Function at 0x442d00
Capabilities:
Check os version
Get common file path
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c4
mov eax, dword [0x487180]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x5b4]
push ecx
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5b4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x442d55
push 0x10
push str.tcsh
push str.GetVersionEx_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x5b0]
cmp eax, 6
mov dword [0x489fc0], eax
jae 0x442d6a
call fcn.00401857
cmp dword [0x4a8998], 0
push esi
push edi
je 0x442e6c
push 1
lea edx, [ebp - 0x5bc]
push edx
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004011e0
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
add esp, 0x10
test eax, eax
je 0x442eb5
cmp dword [ebp - 0x5b8], 0
je 0x443126
mov eax, dword [ebp - 0x5bc]
test eax, eax
je 0x443126
push eax
call edi
mov ecx, dword [ebp - 0x5b8]
push 0xc350
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x443126
cmp dword [0x4a8c10], eax
je 0x443126
mov eax, dword [0x4a8c14]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
add eax, 0xffef0004
push 0x110000
push eax
call esi
test eax, eax
je 0x442eda
push 4
push 0x1000
push 0x110000
push eax
call esi
test eax, eax
je 0x442eda
add eax, 0x110000
mov dword [ebp - 0x5c0], eax
mov esp, dword [ebp - 0x5c0]
push eax
call fcn.00401172
mov edx, dword [ebp - 0x5bc]
add esp, 4
push edx
call edi
mov eax, dword [ebp - 0x5b8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x5bc]
push ecx
call esi
cmp dword [0x4a8998], 0
jne 0x442e71
call fcn.0040189d
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
push 0x104
lea edx, [ebp - 0x520]
push edx
push str.HOME
call esi
test eax, eax
je 0x442f19
cmp eax, 0x104
jge 0x442f19
lea eax, [ebp - 0x520]
push eax
call fcn.00401a78
add esp, 4
lea ecx, [ebp - 0x520]
push ecx
jmp 0x4430ac
cmp dword [0x4a8c10], 0
jne 0x442dea
push 4
push 0x1000
push 0x110000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x442ef0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b8bd
mov esp, ebp
pop ebp
ret
add eax, 0x10fffc
mov dword [ebp - 0x5c0], eax
mov dword [0x4a8c14], eax
mov esp, dword [ebp - 0x5c0]
push eax
call fcn.00401172
add esp, 4
call fcn.0040189d
jmp 0x442e63
push 0x104
lea edx, [ebp - 0x108]
push 0
push edx
call fcn.0044d2e0
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.0044d2e0
push 0x104
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.0044d2e0
mov eax, dword [ebp - 0x5a4]
add esp, 0x24
cmp eax, 2
jne 0x443023
push 0x104
lea edx, [ebp - 0x108]
push edx
push str.USERPROFILE
call esi
push 0x104
lea eax, [ebp - 0x310]
push eax
push str.HOMEDRIVE
call esi
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push str.HOMEPATH
call esi
cmp byte [ebp - 0x108], 0
mov byte [ebp - 0x109], 0
mov byte [ebp - 0x20d], 0
mov byte [ebp - 5], 0
je 0x442fe2
cmp dword [ebp - 0x5b0], 4
jb 0x442fe2
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x41c]
push 0x47bdd8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x443096
cmp byte [ebp - 0x20c], 0
lea ecx, [ebp - 0x20c]
jne 0x442ff6
mov ecx, 0x482254
cmp byte [ebp - 0x310], 0
lea eax, [ebp - 0x310]
jne 0x44300a
mov eax, 0x482250
push ecx
push eax
lea ecx, [ebp - 0x41c]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x443096
cmp eax, 1
jne 0x443082
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jle 0x443060
push 0x10
push str.tcsh
push str.This_should_never_happen
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x108]
push eax
push 0x47bdd8
lea ecx, [ebp - 0x41c]
push 0x109
push ecx
call fcn.0046f0bd
add esp, 0x10
jmp 0x443096
push 0x10
push str.tcsh
push str.Unknown_platform
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea edx, [ebp - 0x41c]
push edx
call fcn.00401a78
add esp, 4
lea eax, [ebp - 0x41c]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.HOME
call ebx
mov ecx, dword [ebp - 0x5a4]
push 0
push 0
push str.Path
mov dword [0x489fd0], ecx
call esi
mov edi, eax
test edi, edi
je 0x443116
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
mov esi, eax
push esi
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push str.Path
call ebx
push esi
push str.PATH
call ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x5c4]
push edx
call fcn.00450cde
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0044b8bd
mov esp, ebp
pop ebp
ret