Function at 0x44b784
Capabilities:
Query environment variable

Disassembly:
push 0x278
mov eax, 0x4a240d
call fcn.0045cd4f
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x268], ebx
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
push 0x101
push str.SoftwareClassesCLSID054AAE20_4BEA_4347_8A35_64A533254A9DLocalServer32
push eax
lea ecx, [ebp - 0x280]
mov dword [ebp - 4], ebx
call fcn.0041bcc4
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.0045e560
add esp, 0xc
mov dword [ebp - 0x268], 0x104
lea eax, [ebp - 0x268]
lea ecx, [ebp - 0x280]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x4b82bc
call fcn.0041bbee
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00408923
push ebx
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 1
call fcn.00408b05
push eax
call fcn.004088ee
pop ecx
push eax
mov ecx, edi
call fcn.0041c73f
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x274]
call fcn.0041d176
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.004097a0
push dword [ebp - 0x270]
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x268], 2
call fcn.00409964
mov dword [ebp - 0x284], ebx
cmp dword [ebp - 0x270], ebx
jbe 0x44b8ca
mov edi, dword [ebp - 0x274]
movzx esi, word [edi + ebx*2]
mov eax, esi
lea ecx, [eax - 0x41]
add eax, 0x20
movzx edx, ax
cmp cx, 0x19
mov eax, esi
lea ecx, [ebp - 0x234]
cmova edx, eax
movzx eax, dx
push eax
call 0x422e24
inc ebx
cmp ebx, dword [ebp - 0x270]
jb 0x44b892
mov edi, dword [ebp - 0x26c]
xor ebx, ebx
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.004117ee
lea ecx, [ebp - 0x234]
call fcn.00408cf0
push ecx
push 0x4bd114
mov ecx, edi
call fcn.00417117
mov dword [ebp - 0x26c], eax
cmp eax, 0xffffffff
je 0x44ba10
push 0x14
push eax
mov ecx, edi
call fcn.00411768
lea ecx, [ebp - 0x234]
call fcn.004097a0
push ebx
push ebx
push str.CommonProgramW6432
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x44b96f
push esi
lea ecx, [ebp - 0x234]
call fcn.00409964
push ebx
lea eax, [esi - 1]
push eax
lea ecx, [ebp - 0x234]
call fcn.0041c73f
lea ecx, [ebp - 0x234]
call fcn.00407ce4
push esi
mov ecx, eax
call fcn.004084a3
push eax
push str.CommonProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x44b9e2
mov ecx, 0x4bce78
call fcn.00415b0d
test eax, eax
je 0x44b9e2
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44b9e2
lea ecx, [ebp - 0x268]
push ecx
push ebx
push ebx
push 0x4b18c8
call eax
test eax, eax
jns 0x44b9ae
lea ecx, [ebp - 0x234]
call fcn.00408cf0
jmp 0x44ba1f
push dword [ebp - 0x268]
lea ecx, [ebp - 0x264]
call fcn.00408923
push eax
lea ecx, [ebp - 0x234]
call fcn.004117ee
lea ecx, [ebp - 0x264]
call fcn.00408cf0
push dword [ebp - 0x268]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x234]
call fcn.00407ce4
mov ecx, eax
push dword [eax + 0x10]
call fcn.004084a3
push eax
push dword [ebp - 0x26c]
mov ecx, edi
call fcn.00442dc3
lea ecx, [ebp - 0x234]
call fcn.00408cf0
mov ecx, edi
call fcn.0040f3b1
neg al
sbb al, al
inc al
mov bl, al
lea ecx, [ebp - 0x24c]
call fcn.00408cf0
cmp dword [ebp - 0x280], 0
je 0x44ba3f
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.0045ccf9
ret 4