Function at 0x40f3a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x631404
mov eax, dword fs:[0]
push eax
mov eax, 0x1384
call fcn.005c3ef0
mov eax, dword [0x6ce488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1244], ecx
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103b5
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x123c], edi
lea ecx, [ebp - 0x121c]
mov dword [ebp - 4], 0
call fcn.00483510
mov byte [ebp - 4], 1
lea esi, [edi - 0x10]
mov ecx, dword [eax]
or ebx, 0xffffffff
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x40f471
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x40f45c
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x40f45c
push edx
call fcn.00401b80
add esp, 4
mov dword [ebp - 0x1240], eax
mov ecx, ebx
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40f451
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1240]
lea edi, [eax + 0x10]
mov dword [ebp - 0x123c], edi
jmp 0x40f471
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x123c]
call fcn.00401e40
mov edi, dword [ebp - 0x123c]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x121c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f492
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi - 0xc], 0
jne 0x40f7c7
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103bf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x121c], eax
push str.IsWow64Process
mov byte [ebp - 4], 2
push str.kernel32
mov dword [ebp - 0x1240], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40f4f4
lea eax, [ebp - 0x1240]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x1240], 0
lea ecx, [ebp - 0x121c]
je 0x40f50c
push 0x14
push str._ProgramFiles_x86___
jmp 0x40f513
push 0xf
push str._ProgramFiles__
call fcn.00401e40
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.005feb40
add esp, 0xc
lea ecx, [ebp - 0x12b8]
push str.GSoSoftGSoInput_
call fcn.004133d0
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov byte [ebp - 4], 3
cmp dword [edx + 0x14], 8
jb 0x40f559
mov edx, dword [edx]
test edx, edx
jne 0x40f561
xor ecx, ecx
jmp 0x40f575
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f566
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x121c]
call fcn.00417970
lea ecx, [ebp - 0x1238]
mov byte [ebp - 4], 2
call fcn.00402f20
mov esi, dword [ebp - 0x121c]
lea eax, [ebp - 0xa18]
push 0x400
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40f605
lea eax, [ebp - 0xa18]
push eax
push esi
call fcn.00613cfe
add esp, 8
test eax, eax
je 0x40f605
mov ecx, dword [ebp - 0x1244]
lea edx, [ebp - 0xa18]
lea eax, [edx + 2]
mov dword [ebp - 0x1240], eax
lea ecx, [ecx + 0x5b0]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40f5e0
sub edx, dword [ebp - 0x1240]
lea eax, [ebp - 0xa18]
sar edx, 1
push edx
push eax
call fcn.00401e40
jmp 0x40f7a3
lea eax, [ebp - 0xa18]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40f7a3
mov ebx, dword [ebp - 0x1244]
lea ecx, [ebp - 0xa18]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f631
sub ecx, edx
lea eax, [ebp - 0xa18]
sar ecx, 1
push ecx
push eax
lea ecx, [ebx + 0x5b0]
call fcn.00401e40
mov ecx, dword [ebx + 0x5b0]
mov ebx, dword [ecx - 0xc]
cmp ebx, 1
jg 0x40f672
lea eax, [ecx - 0x10]
push eax
call fcn.00401b80
add esp, 4
add eax, 0x10
jmp 0x40f6b5
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x40f682
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40f68e
call fcn.004021b0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [ebp - 0x1244]
lea ecx, [ebp - 0x1240]
push 1
mov eax, dword [eax + 0x5b0]
lea eax, [eax + ebx*2]
add eax, 0xfffffffe
push eax
call fcn.00416690
mov eax, dword [ebp - 0x1240]
mov edx, 0x6a2f8c
mov ecx, eax
nop dword [eax]
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x40f6ee
test bx, bx
je 0x40f6e2
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x40f6ee
add ecx, 4
add edx, 4
test bx, bx
jne 0x40f6c0
mov dword [ebp - 0x1240], 0
jmp 0x40f6f9
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x1240], ecx
or ebx, 0xffffffff
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f713
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x1240], 0
je 0x40f734
mov ecx, dword [ebp - 0x1244]
push 1
push 0x6a2f8c
lea ecx, [ecx + 0x5b0]
call fcn.00417970
push str.GSoSoftGSoInput_
lea ecx, [ebp - 0x12b8]
call fcn.004133d0
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov byte [ebp - 4], 4
cmp dword [edx + 0x14], 8
jb 0x40f75f
mov edx, dword [edx]
test edx, edx
jne 0x40f767
xor ecx, ecx
jmp 0x40f785
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1240], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f772
sub ecx, dword [ebp - 0x1240]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1244]
push edx
lea ecx, [ecx + 0x5b0]
call fcn.00417970
lea ecx, [ebp - 0x1238]
call fcn.00402f20
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40f8bb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40f8bb
mov edx, dword [ebp - 0x1244]
lea eax, [edi - 0x10]
mov ecx, dword [edx + 0x5b0]
lea esi, [ecx - 0x10]
cmp eax, esi
je 0x40f843
cmp dword [esi + 0xc], 0
jl 0x40f828
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x40f828
lea eax, [edi - 0x10]
push eax
call fcn.00401b80
add esp, 4
mov dword [ebp - 0x1240], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f817
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1240]
mov edx, dword [ebp - 0x1244]
lea ecx, [eax + 0x10]
mov dword [edx + 0x5b0], ecx
jmp 0x40f843
push dword [edi - 0xc]
lea ecx, [edx + 0x5b0]
push edi
call fcn.00401e40
mov edx, dword [ebp - 0x1244]
mov ecx, dword [edx + 0x5b0]
mov edx, dword [ebp - 0x1244]
lea eax, [ecx - 0x10]
mov dword [ebp - 0x1240], eax
mov esi, dword [edx + 0x5b4]
sub esi, 0x10
cmp eax, esi
je 0x40f8bb
cmp dword [esi + 0xc], 0
jl 0x40f8ac
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x40f8ac
push dword [ebp - 0x1240]
call fcn.00401b80
mov dword [ebp - 0x1240], eax
add esp, 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40f895
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x1244]
mov eax, dword [ebp - 0x1240]
add eax, 0x10
mov dword [ecx + 0x5b4], eax
jmp 0x40f8bb
push dword [ecx - 0xc]
push ecx
lea ecx, [edx + 0x5b4]
call fcn.00401e40
mov eax, dword [ebp - 0x1244]
mov eax, dword [eax + 0x5b4]
cmp dword [eax - 0xc], 0
jne 0x40fb80
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103c9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x121c], eax
push 0x6a0b0c
lea ecx, [ebp - 0x121c]
mov byte [ebp - 4], 5
call fcn.00417800
test al, al
jne 0x40f918
push 9
push 0x6a0b0c
lea ecx, [ebp - 0x121c]
call fcn.00401e40
push ecx
lea ecx, [ebp - 0x1390]
mov byte [ebp - 4], 6
call fcn.00413c90
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov edx, eax
mov byte [ebp - 4], 7
cmp dword [edx + 0x14], 8
jb 0x40f943
mov edx, dword [edx]
test edx, edx
jne 0x40f94b
xor ecx, ecx
jmp 0x40f95f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f950
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x121c]
call fcn.00417970
lea ecx, [ebp - 0x1238]
call fcn.00402f20
xorps xmm0, xmm0
mov dword [ebp - 0x1224], 0
movq qword [ebp - 0x122c], xmm0
mov dword [ebp - 0x122c], 0
mov dword [ebp - 0x1228], 0
mov dword [ebp - 0x1224], 0
push 0x2001f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x122c]
mov esi, dword [ebp - 0x121c]
push esi
push reloc.WS2_32.dll_bind
call fcn.00416a30
test eax, eax
jne 0x40fb54
push str.AppPath
lea ecx, [ebp - 0x12e0]
mov dword [ebp - 0x1240], 0x400
call fcn.00413d50
lea ecx, [ebp - 0x1268]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
mov byte [ebp - 4], 9
cmp dword [ebx + 0x14], 8
jb 0x40fa07
mov ebx, dword [ebx]
mov ecx, dword [ebp - 0x1244]
lea eax, [ebp - 0x1240]
push eax
push 0x400
lea ecx, [ecx + 0x5b4]
call fcn.00401b30
push eax
push ebx
lea ecx, [ebp - 0x122c]
call fcn.00416710
lea ecx, [ebp - 0x1268]
mov byte [ebp - 4], 8
call fcn.00402f20
mov ebx, dword [ebp - 0x1244]
push ecx
lea ecx, [ebx + 0x5b4]
call fcn.00401af0
mov eax, dword [ebp - 0x122c]
test eax, eax
je 0x40fa6b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x122c], eax
mov eax, dword [ebx + 0x5b4]
mov dword [ebp - 0x1228], 0
mov ebx, dword [eax - 0xc]
cmp ebx, 1
jg 0x40fa94
add eax, 0xfffffff0
push eax
call fcn.00401b80
add esp, 4
add eax, 0x10
jmp 0x40fad7
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x40faa4
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x40fab0
call fcn.004021b0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x1244]
push eax
push 1
mov eax, dword [ecx + 0x5b4]
lea ecx, [ebp - 0x1240]
lea eax, [eax + ebx*2]
add eax, 0xfffffffe
push eax
call fcn.00416690
mov eax, dword [ebp - 0x1240]
mov edx, 0x6a2f8c
mov ecx, eax
nop
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x40fb0e
test bx, bx
je 0x40fb02
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x40fb0e
add ecx, 4
add edx, 4
test bx, bx
jne 0x40fae0
mov dword [ebp - 0x1240], 0
jmp 0x40fb19
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x1240], ecx
or ebx, 0xffffffff
lea edx, [eax - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fb33
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x1240], 0
je 0x40fb54
mov ecx, dword [ebp - 0x1244]
push 1
push 0x6a2f8c
lea ecx, [ecx + 0x5b4]
call fcn.00417970
mov eax, dword [ebp - 0x122c]
test eax, eax
je 0x40fb65
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40fb80
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push str.GSoInput
lea ecx, [ebp - 0x12e4]
mov dword [ebp - 0x1220], 0
call fcn.00413540
lea ecx, [ebp - 0x1268]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov esi, eax
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0xa
call fcn.004830f0
mov byte [ebp - 4], 0xb
cmp dword [esi + 0x14], 8
jb 0x40fbc4
mov esi, dword [esi]
push esi
mov edx, eax
lea ecx, [ebp - 0x1220]
call fcn.00411d40
add esp, 4
mov byte [ebp - 4], 0xd
mov eax, ebx
mov edx, dword [ebp - 0x1250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fbf6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1268]
mov byte [ebp - 4], 0xe
call fcn.00402f20
push 1
push 0x6a2f8c
lea ecx, [ebp - 0x1220]
call fcn.00417970
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103d3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x121c], eax
push str.AppData
lea ecx, [ebp - 0x121c]
mov byte [ebp - 4], 0xf
call fcn.00417800
test al, al
jne 0x40fc5e
push 9
push str.AppData
lea ecx, [ebp - 0x121c]
call fcn.00401e40
mov eax, dword [ebp - 0x1244]
lea ecx, [ebp - 0x121c]
push ecx
mov byte [ebp - 4], 0x10
lea ecx, [eax + 0x620]
call fcn.00411a20
mov ecx, dword [ebp - 0x1220]
mov edx, eax
mov dword [ebp - 0x1248], edx
mov esi, dword [edx]
lea eax, [ecx - 0x10]
sub esi, 0x10
mov dword [ebp - 0x1240], eax
cmp eax, esi
je 0x40fcee
cmp dword [esi + 0xc], 0
jl 0x40fce3
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x40fce3
push dword [ebp - 0x1240]
call fcn.00401b80
mov dword [ebp - 0x1240], eax
add esp, 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fcd0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x1248]
mov eax, dword [ebp - 0x1240]
add eax, 0x10
mov dword [ecx], eax
jmp 0x40fcee
push dword [ecx - 0xc]
push ecx
mov ecx, edx
call fcn.00401e40
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x121c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fd0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.GSoInput
lea ecx, [ebp - 0x1294]
call fcn.00413540
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov esi, eax
push 0x800
lea eax, [ebp - 0x1218]
mov byte [ebp - 4], 0x11
push 0
push eax
call fcn.005feb40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [ebp - 0x121c]
mov dword [ebp - 0x121c], 0
push ecx
push eax
call dword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
mov dword [ebp - 0x1248], eax
call fcn.00484a70
test eax, eax
je 0x40fdcb
cmp dword [ebp - 0x1248], 0
je 0x40fd88
mov eax, dword [ebp - 0x121c]
test eax, eax
jne 0x40fd9d
lea ecx, [ebp - 0x121c]
call fcn.00481030
mov eax, dword [ebp - 0x121c]
test eax, eax
je 0x40fde4
lea ecx, [ebp - 0x1218]
push ecx
push 0
push eax
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [ebp - 0x121c]
mov dword [ebp - 0x1248], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1248]
jmp 0x40fde0
lea eax, [ebp - 0x1218]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40fdf1
lea eax, [ebp - 0x1218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103dd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1240], eax
lea eax, [ebp - 0x1218]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x1240]
call fcn.00417800
test al, al
jne 0x40fe53
lea ecx, [ebp - 0x1218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fe31
sub ecx, edx
lea eax, [ebp - 0x1218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1240]
call fcn.00401e40
mov byte [ebp - 4], 0x13
cmp dword [esi + 0x14], 8
jb 0x40fe5f
mov esi, dword [esi]
push esi
lea edx, [ebp - 0x1240]
lea ecx, [ebp - 0x124c]
call fcn.00411d40
add esp, 4
mov byte [ebp - 4], 0x14
mov ecx, dword [eax]
mov esi, dword [ebp - 0x1220]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x40fedb
cmp dword [esi + 0xc], 0
jl 0x40fecc
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x40fecc
push edx
call fcn.00401b80
add esp, 4
mov dword [ebp - 0x1248], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40fec1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1248]
add eax, 0x10
mov dword [ebp - 0x1220], eax
jmp 0x40fedb
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x1220]
call fcn.00401e40
mov byte [ebp - 4], 0x13
mov eax, ebx
mov edx, dword [ebp - 0x124c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fefc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov eax, ebx
mov edx, dword [ebp - 0x1240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ff1d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1238]
mov byte [ebp - 4], 0xe
call fcn.00402f20
push 1
push 0x6a2f8c
lea ecx, [ebp - 0x1220]
call fcn.00417970
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103e7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1240], eax
push str.LocalAppData
lea ecx, [ebp - 0x1240]
mov byte [ebp - 4], 0x15
call fcn.00417800
test al, al
jne 0x40ff85
push 0xe
push str.LocalAppData
lea ecx, [ebp - 0x1240]
call fcn.00401e40
mov ecx, dword [ebp - 0x1244]
lea eax, [ebp - 0x1240]
push eax
mov byte [ebp - 4], 0x16
lea ecx, [ecx + 0x620]
call fcn.00411a20
mov ecx, dword [ebp - 0x1220]
mov edx, eax
mov dword [ebp - 0x1248], edx
mov esi, dword [edx]
lea eax, [ecx - 0x10]
sub esi, 0x10
mov dword [ebp - 0x124c], eax
cmp eax, esi
je 0x410015
cmp dword [esi + 0xc], 0
jl 0x41000a
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x41000a
push dword [ebp - 0x124c]
call fcn.00401b80
mov dword [ebp - 0x124c], eax
add esp, 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40fff7
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x1248]
mov eax, dword [ebp - 0x124c]
add eax, 0x10
mov dword [ecx], eax
jmp 0x410015
push dword [ecx - 0xc]
push ecx
mov ecx, edx
call fcn.00401e40
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x1240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410036
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.GSoInput
lea ecx, [ebp - 0x1294]
call fcn.00413540
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov esi, eax
lea ecx, [ebp - 0x1240]
mov byte [ebp - 4], 0x17
call fcn.00483260
mov byte [ebp - 4], 0x18
cmp dword [esi + 0x14], 8
jb 0x410070
mov esi, dword [esi]
push esi
mov edx, eax
lea ecx, [ebp - 0x1248]
call fcn.00411d40
add esp, 4
mov byte [ebp - 4], 0x19
mov ecx, dword [eax]
mov esi, dword [ebp - 0x1220]
add esi, 0xfffffff0
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x4100e8
cmp dword [esi + 0xc], 0
jl 0x4100d9
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x4100d9
push edx
call fcn.00401b80
add esp, 4
mov dword [ebp - 0x124c], eax
mov ecx, ebx
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4100ce
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x124c]
add eax, 0x10
mov dword [ebp - 0x1220], eax
jmp 0x4100e8
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x1220]
call fcn.00401e40
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0x1248]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410109
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x17
mov eax, ebx
mov edx, dword [ebp - 0x1240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41012a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1238]
mov byte [ebp - 4], 0xe
call fcn.00402f20
push 1
push 0x6a2f8c
lea ecx, [ebp - 0x1220]
call fcn.00417970
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x4103f1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1240], eax
push str.LocalLowAppData
lea ecx, [ebp - 0x1240]
mov byte [ebp - 4], 0x1a
call fcn.00417800
test al, al
jne 0x410192
push 0x11
push str.LocalLowAppData
lea ecx, [ebp - 0x1240]
call fcn.00401e40
mov ecx, dword [ebp - 0x1244]
lea eax, [ebp - 0x1240]
push eax
mov byte [ebp - 4], 0x1b
lea ecx, [ecx + 0x620]
call fcn.00411a20
mov ecx, dword [ebp - 0x1220]
mov edx, eax
mov dword [ebp - 0x1248], edx
mov esi, dword [edx]
lea eax, [ecx - 0x10]
sub esi, 0x10
mov dword [ebp - 0x124c], eax
cmp eax, esi
je 0x410222
cmp dword [esi + 0xc], 0
jl 0x410217
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x410217
push dword [ebp - 0x124c]
call fcn.00401b80
mov dword [ebp - 0x124c], eax
add esp, 4
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410204
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x1248]
mov eax, dword [ebp - 0x124c]
add eax, 0x10
mov dword [ecx], eax
jmp 0x410222
push dword [ecx - 0xc]
push ecx
mov ecx, edx
call fcn.00401e40
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x1240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410243
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005feb40
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.System32_
lea ecx, [ebp - 0x1298]
call fcn.00402a00
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
cmp dword [eax + 0x14], 8
jb 0x41029d
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x1238]
call fcn.00402f20
push str.System32
lea ecx, [ebp - 0x129c]
call fcn.004134e0
lea ecx, [ebp - 0x1238]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov byte [ebp - 4], 0x1c
cmp dword [eax + 0x14], 8
jb 0x4102df
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1240]
call fcn.004178d0
mov ecx, dword [ebp - 0x1244]
lea eax, [ebp - 0x1240]
push eax
mov byte [ebp - 4], 0x1d
lea ecx, [ecx + 0x620]
call fcn.00411a20
lea ecx, [ebp - 0x218]
mov edx, eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410312
sub ecx, esi
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00401e40
mov byte [ebp - 4], 0x1c
mov eax, ebx
mov edx, dword [ebp - 0x1240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410351
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1238]
call fcn.00402f20
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x1220]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41037d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x410399
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c358e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
push 0x80004005
call fcn.00401f90
int3