Function at 0x4033a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x80cc
mov ebp, esp
push edi
push esi
push ebx
call fcn.004058d0
mov esi, dword [ebp + 0x14]
mov ecx, pe_nt_image_headers32
lea edx, [ebp - 0x98]
mov dword [esp + 8], ecx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp], edx
mov dword [ebp - 0x809c], esi
xor esi, esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 4], esi
mov eax, 0x7fff
lea ecx, [ebp - 0x8098]
mov dword [esp + 8], eax
mov dword [esp], ecx
call sub.msvcrt.dll_memset
cmp byte [edi], 0
je 0x403570
nop
mov dword [esp], edi
mov edx, 0x25
mov dword [esp + 4], edx
call sub.msvcrt.dll_strchr
test eax, eax
mov esi, eax
je 0x40366a
lea ebx, [eax + 1]
mov ecx, 0x25
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x80a0], eax
test eax, eax
je 0x403575
mov dword [esp + 4], edi
mov ecx, dword [ebp + 8]
mov eax, esi
sub eax, edi
mov dword [esp + 8], eax
mov dword [esp], ecx
call sub.msvcrt.dll_strncat
mov dword [esp + 4], ebx
mov edi, dword [ebp - 0x80a0]
lea edx, [ebp - 0x98]
mov dword [esp], edx
mov byte [ebp - 0x98], 0
sub edi, esi
dec edi
mov dword [esp + 8], edi
call sub.msvcrt.dll_strncat
mov eax, dword [ebp + 8]
mov edi, str.EXEDIR
lea esi, [ebp - 0x98]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cld
mov ebx, dword [ebp + 8]
add eax, ebx
mov dword [ebp - 0x80a4], eax
mov ebx, 7
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x403580
cld
mov edi, str.EXEFILE
lea esi, [ebp - 0x98]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
je 0x4035d7
cld
mov edi, 0x4073d6
lea esi, [ebp - 0x98]
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x4035f0
cld
mov edi, str.OLDPWD
lea esi, [ebp - 0x98]
mov ecx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40360e
cld
mov edi, str.JREHOMEDIR
lea esi, [ebp - 0x98]
mov ecx, 0xb
repe cmpsb byte [esi], byte es:[edi]
je 0x403627
mov eax, str.HKEY
lea edx, [ebp - 0x98]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strstr
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x403683
cmp byte [ebp - 0x98], 0
jne 0x403632
mov ecx, dword [ebp - 0x80a4]
mov word [ecx], 0x25
lea esi, [esi]
mov eax, dword [0x408090]
test eax, eax
jne 0x4035b0
mov edi, dword [ebp - 0x80a0]
mov esi, dword [ebp - 0x80a0]
inc edi
cmp byte [esi + 1], 0
jne 0x403400
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x809c]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strncat
mov eax, dword [0x408090]
test eax, eax
je 0x403559
lea esi, [esi]
lea edi, [edi]
mov dword [esp], eax
mov edi, dword [ebp - 0x80a4]
lea edx, [ebp - 0x98]
mov dword [esp + 8], edx
mov ecx, str.Substitute:_t_s___s_n
mov dword [esp + 4], ecx
mov dword [esp + 0xc], edi
call sub.msvcrt.dll_fprintf
jmp 0x403559
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x403550
mov dword [esp], 0x104
mov edx, dword [ebp - 0x80a4]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
jmp 0x403550
mov eax, 0x410770
mov dword [esp + 4], eax
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
jmp 0x403550
mov ebx, 0x410664
mov dword [esp + 4], ebx
jmp 0x403617
lea eax, [ebp - 0x8098]
mov edi, 0x7fff
lea edx, [ebp - 0x98]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
je 0x403550
lea esi, [ebp - 0x8098]
mov dword [esp + 4], esi
jmp 0x403617
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, 1
jmp 0x403575
mov dword [esp], ecx
mov esi, dword [ebp - 0x80a4]
mov ebx, 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
call 0x402290
jmp 0x403550