Function at 0x402a00
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf5c
mov eax, dword [0x4060a4]
xor eax, esp
mov dword [esp + 0xf58], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ecx
push ecx
xor eax, eax
mov dword [esp + 0x30], edi
inc ebx
mov dword [esp + 0x14], esi
push ebx
push ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], ecx
mov word [0x406e60], ax
mov word [0x406c50], ax
mov word [0x406638], ax
mov word [0x406430], ax
mov byte [esp + 0x2b], cl
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
xor eax, eax
push eax
push eax
push 0x100
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_SetThreadPreferredUILanguages]
xor ecx, ecx
mov dword [0x407068], 0x407090
xor eax, eax
mov dword [0x407078], ecx
mov byte [0x407080], bl
mov byte [0x407081], cl
mov word [0x407082], ax
mov dword [0x407084], ecx
mov dword [0x4070a0], ecx
mov dword [0x407090], ecx
mov byte [0x4070a8], bl
mov byte [0x4070a9], cl
mov word [0x4070aa], ax
mov dword [0x4070ac], ecx
mov dword [0x4070b8], 0x4021e4
mov dword [0x4070bc], 0x4021d4
mov dword [0x40600c], 0x407068
call fcn.0040296a
xor eax, eax
push 0x401ff4
push eax
call dword [sym.imp.msvcrt.dll_setlocale]
add esp, 4
lea edx, [esp + 0x64]
xor eax, eax
mov dword [esp + 0x34], eax
call fcn.004039fd
test eax, eax
je 0x402b24
lea eax, [esp + 0x60]
push eax
xor eax, eax
push 0x22
push eax
call fcn.0040379e
add esp, 0xc
jmp 0x402b30
xor eax, eax
push 0x23
push eax
call fcn.0040379e
pop ecx
pop ecx
xor eax, eax
push 0x24
push eax
call fcn.0040379e
pop ecx
pop ecx
cmp edi, 2
jl 0x403680
xor eax, eax
push 0x618
push eax
mov word [esp + 0x540], ax
mov word [esp + 0xd60], ax
mov word [esp + 0x338], ax
mov word [esp + 0x130], ax
lea eax, [esp + 0x748]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x10], 8
xor eax, eax
mov dword [esp + 0x24], ebx
mov byte [esp + 0x19], al
mov edi, ebx
mov byte [esp + 0x1a], al
push 0x2d
pop edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push 0x2f
dec eax
mov dword [esp + 0x38], edx
pop ecx
mov dword [esp + 0x38], ecx
cmp eax, ebx
jle 0x403253
mov eax, dword [esi + edi*4]
lea esi, [eax + 2]
movzx eax, word [eax]
cmp ax, dx
je 0x402bcf
cmp ax, cx
jne 0x403680
mov edx, 0x402018
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402be8
or dword [esp + 0x10], ebx
jmp 0x403187
mov edx, 0x402024
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402c02
or dword [esp + 0x10], 2
jmp 0x403187
push 3
mov edx, 0x40203c
mov ecx, esi
call fcn.0040286d
test eax, eax
jne 0x402c51
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x2c]
jne 0x402c19
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x403680
push ecx
lea eax, [esi + 6]
mov dword [esp + 0x40], ebx
push eax
push ecx
mov edx, 0x104
mov ecx, 0x406430
call fcn.00402780
jmp 0x403187
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x4c
jne 0x402c86
push 0x3a
pop eax
cmp word [esi + 2], ax
jne 0x402c86
lea eax, [esi + 4]
mov dword [esp + 0x44], ebx
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
movzx eax, ax
pop ecx
mov dword [esp + 0x40], eax
jmp 0x403187
mov edx, 0x402044
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402cbd
push 2
push eax
push 0x40204c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
test eax, eax
je 0x403244
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
or dword [esp + 0x10], 4
jmp 0x403187
mov edx, 0x402068
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402cd6
or dword [esp + 0x14], ebx
jmp 0x403187
mov edx, 0x40208c
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402cf0
or dword [esp + 0x14], 2
jmp 0x403187
mov edx, 0x4020b0
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402d0a
or dword [esp + 0x14], 0x20
jmp 0x403187
mov edx, 0x4020d4
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402d24
or dword [esp + 0x14], 0x40
jmp 0x403187
mov edx, 0x4020f8
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402d47
cmp dword [esp + 0x1c], eax
jne 0x403680
mov dword [esp + 0x1c], ebx
jmp 0x403187
mov edx, 0x402120
mov ecx, esi
call fcn.00402828
test eax, eax
jne 0x402d6e
cmp dword [esp + 0x1c], eax
jne 0x403680
mov dword [esp + 0x1c], 2
jmp 0x403187
push 0xa
mov edx, 0x402148
mov ecx, esi
call fcn.0040286d
mov ecx, esi
test eax, eax
jne 0x402e58
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x402d8b
sub ecx, edx
sar ecx, 1
cmp ecx, 0xa
jbe 0x403680
push 0x402160
mov edx, 0x30c
lea ecx, [esp + 0x744]
call fcn.00402717
mov edi, eax
test edi, edi
jns 0x402df9
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push edi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x402df9
test byte [eax + 0x1c], bl
je 0x402df9
cmp byte [eax + 0x19], 2
jb 0x402df9
push edi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.004028c5
lea eax, [esi + 0x14]
mov edx, 0x30c
push eax
lea ecx, [esp + 0x744]
call fcn.00402717
mov esi, eax
test esi, esi
jns 0x40301e
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x40301e
test byte [eax + 0x1c], bl
je 0x40301e
cmp byte [eax + 0x19], 2
jb 0x40301e
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
jmp 0x403013
push 4
mov edx, 0x402168
call fcn.0040286d
mov ecx, esi
test eax, eax
jne 0x402f40
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x402e73
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x403680
push 0x402174
mov edx, 0x30c
lea ecx, [esp + 0x744]
call fcn.00402717
mov edi, eax
test edi, edi
jns 0x402ee1
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push edi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x402ee1
test byte [eax + 0x1c], bl
je 0x402ee1
cmp byte [eax + 0x19], 2
jb 0x402ee1
push edi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.004028c5
lea eax, [esi + 8]
mov edx, 0x30c
push eax
lea ecx, [esp + 0x744]
call fcn.00402717
mov esi, eax
test esi, esi
jns 0x40301e
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x40301e
test byte [eax + 0x1c], bl
je 0x40301e
cmp byte [eax + 0x19], 2
jb 0x40301e
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xd
jmp 0x403013
push 4
mov edx, 0x40217c
call fcn.0040286d
test eax, eax
jne 0x40302c
mov ecx, esi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x402f5b
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x403680
push 0x402188
mov edx, 0x30c
lea ecx, [esp + 0x744]
call fcn.00402717
mov edi, eax
test edi, edi
jns 0x402fc9
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push edi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x402fc9
test byte [eax + 0x1c], bl
je 0x402fc9
cmp byte [eax + 0x19], 2
jb 0x402fc9
push edi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.004028c5
lea eax, [esi + 8]
mov edx, 0x30c
push eax
lea ecx, [esp + 0x744]
call fcn.00402717
mov esi, eax
test esi, esi
jns 0x40301e
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x40301e
test byte [eax + 0x1c], bl
je 0x40301e
cmp byte [eax + 0x19], 2
jb 0x40301e
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
mov edx, 0x4021c4
pop ecx
call fcn.004028c5
or dword [esp + 0x10], 0x20
mov edi, dword [esp + 0x24]
jmp 0x403187
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x43
jne 0x403069
push 0x3a
pop eax
cmp word [esi + 2], ax
jne 0x403069
cmp dword [esp + 0x14], 0
jne 0x403680
lea eax, [esi + 4]
mov byte [esp + 0x19], bl
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [esp + 0x14], eax
jmp 0x403187
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x49
jne 0x4030a6
push 0x3a
pop eax
cmp word [esi + 2], ax
jne 0x4030a6
cmp dword [esp + 0x1c], 0
jne 0x403680
lea eax, [esi + 4]
mov byte [esp + 0x1a], bl
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [esp + 0x1c], eax
jmp 0x403187
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x4e
jne 0x4030c3
lea edx, [esp + 0x128]
jmp 0x403212
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x42
jne 0x403190
mov esi, dword [esp + 0xc]
mov esi, dword [esi + edi*4]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x2c]
jne 0x4030e4
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x403680
push 0x3a
pop eax
cmp word [esi + 4], ax
jne 0x403680
lea ecx, [esp + 0x740]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x2c]
jne 0x403115
sub ecx, edx
sar ecx, 1
jne 0x403680
push ecx
lea eax, [esi + 6]
mov edx, 0x30c
push eax
push ecx
lea ecx, [esp + 0x74c]
call fcn.00402780
mov esi, eax
test esi, esi
jns 0x403183
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x403183
test byte [eax + 0x1c], bl
je 0x403183
cmp byte [eax + 0x19], 2
jb 0x403183
push esi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.004028c5
mov byte [esp + 0x1b], bl
mov esi, dword [esp + 0xc]
jmp 0x403229
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x55
jne 0x4031aa
lea edx, [esp + 0x538]
jmp 0x403212
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x50
jne 0x4031f6
mov esi, dword [esp + 0xc]
push 0x3a
pop edx
mov eax, dword [esi + edi*4]
lea ecx, [eax + 4]
cmp word [ecx], dx
jne 0x4031d5
xor edx, edx
cmp word [eax + 6], dx
je 0x4031e9
lea edx, [esp + 0xd58]
call fcn.00403c4f
test eax, eax
je 0x403685
lea eax, [esp + 0xd58]
mov dword [esp + 0x30], eax
jmp 0x403229
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
pop ecx
cmp ax, 0x41
jne 0x403680
lea edx, [esp + 0x330]
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + edi*4]
add ecx, 4
call fcn.00403c4f
test eax, eax
je 0x403685
mov ecx, dword [esp + 0x28]
inc edi
mov dword [esp + 0x24], edi
lea eax, [ecx - 1]
cmp edi, eax
jge 0x403253
push 0x2f
pop ecx
push 0x2d
pop edx
jmp 0x402bb8
push 0x1e
push ebx
call fcn.0040379e
pop ecx
pop ecx
jmp 0x403685
push ecx
lea eax, [esp + 0x744]
mov edx, 0x30c
push eax
push ecx
mov ecx, 0x406638
call fcn.00402780
mov esi, eax
test esi, esi
jns 0x4032ac
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x4032ac
test byte [eax + 0x1c], bl
je 0x4032ac
cmp byte [eax + 0x19], 2
jb 0x4032ac
push esi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.004028c5
cmp byte [esp + 0x19], 0
jne 0x4032c6
mov edx, dword [esp + 0x14]
mov cl, bl
call fcn.00403cc3
test al, al
je 0x403680
cmp byte [esp + 0x1a], 0
jne 0x4032e2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4032e2
cmp eax, ebx
je 0x4032e2
cmp eax, 2
jne 0x403680
mov edx, dword [esp + 0x10]
xor esi, esi
test dl, 4
je 0x403315
lea ecx, [esp + 0x740]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4032f7
sub ecx, edx
sar ecx, 1
cmp ecx, ebx
jae 0x403311
push 0x1b
jmp 0x403246
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
lfence
mov eax, dword [edi + eax*4 - 4]
movzx ecx, word [eax]
cmp cx, word [esp + 0x34]
je 0x403335
cmp cx, word [esp + 0x38]
jne 0x403346
cmp word [eax + 2], 0x3f
jne 0x403346
cmp word [eax + 4], si
je 0x403680
test dl, 0x20
je 0x403356
cmp byte [esp + 0x1b], 0
jne 0x403680
push ecx
push eax
push ecx
mov edx, 0x104
mov ecx, 0x406e60
call fcn.00402780
mov esi, eax
test esi, esi
jns 0x4033a8
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x4033a8
test byte [eax + 0x1c], bl
je 0x4033a8
cmp byte [eax + 0x19], 2
jb 0x4033a8
push esi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.004028c5
mov eax, dword [esp + 0x28]
push 0x104
mov eax, dword [edi + eax*4 - 4]
mov edi, 0x406c50
push edi
push eax
mov dword [0x4070c0], eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40341f
push ecx
push dword [0x4070c0]
mov edx, 0x105
push ecx
mov ecx, edi
call fcn.00402780
mov esi, eax
test esi, esi
jns 0x40341f
call dword [sym.imp.wbemcomn.dll_GetMemLogObject]
push esi
mov ecx, eax
call dword [sym.imp.wbemcomn.dll_public:_void___thiscall_CMemoryLog::Write_long_int_]
mov eax, dword [0x40600c]
cmp eax, 0x40600c
je 0x40341f
test byte [eax + 0x1c], bl
je 0x40341f
cmp byte [eax + 0x19], 2
jb 0x40341f
push esi
push dword [eax + 0x14]
mov edx, 0x4021c4
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.004028c5
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40343c
push edi
push 0x1d
push ebx
call fcn.0040379e
add esp, 0xc
jmp 0x403685
xor eax, eax
push eax
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
jns 0x40345e
push eax
push 0x26
push ebx
call fcn.0040379e
add esp, 0xc
push 3
pop ebx
jmp 0x403685
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push eax
push eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeSecurity]
lea eax, [esp + 0x20]
xor edi, edi
push eax
push 0x401fe4
push ebx
push edi
push 0x401fd4
mov dword [esp + 0x34], edi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov esi, eax
test esi, esi
je 0x40354d
push 0x208
call fcn.00403eae
mov edi, eax
pop ecx
test edi, edi
je 0x403532
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0x403526
push 0x402190
mov edx, 0x104
mov ecx, edi
call fcn.00402717
xor eax, eax
push eax
push eax
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov dword [esp + 0x34], eax
test eax, eax
je 0x403526
push 0x4021b0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esp + 0x38], eax
test eax, eax
je 0x40351c
mov ecx, eax
call dword [0x408198]
call dword [esp + 0x38]
lea eax, [esp + 0x20]
push eax
push 0x401fe4
push ebx
xor eax, eax
push eax
push 0x401fd4
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov esi, eax
push dword [esp + 0x34]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
test esi, esi
je 0x40354b
push esi
push 0x25
push ebx
call fcn.0040379e
add esp, 0xc
call fcn.004029ba
push 3
pop eax
jmp 0x40368c
xor edi, edi
lea ecx, [esp + 0x740]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x403557
sub ecx, edx
sar ecx, 1
je 0x4035a4
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov esi, dword [eax + 0x14]
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push eax
push 0x406638
push 0x406c50
push ecx
mov ecx, esi
call dword [0x408198]
call esi
jmp 0x403632
cmp dword [esp + 0x3c], 0
je 0x4035ec
push dword [esp + 0x40]
lea eax, [esp + 0x4c]
push dword [esp + 0x48]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x340]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x48]
push eax
lea eax, [esp + 0x558]
push eax
lea eax, [esp + 0x14c]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00403d01
jmp 0x403632
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov esi, dword [eax + 0xc]
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x338]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x40]
push eax
lea eax, [esp + 0x550]
push eax
lea eax, [esp + 0x144]
push eax
push 0x406c50
push ecx
mov ecx, esi
call dword [0x408198]
call esi
mov edi, eax
test edi, edi
je 0x403647
push dword [esp + 0x4c]
push 0x27
push ebx
call fcn.0040379e
add esp, 0xc
mov eax, dword [esp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x408198]
call esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
test edi, edi
jne 0x403675
push 0x20
push ebx
call fcn.0040379e
pop ecx
xor eax, eax
pop ecx
mov ebx, eax
jmp 0x403685
call fcn.004029ba
mov eax, dword [esp + 0x48]
jmp 0x40368c
call fcn.004038f5
call fcn.004029ba
mov eax, ebx
mov ecx, dword [esp + 0xf64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404aa0
mov esp, ebp
pop ebp
ret