Function at 0x410f10
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebx + 4], 0
jne 0x410f37
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x10], 0
je 0x410f47
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
test byte [ebx + 0x18], 0x10
push edi
je 0x411219
push 0x1000
call fcn.0044063a
mov esi, eax
add esp, 4
test esi, esi
jne 0x410f79
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 0
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x410fa2
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
add esp, 0x18
push 0x46e83c
push 0x1000
push esi
call fcn.004404a3
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x410ff4
lea eax, [ebp - 0x428]
mov byte [ebp - 0x29], 0
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
add esp, 0x18
push 0x400
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4110a0
lea ecx, [ebp - 0x428]
mov byte [ebp - 0x29], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411020
sub ecx, edx
lea eax, [ebp + ecx - 0x429]
lea ecx, [ebp - 0x428]
cmp eax, ecx
jb 0x411061
nop word [eax + eax]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x41105e
cmp cl, 0x2f
je 0x41105e
cmp cl, 0x3a
je 0x41105e
dec eax
lea ecx, [ebp - 0x428]
cmp eax, ecx
jae 0x411040
jmp 0x411061
mov byte [eax], 0
lea ecx, [ebp - 0x428]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411070
sub ecx, edx
je 0x4110a0
lea eax, [ebp - 0x428]
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
add esp, 0x18
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x428]
push 0x400
push eax
push str._NT_SYMBOL_PATH
call edi
test eax, eax
je 0x4110e6
lea eax, [ebp - 0x428]
mov byte [ebp - 0x29], 0
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
add esp, 0x18
push 0x400
lea eax, [ebp - 0x428]
push eax
push str._NT_ALTERNATE_SYMBOL_PATH
call edi
test eax, eax
je 0x411126
lea eax, [ebp - 0x428]
mov byte [ebp - 0x29], 0
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
add esp, 0x18
push 0x400
lea eax, [ebp - 0x428]
push eax
push str.SYSTEMROOT
call edi
test eax, eax
je 0x41119e
lea eax, [ebp - 0x428]
mov byte [ebp - 0x29], 0
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
push str._system32
lea eax, [ebp - 0x428]
push 0x400
push eax
call fcn.004404a3
lea eax, [ebp - 0x428]
push eax
push 0x1000
push esi
call fcn.004404a3
push 0x46e838
push 0x1000
push esi
call fcn.004404a3
add esp, 0x3c
test byte [ebx + 0x18], 0x20
je 0x411219
push 0x400
lea eax, [ebp - 0x428]
push eax
push str.SYSTEMDRIVE
call edi
test eax, eax
je 0x411206
push str.SRV
push 0x1000
push esi
mov byte [ebp - 0x29], 0
call fcn.004404a3
lea eax, [ebp - 0x428]
push eax
push 0x1000
push esi
call fcn.004404a3
push str.websymbols
push 0x1000
push esi
call fcn.004404a3
push str.http:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.004404a3
add esp, 0x30
jmp 0x411219
push str.SRVc:websymbolshttp:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.004404a3
add esp, 0xc
mov ecx, dword [ebx + 4]
push esi
call fcn.004108f0
mov edi, eax
test esi, esi
je 0x411231
push esi
call fcn.0044061d
add esp, 4
test edi, edi
jne 0x411258
mov eax, dword [ebx]
mov ecx, ebx
push edi
push edi
push edi
push str.Error_while_initializing_dbghelp.dll
call dword [eax + 0x10]
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 4]
xor edi, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x46e6d8
mov dword [ebp - 0x24], str.tlhelp32.dll
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x64c], 0x224
nop
push dword [ebp + edi*4 - 0x28]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4112f9
push 0x46e6f8
push esi
call ebx
push str.Module32First
push esi
mov dword [ebp - 4], eax
call ebx
push str.Module32Next
push esi
mov dword [ebp - 8], eax
call ebx
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
test eax, eax
je 0x4112e7
cmp dword [ebp - 8], 0
je 0x4112e7
test ebx, ebx
jne 0x411302
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
mov dword [ebp - 0x10], esi
inc edi
cmp edi, 2
jb 0x4112a0
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x14]
test esi, esi
je 0x41131e
push dword [ebp - 0x20]
push 8
call eax
mov edi, eax
cmp edi, 0xffffffff
jne 0x41133b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.00410130
test eax, eax
je 0x411334
mov dword [ebx + 0x10], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x64c]
mov dword [ebp - 4], 0
push eax
push edi
call dword [ebp - 8]
test eax, eax
je 0x4113a0
mov esi, dword [ebp - 0xc]
xor ebx, ebx
nop word [eax + eax]
push dword [ebp - 0x634]
mov eax, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x1c]
cdq
push edx
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x52c]
push eax
push dword [ebp - 0x18]
call fcn.00410d20
lea eax, [ebp - 0x64c]
inc ebx
push eax
push edi
call esi
test eax, eax
jne 0x411360
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 4], 0
jle 0x41131e
pop edi
mov eax, 1
pop esi
mov dword [ebx + 0x10], eax
pop ebx
mov esp, ebp
pop ebp
ret