Function at 0x40670b
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x41689d
call fcn.00415f10
sub esp, 0x184
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov esi, dword [ebp + 8]
push edi
call fcn.00402f43
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x38], 1
call fcn.0040ac60
pop ecx
mov ecx, esi
mov esi, dword [ecx + 0x14]
add eax, eax
cmp esi, eax
ja 0x406aa3
cmp dword [ecx + 0x18], eax
je 0x406aa3
push 1
push eax
call fcn.004031ce
test al, al
je 0x406aa3
mov ecx, dword [ebp + 8]
push esi
call fcn.004031b2
jmp 0x406aa3
mov al, byte [edi]
inc edi
mov byte [ebp - 0x34], al
cmp al, 0x25
je 0x40678f
push dword [ebp - 0x34]
mov esi, dword [ebp + 8]
call fcn.0040836e
jmp 0x406aa3
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004031b2
mov dword [ebp - 4], 1
mov al, byte [edi]
mov byte [ebp - 0x30], al
movsx eax, al
inc edi
cmp eax, 0x25
je 0x406a8a
cmp eax, 0x7b
je 0x4067c8
push dword [ebp - 0x30]
lea esi, [ebp - 0x2c]
call fcn.0040836e
cmp byte [ebp - 0x30], 0x7b
jne 0x406a1c
mov byte [ebp - 0xd], 1
mov byte [ebp + 0xf], bl
jmp 0x40680c
cmp al, 0x7d
je 0x406812
cmp byte [ebp + 0xf], bl
jne 0x4067ff
cmp al, 0x3a
jne 0x4067ee
mov byte [ebp + 0xf], 1
jmp 0x4067ff
movsx eax, al
push eax
call fcn.0040cce2
pop ecx
test eax, eax
jne 0x4067ff
mov byte [ebp - 0xd], bl
movzx eax, byte [edi]
push eax
lea esi, [ebp - 0x2c]
inc edi
call fcn.0040836e
mov al, byte [edi]
cmp al, bl
jne 0x4067db
mov al, byte [edi]
inc edi
mov dword [ebp + 0xc], edi
test al, al
je 0x406aad
mov eax, dword [ebp - 0x28]
cmp byte [ebp - 0xd], bl
je 0x40691b
cmp dword [ebp - 0x14], 0x10
jae 0x406835
lea eax, [ebp - 0x28]
push 0x3a
push eax
call fcn.0040cea0
mov esi, eax
pop ecx
xor edi, edi
pop ecx
cmp esi, ebx
je 0x406872
mov byte [esi], bl
inc esi
push str.path
push esi
call fcn.0040b364
pop ecx
pop ecx
test eax, eax
jne 0x40685e
inc edi
jmp 0x406872
push str.file
push esi
call fcn.0040b364
pop ecx
pop ecx
test eax, eax
jne 0x406872
push 2
pop edi
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x40687e
lea eax, [ebp - 0x28]
push eax
call fcn.0040cf74
pop ecx
lea ecx, [ebp - 0x54]
push ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
call fcn.00407f03
mov eax, edi
dec eax
mov byte [ebp - 4], 2
je 0x4068d0
dec eax
jne 0x406905
cmp dword [ebp - 0x3c], 0x10
mov eax, dword [ebp - 0x50]
jae 0x4068ab
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x8c]
call fcn.004076f8
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.00402fcf
lea ecx, [ebp - 0x8c]
jmp 0x4068f9
cmp dword [ebp - 0x3c], 0x10
mov eax, dword [ebp - 0x50]
jae 0x4068dc
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x70]
call fcn.00407771
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call fcn.00402fcf
lea ecx, [ebp - 0x70]
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.00403082
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x54]
call fcn.004048fd
lea ecx, [ebp - 0x54]
jmp 0x406a0f
push 0x10
pop esi
cmp dword [ebp - 0x14], esi
jae 0x406926
lea eax, [ebp - 0x28]
push str.unique
push eax
call fcn.0040b364
pop ecx
pop ecx
test eax, eax
je 0x4069ce
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x406946
lea eax, [ebp - 0x28]
push 7
push str.unique:
push eax
call fcn.0040b4a8
add esp, 0xc
test eax, eax
je 0x4069ce
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x406965
lea eax, [ebp - 0x28]
push str.guid
push eax
call fcn.0040b364
pop ecx
pop ecx
test eax, eax
je 0x4069ae
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x406981
lea eax, [ebp - 0x28]
push 5
push str.guid:
push eax
call fcn.0040b4a8
add esp, 0xc
test eax, eax
je 0x4069ae
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x10]
call fcn.00407f3f
mov byte [ebp - 4], 7
jmp 0x406a72
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x4069b9
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004064fc
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x406a72
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x4069d9
lea ecx, [ebp - 0x28]
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], esi
jb 0x4069e6
mov eax, dword [edi + 4]
jmp 0x4069e9
lea eax, [edi + 4]
push dword [ebp + 0x10]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004061cf
add esp, 0x14
push 0xffffffffffffffff
push ebx
mov esi, edi
mov byte [ebp - 4], 5
call fcn.004048fd
lea ecx, [ebp - 0x70]
push ebx
push 1
call fcn.00403082
mov edi, dword [ebp + 0xc]
jmp 0x406a95
movzx eax, byte [edi]
jmp 0x406a31
cmp al, 0x25
je 0x406a35
push eax
lea esi, [ebp - 0x2c]
inc edi
call fcn.0040836e
mov al, byte [edi]
cmp al, bl
jne 0x406a21
mov al, byte [edi]
inc edi
test al, al
je 0x406aad
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x406a48
lea eax, [ebp - 0x28]
push 0x104
lea ecx, [ebp - 0x190]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406a95
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x70]
call fcn.00402f56
mov byte [ebp - 4], 8
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push ebx
call fcn.004048fd
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.00403082
jmp 0x406a95
push dword [ebp - 0x30]
mov esi, dword [ebp + 8]
call fcn.0040836e
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00403082
cmp byte [edi], bl
jne 0x406775
jmp 0x406ab8
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403082
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret