Function at 0x411170
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x4b135c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea ecx, [ebp - 0x638]
call fcn.00405d80
mov edi, eax
mov esi, 0x4b29e0
cmp edi, esi
je 0x4111d6
cmp dword [0x4b29f4], 8
jb 0x4111b2
push dword [0x4b29e0]
call fcn.0046f2be
add esp, 4
xor eax, eax
mov dword [0x4b29f4], 7
push edi
mov ecx, esi
mov dword [0x4b29f0], 0
mov word [0x4b29e0], ax
call fcn.004027d0
cmp dword [ebp - 0x624], 8
jb 0x4111ed
push dword [ebp - 0x638]
call fcn.0046f2be
add esp, 4
mov ecx, 0x4b2a10
cmp ecx, 0x4b29e0
je 0x411208
push 0xffffffffffffffff
push 0
push 0x4b29e0
call fcn.00401d50
push 1
push 0x49fa50
mov ecx, esi
call fcn.00402830
push 0x13
push str.SoftwareInpaintMAX
mov ecx, esi
call fcn.00402830
cmp dword [0x4b29f4], 8
mov dword [ebp - 0x624], 7
cmovae esi, dword [0x4b29e0]
xor eax, eax
mov dword [ebp - 0x628], 0
mov word [ebp - 0x638], ax
cmp word [esi], ax
jne 0x411258
xor ecx, ecx
jmp 0x41126f
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411260
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x638]
call fcn.00401b00
cmp dword [ebp - 0x624], 8
lea ecx, [ebp - 0x63c]
push 0
push ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x638]
cmovae eax, dword [ebp - 0x638]
push 0
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4112bf
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x624], 8
jb 0x4112d6
push dword [ebp - 0x638]
call fcn.0046f2be
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.00421df0
add esp, 0xc
lea eax, [ebp - 0x418]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x418], 0
jne 0x411315
xor ecx, ecx
jmp 0x41132f
lea ecx, [ebp - 0x418]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411320
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x418]
mov ecx, 0x4b29c8
push eax
call fcn.00401b00
push 1
push 0x49fa50
mov ecx, 0x4b29c8
call fcn.00402830
push 0xa
push 0x4a0038
mov ecx, 0x4b29c8
call fcn.00402830
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00421df0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x208
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x4a0038
lea eax, [ebp - 0x210]
push eax
push 0x49fb54
push eax
call fcn.00403350
add esp, 0x10
cmp word [ebp - 0x210], 0
jne 0x4113b8
xor ecx, ecx
jmp 0x4113d0
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4113c1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x210]
mov ecx, 0x4b29f8
push eax
call fcn.00401b00
push 0x208
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.00421df0
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x411426
lea eax, [eax*2 - 2]
cmp eax, 0x208
jae 0x411471
xor ecx, ecx
mov word [ebp + eax - 0x620], cx
cmp word [ebp - 0x620], 0
jne 0x411434
xor ecx, ecx
jmp 0x41144f
lea ecx, [ebp - 0x620]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411440
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x620]
mov ecx, 0x4b2a28
push eax
call fcn.00401b00
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041d30f
mov esp, ebp
pop ebp
ret
call fcn.0041dea5
int3