0
push 0x400
lea eax, [ebp - 0x404]
push eax
push str.SYSTEMDRIVE
call edi
test eax, eax
je 0x4ff99d
push str.SRV
push 0x1000
push esi
mov byte [ebp - 5], 0
call fcn.00523192
lea ecx, [ebp - 0x404]
push ecx
push 0x1000
push esi
call fcn.00523192
push str.websymbols
push 0x1000
push esi
call fcn.00523192
push str.http:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.00523192
add esp, 0x30
jmp 0x4ff9b0
push str.SRVc:websymbolshttp:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.00523192
add esp, 0xc
mov ecx, dword [ebx + 4]
push esi
call fcn.004fea20
mov edi, eax
test esi, esi
je 0x4ff9c9
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
test edi, edi
jne 0x4ff9f2
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
push edi
push edi
push edi
push str.Error_while_initializing_dbghelp.dll
mov ecx, ebx
call eax
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 4]
push eax
push esi
mov ecx, edi
call fcn.004ff340
test eax, eax
je 0x4ffa17
pop edi
mov eax, 1
pop esi
mov dword [ebx + 0x10], eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov ecx, edi
call fcn.004ff470
test eax, eax
je 0x4ffa2a
mov dword [ebx + 0x10], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret