Function at 0x410180
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4323fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x15c]
push ebp
push esi
xor esi, esi
cmp ebx, esi
mov dword [esp + 0x2c], esi
je 0x4101b6
mov ecx, ebx
call fcn.0040b440
mov ecx, dword [esp + 0x168]
cmp ecx, esi
je 0x4101c6
call fcn.0040b440
mov ebp, dword [esp + 0x16c]
cmp ebp, esi
je 0x4101d8
mov ecx, ebp
call fcn.0040b440
mov eax, dword [esp + 0x160]
cmp eax, esi
je 0x41069e
cmp byte [eax], 0
je 0x41069e
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.0040af60
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x15c], esi
stosb byte es:[edi], al
call fcn.004113a0
add eax, 0xfffffffe
cmp eax, 5
ja case.0x410224.4
jmp dword [eax*4 + 0x4106b8]
lea eax, [esp + 0x50]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp case.0x410224.4
lea ecx, [esp + 0x50]
push 0x104
push ecx
push str._Systemroot_System32DriversEtc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x50]
push edx
call fcn.0040d7d0
add esp, 4
test eax, eax
je 0x410685
lea ecx, [esp + 0x20]
call fcn.0040af50
lea eax, [esp + 0x50]
push str.hosts
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x168], 1
call fcn.0040dfc0
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.0040b220
push eax
call fcn.0040d800
add esp, 4
test eax, eax
je 0x410674
lea ecx, [esp + 0x28]
call fcn.0040af50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 2
call fcn.0040af50
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 3
call fcn.0040af50
push 0x43b6d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x160], 4
call fcn.0040bb90
mov esi, eax
test esi, esi
jl 0x410338
add esi, 3
lea edx, [esp + 0x18]
push esi
push edx
lea ecx, [esp + 0x1c]
call fcn.0040ba90
mov ecx, eax
mov byte [esp + 0x15c], 5
call fcn.0040b220
push eax
lea ecx, [esp + 0x2c]
call fcn.0040b700
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 4
call fcn.0040b520
push esi
lea ecx, [esp + 0x18]
call fcn.0040b0c0
jmp 0x410341
lea ecx, [esp + 0x28]
call fcn.0040b440
push 0x3a
lea ecx, [esp + 0x18]
call fcn.0040b940
push 0x2f
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0040b940
test esi, esi
jg 0x41037d
test eax, eax
jg 0x410385
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
call fcn.0040b680
lea ecx, [esp + 0x2c]
call fcn.0040b440
jmp 0x410412
test eax, eax
jle 0x410389
cmp esi, eax
jl 0x410391
mov esi, eax
jmp 0x410391
test esi, esi
jle 0x410412
test esi, esi
jle 0x410412
lea ecx, [esp + 0x18]
push esi
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040ba90
mov ecx, eax
mov byte [esp + 0x15c], 6
call fcn.0040b220
push eax
lea ecx, [esp + 0x20]
call fcn.0040b700
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 4
call fcn.0040b520
lea ecx, [esp + 0x14]
call fcn.0040b1f0
sub eax, esi
lea edx, [esp + 0x18]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.0040b9e0
mov ecx, eax
mov byte [esp + 0x15c], 7
call fcn.0040b220
push eax
lea ecx, [esp + 0x30]
call fcn.0040b700
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 4
call fcn.0040b520
test ebx, ebx
je 0x410422
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.0040b680
push 0
lea ecx, [esp + 0x24]
call fcn.0040b220
push eax
call fcn.0040ea70
mov edi, eax
add esp, 8
test edi, edi
je 0x41063d
push 0
push 0x43b6b4
push edi
lea ecx, [esp + 0x48]
call fcn.0040f010
lea ecx, [esp + 0x10]
mov byte [esp + 0x15c], 8
call fcn.0040af50
mov byte [esp + 0x15c], 9
mov bl, 0xc
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x40]
call fcn.0040f210
test eax, eax
je 0x410612
push 0x23
lea ecx, [esp + 0x14]
call fcn.0040b940
test eax, eax
jl 0x41049b
push eax
lea ecx, [esp + 0x14]
call fcn.0040b900
push 0x43b6d8
lea ecx, [esp + 0x14]
call fcn.0040c060
lea ecx, [esp + 0x10]
call fcn.0040b1f0
test eax, eax
jle 0x410606
xor esi, esi
push esi
lea ecx, [esp + 0x14]
call fcn.0040b290
movsx edx, al
push edx
call fcn.00420a15
add esp, 4
test eax, eax
jne 0x4104e4
push esi
lea ecx, [esp + 0x14]
call fcn.0040b290
cmp al, 0x2e
jne 0x4104e7
inc esi
jmp 0x4104bc
lea eax, [esp + 0x38]
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.0040ba90
mov ecx, eax
mov byte [esp + 0x15c], 0xa
call fcn.0040b220
push eax
lea ecx, [esp + 0x28]
call fcn.0040af60
lea ecx, [esp + 0x38]
mov byte [esp + 0x15c], bl
call fcn.0040b520
push 0x43b6d8
lea ecx, [esp + 0x28]
call fcn.0040c060
lea ecx, [esp + 0x10]
call fcn.0040b1f0
sub eax, esi
lea ecx, [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040b9e0
mov ecx, eax
mov byte [esp + 0x15c], 0xd
call fcn.0040b220
push eax
lea ecx, [esp + 0x1c]
call fcn.0040af60
lea ecx, [esp + 0x34]
mov byte [esp + 0x15c], 0xf
call fcn.0040b520
push 0x43b6d8
lea ecx, [esp + 0x1c]
call fcn.0040c190
lea ecx, [esp + 0x18]
call fcn.0040b220
push eax
lea ecx, [esp + 0x20]
call fcn.0040b270
test eax, eax
jne 0x4105e5
mov ecx, dword [esp + 0x16c]
mov dword [esp + 0x30], 1
test ecx, ecx
je 0x4105b3
lea edx, [esp + 0x24]
push edx
call fcn.0040b680
test ebp, ebp
je 0x4105e5
lea eax, [esp + 0x28]
mov ecx, ebp
push eax
call fcn.0040b680
lea ecx, [esp + 0x24]
call fcn.0040b220
push eax
mov ecx, ebp
call fcn.0040b840
lea ecx, [esp + 0x2c]
call fcn.0040b220
push eax
mov ecx, ebp
call fcn.0040b840
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], bl
call fcn.0040af80
lea ecx, [esp + 0x24]
mov byte [esp + 0x15c], 9
call fcn.0040af80
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41046c
push edi
call fcn.004203d7
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x15c], 8
call fcn.0040af80
lea ecx, [esp + 0x3c]
mov byte [esp + 0x15c], 4
call fcn.0040f070
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 3
call fcn.0040af80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 2
call fcn.0040af80
lea ecx, [esp + 0x28]
mov byte [esp + 0x15c], 1
call fcn.0040af80
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x20]
mov byte [esp + 0x15c], 0
call fcn.0040af80
lea ecx, [esp + 0x14]
mov dword [esp + 0x15c], 0xffffffff
call fcn.0040af80
mov eax, esi
pop edi
jmp 0x4106a0
mov eax, esi
mov ecx, dword [esp + 0x150]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret