Function at 0x40919a
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor eax, eax
mov dword [ebp - 0x10], edx
push 0x1800
push 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x409431
xor ecx, ecx
push ebx
mov byte [edi], cl
lea ebx, [edi + 0x400]
push esi
mov ecx, edi
call fcn.0048cba0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x5069c8
push edi
call esi
push str.K7OemCfg.dat
push edi
call esi
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00483b70
mov esi, dword [ebp - 0xc]
pop ecx
cmp eax, 1
jne 0x409413
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
xor eax, eax
push eax
push 0x5078e8
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
mov byte [ebx], cl
jmp 0x4093df
cmp byte [ebx], 0
je 0x409404
push 0xd
push str._USERPROFILE_
push ebx
call fcn.004d0ef7
add esp, 0xc
test eax, eax
jne 0x409328
lea ecx, [ebx + 0x400]
mov al, byte [ecx]
test al, al
jne 0x40926b
call fcn.0040aff2
lea ecx, [ebx + 0x400]
mov al, byte [ecx]
mov dword [ebp - 0x1c], ecx
test al, al
je 0x4093c7
mov esi, dword [ebp - 4]
lea eax, [ebx + 0xd]
mov dword [ebp - 0x20], eax
mov ebx, ecx
push eax
push ebx
push 0x507908
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push edi
add ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40930e
and eax, 0x10
xor ecx, ecx
push 0xfa0
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0x10]
push eax
push 0xffffffffffffffff
mov word [eax], cx
xor eax, eax
push edi
push eax
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esi + 0x10]
xor ecx, ecx
cmp word [eax], cx
je 0x40930e
push eax
call fcn.004c96f6
pop ecx
mov ecx, eax
mov dword [esi + 4], 0x4b374558
xor eax, eax
mov dword [esi + 0xc], ecx
cmp eax, dword [ebp - 0x1c]
sbb eax, eax
lea edx, [ecx*2 + 0x12]
and eax, 0xfeffff00
mov dword [esi], edx
add eax, 0x2000107
mov dword [esi + 8], eax
add esi, edx
mov eax, dword [ebp - 0x10]
inc dword [eax]
cmp byte [ebx], 0
mov eax, dword [ebp - 0x20]
jne 0x409281
mov dword [ebp - 4], esi
lea ebx, [edi + 0x400]
jmp 0x4093c4
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x409341
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4093c7
and eax, 0x10
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0xfa0
add eax, 0x10
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x20], eax
mov word [eax], cx
xor eax, eax
push edi
push eax
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp word [eax], cx
je 0x4093c7
push eax
call fcn.004c96f6
mov esi, dword [ebp - 4]
pop ecx
mov ecx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x4b374558
lea edx, [ecx*2 + 0x12]
mov dword [eax], edx
xor eax, eax
cmp eax, dword [ebp - 0x1c]
sbb eax, eax
and eax, 0xfeffff00
add eax, 0x2000107
mov dword [esi + 8], eax
mov eax, esi
mov dword [eax + 0xc], ecx
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
inc dword [eax]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
inc eax
push eax
push 0x5078e8
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov byte [ebx], al
add esp, 0xc
mov dword [ebp - 8], 0x400
mov eax, dword [esi]
lea ecx, [ebp - 8]
push ecx
push ebx
push edi
push str.DynaExclude
mov ecx, esi
call dword [eax + 0x14]
cmp eax, 1
je 0x409231
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ecx], eax
push edi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x40942f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x40]
pop esi
pop ebx
mov eax, dword [ebp - 0x14]
pop edi
leave
ret