Function at 0x4033e6
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11ec
call fcn.0040f7d0
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
mov dword [ebp - 0x10], esi
call fcn.00402ad0
mov edi, dword [edi + 0x1c]
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.ControlClass
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4037cc
push 0x1fe
lea eax, [ebp - 0x9e6]
push ebx
push eax
mov word [ebp - 0x9e8], bx
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x9e8]
push eax
push ebx
push dword [ebp - 8]
mov eax, 0xff
mov dword [ebp - 0xc], ebx
call fcn.0040e30c
add esp, 0x18
jmp 0x4037bb
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x9e8]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40379e
push 7
pop ecx
mov word [ebp - 0x34], bx
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
push 0x7fe
stosw word es:[edi], ax
lea eax, [ebp - 0x11e6]
push ebx
push eax
mov word [ebp - 0x11e8], bx
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x7e6]
push ebx
push eax
mov word [ebp - 0x3c8], bx
mov word [ebp - 0x348], bx
mov word [ebp - 0x2c8], bx
mov word [ebp - 0x244], bx
mov dword [ebp - 0x248], ebx
mov word [ebp - 0x7e8], bx
call sub.msvcrt.dll_memset
push 0x41047c
push dword [ebp - 4]
lea esi, [ebp - 0x2c8]
push 0x3f
pop eax
call fcn.0040e222
push str.Class
push dword [ebp - 4]
lea esi, [ebp - 0x348]
push 0x3f
pop eax
call fcn.0040e222
lea eax, [ebp - 0x9e8]
push eax
push 0x3f
pop eax
lea edi, [ebp - 0x3c8]
call fcn.00405bd7
push str.IconPath
push dword [ebp - 4]
mov eax, 0x104
lea esi, [ebp - 0x7e8]
call fcn.0040e222
push str.Icon
push dword [ebp - 4]
lea esi, [ebp - 0x34]
push 0xf
pop eax
call fcn.0040e222
push str.Installer32
push dword [ebp - 4]
mov edi, 0x3ff
mov eax, edi
lea esi, [ebp - 0x11e8]
call fcn.0040e222
add esp, 0x44
cmp word [ebp - 0x11e8], bx
jne 0x403586
push str.EnumPropPages32
push dword [ebp - 4]
mov eax, edi
call fcn.0040e222
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
call sub.msvcrt.dll__wtoi
cmp word [ebp - 0x7e8], bx
pop ecx
mov dword [ebp - 0x248], eax
je 0x4035ec
lea eax, [ebp - 0x7e8]
push 0x2c
push eax
call sub.msvcrt.dll_wcsrchr
cmp eax, ebx
pop ecx
pop ecx
je 0x4035d0
mov word [eax], bx
add eax, 2
push eax
call sub.msvcrt.dll__wtoi
cmp eax, ebx
pop ecx
mov dword [ebp - 0x248], eax
jge 0x4035d0
neg dword [ebp - 0x248]
mov esi, 0x104
push esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4035f1
mov esi, 0x104
push 0x208
lea eax, [ebp - 0x5d6]
push ebx
push eax
mov word [ebp - 0x5d8], bx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp word [0x415688], bx
jne 0x403627
push esi
push 0x415688
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x415894], eax
lea eax, [ebp - 0x5d8]
push 0x415688
push eax
call sub.msvcrt.dll_wcscpy
cmp word [ebp - 0x11e8], bx
pop ecx
pop ecx
je 0x4036dd
cmp word [ebp - 0x244], bx
jne 0x4036e6
lea eax, [ebp - 0x11e8]
push 0x2c
push eax
call sub.msvcrt.dll_wcschr
cmp eax, ebx
pop ecx
pop ecx
je 0x40366b
mov word [eax], bx
lea eax, [ebp - 0x11e8]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x4036c8
lea eax, [ebp - 0x5d8]
push eax
call sub.msvcrt.dll_wcslen
mov edi, eax
lea eax, [ebp - 0x11e8]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [edi + eax + 1]
cmp eax, esi
pop ecx
pop ecx
jae 0x4036bf
lea eax, [ebp - 0x11e8]
push eax
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x244]
call fcn.00405f52
pop ecx
jmp 0x4036dc
mov word [ebp - 0x244], bx
jmp 0x4036dd
lea eax, [ebp - 0x11e8]
push eax
mov eax, esi
lea edi, [ebp - 0x244]
call fcn.00405bd7
pop ecx
cmp word [ebp - 0x244], bx
je 0x4036ee
cmp dword [ebp - 0x248], ebx
jge 0x403740
cmp dword [ebp - 0x248], ebx
jge 0x4036fc
neg dword [ebp - 0x248]
mov esi, str.setupapi.dll
push esi
call sub.msvcrt.dll_wcslen
mov edi, eax
lea eax, [ebp - 0x5d8]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [edi + eax + 1]
cmp eax, 0x104
pop ecx
pop ecx
jae 0x403739
lea eax, [ebp - 0x5d8]
push esi
push eax
lea eax, [ebp - 0x244]
call fcn.00405f52
pop ecx
pop ecx
jmp 0x403740
mov word [ebp - 0x244], bx
mov esi, dword [ebp - 0x10]
mov edi, dword [esi + 0xc]
cmp edi, ebx
mov dword [ebp - 0x14], edi
jl 0x403795
cmp edi, 0xffffffff
mov eax, dword [esi + 8]
jne 0x40375e
push dword [esi]
call sub.msvcrt.dll_free
jmp 0x403774
push eax
mov edx, edi
push 0x390
lea eax, [esi + 4]
mov edi, esi
call fcn.00405c05
mov edi, dword [ebp - 0x14]
pop ecx
lea eax, [edi + 1]
cmp dword [esi + 0xc], eax
pop ecx
jge 0x403780
mov dword [esi + 0xc], eax
imul edi, edi, 0x390
add edi, dword [esi]
mov ecx, 0xe4
lea esi, [ebp - 0x3c8]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
lea eax, [ebp - 0x9e8]
push eax
push dword [ebp - 0xc]
mov eax, 0xff
push dword [ebp - 8]
call fcn.0040e30c
add esp, 0xc
test eax, eax
je 0x40345f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret