Function at 0x406f03
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
push ebx
xor ebx, ebx
cmp dword [0x4240a4], ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
je 0x40723d
cmp dword [0x4240b0], ebx
je 0x40723d
cmp dword [0x422bf4], ebx
jne 0x40723d
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, 0x102
lea eax, [ebp - 0x134]
push edi
push eax
push 0x41c908
mov byte [ebp - 0x134], bl
call esi
test eax, eax
je 0x406fa1
lea eax, [ebp - 0x134]
push eax
call fcn.0040919c
lea eax, [ebp - 0x134]
push eax
call fcn.00413210
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.00419470
add esp, 0x14
test eax, eax
jne 0x40723d
lea eax, [ebp - 0x134]
push edi
push eax
push 0x41c8f8
call esi
test eax, eax
je 0x406ff0
lea eax, [ebp - 0x134]
push eax
call fcn.0040919c
lea eax, [ebp - 0x134]
push eax
call fcn.00413210
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.00419470
add esp, 0x14
test eax, eax
jne 0x40723d
mov edi, 0x103
lea eax, [ebp - 0xa58]
push edi
push dword [ebp + 8]
push eax
call fcn.0040c7b3
lea eax, [ebp - 0x24]
mov word [ebp - 0x74c], bx
push eax
lea eax, [ebp - 0x74c]
push eax
mov dword [ebp - 0x24], edi
call fcn.0040babf
add esp, 0x14
cmp word [ebp - 0x74c], bx
je 0x40723d
call fcn.00406e85
test eax, eax
je 0x40723d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
push 4
lea eax, [ebp - 0xa58]
push 1
push eax
call dword [0x420b8c]
test eax, eax
jne 0x40723d
cmp dword [ebp - 0x10], ebx
je 0x40723d
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xb
push 1
push 0x41c08c
call esi
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 0x41c094
call esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
cmp word [eax + 4], bx
jbe 0x4071f2
lea ecx, [ebp - 0x2c]
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x4071da
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
cmp byte [eax], bl
jne 0x4071da
push dword [ebp - 8]
lea esi, [eax + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4071c7
push dword [ebp - 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4071c7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x30], edi
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x544]
push eax
push esi
push ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x544], bx
mov word [ebp - 0x33c], bx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x4071da
lea eax, [ebp - 0x74c]
push 0x5c
push eax
call fcn.00414068
pop ecx
test eax, eax
pop ecx
je 0x407195
cmp word [ebp - 0x33c], bx
je 0x407195
push edi
lea eax, [ebp - 0x33c]
push 0x41cbe4
push eax
call fcn.0040c719
lea eax, [ebp - 0x544]
push edi
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.0040c719
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x544]
push eax
call fcn.00413eda
add esp, 0x20
push 1
pop esi
cmp dword [ebp - 0x1c], esi
jne 0x4071da
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x544]
push eax
call fcn.0041951d
pop ecx
test eax, eax
pop ecx
jne 0x4071da
mov eax, dword [ebp - 0x20]
test dword [eax + 4], 0x40000002
je 0x4071da
mov dword [ebp - 0x14], esi
jmp 0x4071da
mov eax, dword [ebp - 0x20]
test dword [eax + 4], 0x40000002
je 0x4071da
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
inc dword [ebp + 8]
movzx ecx, word [eax + 4]
cmp dword [ebp + 8], ecx
jl 0x4070b0
cmp dword [ebp - 4], ebx
jne 0x407210
mov eax, dword [0x41c068]
push 1
pop ecx
cmp eax, ecx
jne 0x407203
cmp dword [ebp - 0x14], ebx
je 0x40720d
cmp eax, 2
jne 0x407210
cmp dword [ebp - 0x14], ebx
je 0x407210
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x18], ebx
je 0x40721e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_FreeSid]
je 0x40722e
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], ebx
je 0x407238
push dword [ebp - 8]
call esi
mov eax, dword [ebp - 4]
jmp 0x40723f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret