Function at 0x4031f0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dac8
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5d2fec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x230], 0
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
mov dword [ebp - 0x220], 0
call fcn.00405fc0
mov ecx, eax
call fcn.00405f10
push eax
lea ecx, [ebp - 0x220]
call fcn.004069a0
push 0x5af8ec
push 0x5af3f0
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 1
call fcn.00405cb0
mov eax, dword [ebp - 0x220]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x403295
push 0x80070057
call fcn.00407010
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x4032b8
push esi
lea ecx, [ebp - 0x220]
call fcn.00406e60
mov eax, dword [ebp - 0x220]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.00556e6f
mov eax, dword [ebp - 0x220]
add esp, 8
cmp esi, dword [eax - 8]
jg 0x40328b
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x220]
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], ecx
jge 0x4032ef
or edi, 0xffffffff
jmp 0x403312
push str..exe
push eax
call fcn.00550fb4
mov edi, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test edi, edi
jne 0x40330e
or edi, 0xffffffff
jmp 0x403312
sub edi, eax
sar edi, 1
cmp dword [eax - 0xc], 0
jge 0x40331d
or ebx, 0xffffffff
jmp 0x403340
push 0x5af3f4
push eax
call fcn.00550fb4
mov ebx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ebx, ebx
jne 0x40333c
or ebx, 0xffffffff
jmp 0x403340
sub ebx, eax
sar ebx, 1
cmp dword [eax - 0xc], 0
jge 0x403352
mov dword [ebp - 0x228], 0xffffffff
jmp 0x403382
push str..ocx
push eax
call fcn.00550fb4
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
jne 0x403378
mov dword [ebp - 0x228], 0xffffffff
jmp 0x403382
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x228], ecx
cmp dword [eax - 0xc], 0
jge 0x403394
mov dword [ebp - 0x224], 0xffffffff
jmp 0x4033c4
push str..scr
push eax
call fcn.00550fb4
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x220]
test ecx, ecx
jne 0x4033ba
mov dword [ebp - 0x224], 0xffffffff
jmp 0x4033c4
sub ecx, eax
sar ecx, 1
mov dword [ebp - 0x224], ecx
cmp dword [eax - 0xc], 0
jge 0x4033cf
or eax, 0xffffffff
jmp 0x4033ee
push str..ime
push eax
call fcn.00550fb4
add esp, 8
test eax, eax
jne 0x4033e6
or eax, 0xffffffff
jmp 0x4033ee
sub eax, dword [ebp - 0x220]
sar eax, 1
or esi, 0xffffffff
test edi, edi
jle 0x403411
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.00405b70
mov byte [ebp - 4], 2
jmp 0x40347b
test ebx, ebx
jle 0x403431
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.00405b70
mov byte [ebp - 4], 3
jmp 0x40347b
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jle 0x403457
lea eax, [ecx + 4]
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.00405b70
mov byte [ebp - 4], 4
jmp 0x40347b
mov ecx, dword [ebp - 0x224]
test ecx, ecx
jle 0x4034aa
lea eax, [ecx + 4]
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.00405b70
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x220]
call fcn.00406cf0
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4034e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4034e7
test eax, eax
jle 0x4038ee
add eax, 4
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00405b70
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 6
call fcn.00406cf0
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.004070b0
sub esp, 8
lea ecx, [ebp - 0x220]
call fcn.00405fc0
mov ecx, eax
call fcn.00405f10
mov eax, dword [ebp - 0x220]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp dword [eax - 0xc], 0
jl 0x4037e9
push str._programfiles_
push eax
call fcn.00550fb4
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40363e
mov eax, dword [ebp - 0x220]
sub ecx, eax
sar ecx, 1
jne 0x403644
push 0xf
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 8]
call fcn.00405be0
push eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 7
push str.C:Program_Files__x86__
push eax
call fcn.00406490
add esp, 0xc
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 8
call fcn.00406cf0
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403595
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4035b6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x220]
call edi
test eax, eax
jne 0x40363e
push 0xf
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 8]
call fcn.00405be0
push eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 9
push str.C:Program_Files_
push eax
call fcn.00406490
add esp, 0xc
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xa
call fcn.00406cf0
mov byte [ebp - 4], 9
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40361d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40363e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], 0
jl 0x4037e9
push str._commonprogramfiles_
push eax
call fcn.00550fb4
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x40377a
mov eax, dword [ebp - 0x220]
sub ecx, eax
sar ecx, 1
jne 0x403780
push 0x15
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 8]
call fcn.00405be0
push eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xb
push str.C:Program_Files__x86_Common_Files_
push eax
call fcn.00406490
add esp, 0xc
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xc
call fcn.00406cf0
mov byte [ebp - 4], 0xb
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4036d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4036f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x220]
call edi
test eax, eax
jne 0x40377a
push 0x15
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp + 8]
call fcn.00405be0
push eax
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 0xd
push str.C:Program_FilesCommon_Files_
push eax
call fcn.00406490
add esp, 0xc
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xe
call fcn.00406cf0
mov byte [ebp - 4], 0xd
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403759
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40377a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], 0
jl 0x4037e9
push 0x5af8ec
push eax
call fcn.00550fb4
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x4037e9
mov eax, dword [ebp - 0x220]
sub ecx, eax
sar ecx, 1
js 0x4037e9
push 0x20a
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4037c2
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x220]
call fcn.00406bd0
jmp 0x403896
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp + 8]
call fcn.00406cf0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x224]
push str.C:WindowsSystem32_
push eax
call fcn.00406490
add esp, 0xc
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xf
call fcn.00406cf0
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403841
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x220]
call edi
test eax, eax
jne 0x403896
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x224]
push str.C:WindowsSysWOW64_
push eax
call fcn.00406490
add esp, 0xc
push eax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0x10
call fcn.00406cf0
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x403896
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x22c]
lea eax, [ebp - 0x220]
push eax
mov ecx, edi
call fcn.004069a0
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4038cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4038ea
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
jmp 0x403916
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp + 8]
push eax
call fcn.004069a0
lea ecx, [ebp - 0x220]
call fcn.004070b0
lea ecx, [ebp + 8]
call fcn.004070b0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054e73a
mov esp, ebp
pop ebp
ret