Function at 0x4e37d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
cmp dword [ebp + 8], 0
jne 0x4e3807
cmp dword [ebp + 0xc], 0
je 0x4e3807
cmp dword [ebp + 0xc], 0xffffffff
je 0x4e3807
call fcn.004e4120
mov dword [ebp + 8], eax
mov eax, fcn.004022b6
cmp eax, fcn.004022b6
je 0x4e3886
push 0x819a60
call fcn.00401389
add esp, 4
test eax, eax
jne 0x4e382d
cmp dword [0x819618], 0
je 0x4e3881
push 0x104
push 0
push 0x819a60
call fcn.005b02a0
add esp, 0xc
mov dword [0x819618], 0
push 0
push 0
call fcn.004022b6
add esp, 8
push eax
push str._sPAULA_
push 0x104
push 0x819a60
call fcn.00402dc9
add esp, 0x10
push 0x819a60
call fcn.005b4690
add esp, 4
mov dword [0x819724], eax
jmp 0x4e3982
push 0x819a60
call fcn.00401389
add esp, 4
test eax, eax
jne 0x4e38a4
cmp dword [0x819618], 0
je 0x4e3982
push 0x104
push 0
push 0x819a60
call fcn.005b02a0
add esp, 0xc
mov dword [0x819618], 0
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4e393e
push 0x104
lea edx, [ebp - 0x110]
push edx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4e393e
push 0x104
lea eax, [ebp - 0x110]
push eax
push str.ProgramData
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4e393e
push 0x6ad4e0
push str.:5:GetPaulaInstallationDir___EAP:_GetEnvironmentVariable__ProgramData___FAILED:__s
call fcn.004018ca
add esp, 8
push 0x104
push str.C:ProgramData
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402725
add esp, 0xc
push 0x6ad554
lea edx, [ebp - 0x110]
push edx
call fcn.005b4730
add esp, 8
lea eax, [ebp - 0x110]
push eax
push str._sBETTY_
push 0x104
push 0x819a60
call fcn.00402dc9
add esp, 0x10
push 0x819a60
call fcn.005b4690
add esp, 4
mov dword [0x819724], eax
push 0x104
push 0x819a60
push 0x819b68
call fcn.00402725
add esp, 0xc
mov ecx, dword [0x819724]
push ecx
push 0x819a60
push 0x819c70
call fcn.00402725
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x4e39e5
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4e39c8
mov eax, 0x819c70
jmp 0x4e3a9c
cmp dword [ebp + 0xc], 0
je 0x4e39db
push str.:8:GetPaulaInstallationDir___was_called_with_an_INVALID_pszAppend___
call fcn.00401014
add esp, 4
mov eax, 0x819b68
jmp 0x4e3a9c
cmp dword [ebp + 0xc], 0xffffffff
jne 0x4e3a14
push 0x819c70
mov edx, dword [ebp + 8]
push edx
call fcn.005b4720
add esp, 8
push 0x819c70
call fcn.005b4690
add esp, 4
mov dword [ebp - 0x114], eax
jmp 0x4e3a99
push 0x819b68
mov eax, dword [ebp + 8]
push eax
call fcn.005b4720
add esp, 8
push 0x819b68
call fcn.005b4690
add esp, 4
mov dword [ebp - 0x114], eax
cmp dword [ebp + 0xc], 0
je 0x4e3a99
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, 0x104
sub ecx, dword [ebp - 0x114]
push ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x114]
push edx
call fcn.005b8260
add esp, 0x10
test eax, eax
jge 0x4e3a8f
mov eax, dword [ebp + 0xc]
push eax
push str.:8:GetPaulaInstallationDir___EAP:_MAX_PATH_has_been_exceeded:___s_
call fcn.00401014
add esp, 8
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x103], 0
mov dword [ebp - 0x118], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret