Function at 0x40fc35
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41da96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x10e4
call fcn.00419050
push ebx
push esi
xor ecx, ecx
mov eax, str.SoftwareMicrosoftWABDLLPath
mov esi, 0x820
push edi
mov dword [esp + 0x20], esi
cmp ecx, eax
je 0x40fc92
lea ecx, [esp + 0xb0]
push ecx
push 0x421af4
push eax
push 0x80000002
lea edi, [esp + 0x30]
call fcn.004068cf
test al, al
jne 0x40fc99
xor al, al
jmp 0x410066
push esi
lea eax, [esp + 0x8d4]
push eax
lea eax, [esp + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.WABOpen
call fcn.004046cc
lea ebx, [esp + 0x8d4]
mov ecx, eax
call fcn.004010c5
xor ebx, ebx
cmp eax, ebx
je 0x40fc92
push ebx
push ebx
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x28]
push ecx
call eax
test eax, eax
jne 0x40fc92
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
lea edx, [esp + 0x54]
push edx
push eax
call dword [ecx + 0x64]
test eax, eax
je 0x40fd0e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40fc92
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x3c]
push edx
push 0x10
push ebx
push dword [esp + 0x64]
mov dword [esp + 0x4c], ebx
push dword [esp + 0x64]
mov dword [esp + 0x30], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
test eax, eax
jne 0x40fcf8
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esp + 0x38], 4
je 0x40fd5a
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
jmp 0x40fd06
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push 0x80100000
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x38]
test eax, eax
jne 0x40fd4a
mov eax, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x90]
push edx
mov dword [esp + 0x94], 8
mov dword [esp + 0x98], 0xfff0102
mov dword [esp + 0x9c], 0x3001001f
mov dword [esp + 0xa0], 0x3003001f
mov dword [esp + 0xa4], 0x3a1c001f
mov dword [esp + 0xa8], 0x3a59001f
mov dword [esp + 0xac], 0x3a5d001f
mov dword [esp + 0xb0], 0x3a09001f
mov dword [esp + 0xb4], 0x3a16001f
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push ebx
push ebx
push ebx
push eax
call dword [ecx + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
je 0x40fe2a
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
jmp 0x40fd06
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x30]
push edx
push ebx
push dword [esp + 0x54]
push eax
call dword [ecx + 0x4c]
lea esi, [esp + 0x3c]
mov dword [esp + 0x2c], ebx
call fcn.00405d11
mov dword [esp + 0x10fc], ebx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
cmp dword [eax], ebx
jbe 0x41002a
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x20]
lea esi, [ecx + eax + 4]
lea eax, [esp + 0x68]
push eax
call fcn.00401108
mov byte [esp + 0x10fc], 1
mov dword [esp + 0x24], ebx
cmp dword [esi + 4], ebx
jbe 0x40ff4f
mov dword [esp + 0x34], ebx
mov eax, dword [esi + 8]
add eax, dword [esp + 0x34]
mov edi, dword [eax + 8]
mov eax, dword [eax]
cmp eax, 0x3001001f
je 0x40ff22
cmp eax, 0x3003001f
je 0x40ff14
cmp eax, 0x3a09001f
je 0x40ff06
cmp eax, 0x3a16001f
je 0x40fef8
cmp eax, 0x3a1c001f
je 0x40feea
cmp eax, 0x3a59001f
je 0x40fedc
cmp eax, 0x3a5d001f
jne 0x40ff39
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x6ca92c23
jmp 0x40ff2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7844e566
jmp 0x40ff2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7bbfe71c
jmp 0x40ff2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7e4611d2
jmp 0x40ff2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7e44e652
jmp 0x40ff2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x694fe652
jmp 0x40ff2e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x744f0fd2
mov ecx, edi
lea edi, [esp + 0x6c]
call fcn.004011e8
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x34], 0x10
cmp eax, dword [esi + 4]
jb 0x40fe91
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x18]
lea esi, [esp + 0x58]
call fcn.00405d11
mov byte [esp + 0x10fc], 2
mov ecx, esi
lea edx, [esp + 0x68]
call fcn.0040120a
test al, al
je 0x40ffef
mov esi, dword [esp + 0x5c]
push ebx
lea eax, [esp + 0x28]
push eax
push 4
pop eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2c], esi
call fcn.004060be
push ebx
push dword [esp + 0x5c]
mov eax, esi
lea ecx, [esp + 0x44]
call fcn.004060be
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x14
jge 0x40ffbc
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
dec eax
cmp dword [esp + 0x28], eax
jb 0x40ffef
push dword [esp + 0x40]
mov esi, dword [ebp + 8]
push ebx
push 0x3e8
push esi
call fcn.00403aef
push eax
push 0x80362001
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0040242d
lea esi, [esp + 0x3c]
mov dword [esp + 0x2c], ebx
call fcn.00405f3e
mov byte [esp + 0x10fc], 1
lea esi, [esp + 0x58]
call fcn.00405f2c
mov byte [esp + 0x10fc], bl
lea eax, [esp + 0x68]
push eax
call fcn.0040114f
inc dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
add dword [esp + 0x20], 0xc
cmp ecx, dword [eax]
jb 0x40fe66
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [esp + 0x10fc], 0xffffffff
lea esi, [esp + 0x3c]
call fcn.00405f2c
mov al, 1
mov ecx, dword [esp + 0x10f4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret