Function at 0x406ee2
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x11df0]
mov eax, 0x11e70
call fcn.00468c00
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x11dec], eax
mov eax, dword [ebp + 0x11e00]
push ebx
mov ebx, dword [ebp + 0x11df8]
push esi
mov esi, dword [sym.imp.PPLIB32W.DLL__VFSFullPath_12]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x11e04]
push edi
mov edi, dword [ebp + 0x11dfc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x11e08]
mov dword [ebp - 0x4c], ebx
add ebx, 0xa34
push ebx
mov dword [ebp - 0x48], eax
push edi
lea eax, [ebp + 0x1193c]
push eax
call esi
test eax, eax
jne 0x406f9b
cmp word [ebx], 0x3f
jne 0x40732b
mov ebx, dword [ebp - 0x4c]
mov word [ebp + 0x1193c], ax
lea eax, [ebx + 0x584]
push eax
push edi
lea eax, [ebp + 0x1193c]
push eax
call esi
test eax, eax
je 0x406f8e
lea eax, [ebp + 0x1193c]
push eax
push eax
push dword [ebx + 0xc]
call dword [sym.imp.PPLIB32W.DLL__VFSGetRealPath_12]
test eax, eax
jne 0x406f8e
xor eax, eax
jmp 0x40732b
xor ebx, ebx
cmp word [ebp + 0x1193c], bx
jne 0x406f9d
jmp 0x406f87
xor ebx, ebx
push edi
call dword [sym.imp.PPLIB32W.DLL__FindExtSeparator_4]
lea eax, [edi + eax*2]
cmp word [eax], 0x2e
jne 0x407011
cmp word [eax + 2], 0x7b
jne 0x407011
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x406fb7
sub eax, edx
sar eax, 1
cmp eax, 0x27
jne 0x407011
cmp dword [ebp - 0x40], ebx
je 0x406fe2
push edi
push dword [ebp - 0x40]
push ebx
call dword [sym.imp.PPLIB32W.DLL__CatPath_12]
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov word [ecx], ax
mov esi, dword [ebp - 0x48]
cmp esi, ebx
je 0x407328
push str.JNCLCLSID
mov edx, 0xe3f9
mov ecx, esi
call fcn.00457166
push str.JPCLCLSID_pair_window_
mov edx, 0xe3ff
mov ecx, esi
call fcn.00457166
jmp 0x407014
mov esi, dword [ebp - 0x48]
push 0x11000
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1193c]
push eax
call fcn.00406e9a
mov edi, eax
cmp edi, ebx
jne 0x407064
cmp esi, ebx
je 0x406f87
push esi
push 0x80000000
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1193c]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSCheckDir_16]
push str.JPDIshow_pair_window
mov edx, 0xe3fa
mov ecx, esi
call fcn.00457166
jmp 0x406f87
cmp edi, 0x64
jbe 0x4071b3
cmp byte [ebp - 0x24], 0x4c
jne 0x4071b3
cmp byte [ebp - 0x23], 0
jne 0x4071b3
cmp byte [ebp - 0x22], 0
jne 0x4071b3
cmp dword [ebp - 0x40], ebx
je 0x407189
lea eax, [ebp + 0x10fdc]
push eax
lea eax, [ebp + 0x1193c]
push eax
mov eax, dword [ebp - 0x4c]
push dword [eax + 0xc]
call fcn.0043b114
test eax, eax
jl 0x407171
cmp word [ebp + 0x10fdc], bx
je 0x407171
xor eax, eax
mov word [ebp + 0x1148c], ax
push 0x258
lea eax, [ebp + 0x1148c]
push eax
lea eax, [ebp + 0x10fdc]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x1148c]
push eax
call dword [sym.imp.PPLIB32W.DLL__GetFileAttributesL_4]
test al, 0x10
je 0x407122
cmp eax, 0xffffffff
je 0x407122
mov edx, dword [ebp - 0x40]
lea eax, [ebp + 0x1148c]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x407107
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov word [ecx], ax
jmp 0x407328
lea eax, [ebp + 0x1148c]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSFindLastEntry_4]
cmp word [eax], 0x5c
lea edx, [eax + 2]
je 0x40713a
mov edx, eax
mov esi, dword [ebp - 0x44]
movzx ecx, word [edx]
inc edx
mov word [esi], cx
inc edx
inc esi
inc esi
cmp cx, bx
jne 0x40713d
mov edx, dword [ebp - 0x40]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x1148c]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x40715e
jmp 0x407328
cmp esi, ebx
jne 0x407191
mov ecx, dword [ebp - 0x4c]
push str.ESCTShort_cut_error
xor edx, edx
call fcn.00427caa
jmp 0x406f87
cmp esi, ebx
je 0x407328
push str.JNSHshortcut
mov edx, 0xe3f7
mov ecx, esi
call fcn.00457166
push str.JPSHshortcut_pair_window_
mov edx, 0xe3fd
mov ecx, esi
call fcn.00457166
push esi
mov esi, 0x80000000
or edi, esi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x1193c]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSCheckDir_16]
test eax, eax
je 0x407202
mov edx, dword [ebp - 0x40]
cmp edx, ebx
je 0x4071f8
lea eax, [ebp + 0x1193c]
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x4071e2
mov ecx, dword [ebp - 0x44]
xor eax, eax
mov word [ecx], ax
cmp dword [ebp - 0x48], ebx
jne 0x40720b
jmp 0x407328
cmp dword [ebp - 0x48], ebx
je 0x406f87
push ebx
push 0x80
push 3
push ebx
push 1
push esi
lea eax, [ebp + 0x1193c]
push eax
mov dword [ebp - 0x44], ebx
call dword [sym.imp.PPLIB32W.DLL__CreateFileL_28]
mov edi, eax
cmp edi, 0xffffffff
je 0x407316
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x40726b
cmp dword [ebp - 0x58], 2
jb 0x40726b
mov ecx, dword [ebp - 0x48]
push str.JNHLhard_links_H_
mov edx, 0xe3f6
call fcn.00457166
mov ecx, dword [ebp - 0x48]
push str.JPHLhard_links_pair_window_
mov edx, 0xe3fc
call fcn.00457166
mov esi, dword [sym.imp.KERNEL32.dll_BackupRead]
jmp 0x4072ba
cmp dword [ebp - 0x40], 0x14
jb 0x4072f7
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp + 0x10fdc]
push eax
push edi
call esi
test eax, eax
je 0x4072f7
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x40], eax
jb 0x4072f7
cmp eax, ebx
jne 0x4072d3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_BackupSeek]
test eax, eax
je 0x4072f7
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x14
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
test eax, eax
jne 0x407273
jmp 0x4072f7
mov ecx, dword [ebp - 0x48]
push str.JNSTstream
mov edx, 0xe3f5
call fcn.00457166
mov ecx, dword [ebp - 0x48]
push str.JPSTstream_pair_window_
mov edx, 0xe3fb
call fcn.00457166
cmp dword [ebp - 0x44], ebx
je 0x40730f
lea eax, [ebp - 0x44]
push eax
push ebx
push 1
lea eax, [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x48]
push str.JPDIshow_pair_window
mov edx, 0xe3fa
call fcn.00457166
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x11dec]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x11df0
leave
ret 0x14