Function at 0x407bbb
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
mov edi, edi
push ebp
sub esp, 0x4c
mov eax, 0x417a50
call fcn.00416288
sub esp, 0x1c8
push ebx
xor ebx, ebx
mov dword [ebp], ebx
push esi
push edi
mov edi, dword [ebp + 0x58]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
mov dword [ebp], 1
call fcn.0040d480
cdq
mov ecx, 0x175b
idiv ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0x48], 0x3906a0c
mov eax, dword [ebp + 0x48]
test eax, eax
mov eax, dword [ebp + 8]
jne 0x407c16
mov eax, dword [ebp + 0x48]
mov esi, dword [ebp + 0x5c]
push esi
mov dword [ebp + 0x48], eax
call fcn.0040d2b0
pop ecx
add eax, eax
mov ecx, edi
call fcn.00406efb
cmp byte [esi], bl
je 0x408294
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov byte [ebp + 0x30], bl
lea edi, [ebp + 0x31]
stosb byte es:[edi], al
mov al, byte [0x41a9c5]
mov byte [ebp + 0x30], al
mov eax, dword [ebp + 0x5c]
mov al, byte [eax]
inc dword [ebp + 0x5c]
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 8], al
call esi
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x407c6a
call esi
mov dword [ebp + 0x4c], eax
cmp byte [ebp + 8], 0x25
je 0x407c91
push dword [ebp + 8]
mov esi, dword [ebp + 0x58]
xor eax, eax
mov byte [ebp + 0x28], bl
lea edi, [ebp + 0x29]
stosb byte es:[edi], al
mov al, byte [0x41a9d1]
mov byte [ebp + 0x28], al
call fcn.0040b2a4
jmp 0x408278
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x5c]
mov al, byte [eax]
inc dword [ebp + 0x5c]
mov byte [ebp + 4], al
movsx eax, al
cmp eax, 0x25
je 0x40825e
cmp eax, 0x7b
je 0x407ce3
push dword [ebp + 4]
lea esi, [ebp + 0xc]
call fcn.0040b2a4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [ebp + 0x34], bl
xor eax, eax
lea edi, [ebp + 0x35]
stosb byte es:[edi], al
mov al, byte [0x41a9dd]
mov byte [ebp + 0x34], al
cmp byte [ebp + 4], 0x7b
jne 0x408163
mov dword [ebp + 0x48], ebx
mov eax, dword [ebp + 0x48]
test eax, eax
je 0x407d0c
push str.windows5993XP
push dword [ebp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x407d0c
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov byte [ebp + 0x43], 1
call esi
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x407d24
call esi
mov dword [ebp + 0x4c], eax
mov edi, dword [ebp + 0x5c]
mov byte [ebp + 0x42], bl
jmp 0x407da1
cmp al, 0x7d
je 0x407da7
mov dword [ebp + 0x48], ebx
mov eax, dword [ebp + 0x48]
test eax, eax
je 0x407d4f
push str.windows5995XP
push dword [ebp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x407d4f
mov dword [ebp + 0x48], ebx
cmp byte [ebp + 0x42], bl
jne 0x407d88
mov eax, dword [ebp + 0x5c]
mov al, byte [eax]
cmp al, 0x3a
jne 0x407d63
mov byte [ebp + 0x42], 1
jmp 0x407d74
movsx eax, al
push eax
call fcn.0040f18b
pop ecx
test eax, eax
jne 0x407d74
mov byte [ebp + 0x43], bl
mov dword [ebp + 0x4c], ebx
call esi
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x407d88
call esi
mov dword [ebp + 0x4c], eax
mov edi, dword [ebp + 0x5c]
movzx eax, byte [edi]
inc edi
push eax
lea esi, [ebp + 0xc]
mov dword [ebp + 0x5c], edi
call fcn.0040b2a4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov al, byte [edi]
cmp al, bl
jne 0x407d2c
mov al, byte [edi]
inc edi
mov dword [ebp + 0x5c], edi
test al, al
je 0x408285
call fcn.0040d480
cdq
mov ecx, 0x3937760
idiv ecx
mov dword [ebp + 0x48], edx
call fcn.0040d480
cdq
mov ecx, 0x176f
idiv ecx
mov dword [ebp + 0x4c], edx
mov eax, dword [ebp + 0x4c]
add eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x48]
imul eax, ecx
mov dword [ebp + 0x48], eax
cmp byte [ebp + 0x43], bl
je 0x407f95
mov dword [ebp + 0x4c], ebx
call esi
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x407e01
call esi
mov dword [ebp + 0x4c], eax
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x407e0d
lea eax, [ebp + 0xc]
push 0x3a
push eax
call fcn.0040f250
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp + 0x48]
pop ecx
pop ecx
test eax, eax
je 0x407e39
push str.windows6001XP
push dword [ebp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x407e39
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
cmp dword [ebp + 0x3c], ebx
je 0x407ec5
mov byte [ebp + 0x38], bl
xor eax, eax
lea edi, [ebp + 0x39]
stosb byte es:[edi], al
mov al, byte [0x41aa19]
mov byte [ebp + 0x38], al
mov eax, dword [ebp + 0x3c]
inc dword [ebp + 0x3c]
mov byte [eax], bl
mov dword [ebp + 0x48], ebx
push 2
mov dword [ebp + 0x44], 0x1776
mov dword [ebp + 0x48], ebx
pop edi
jmp 0x407e78
call esi
mov dword [ebp + 0x44], eax
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
cmp eax, edi
jl 0x407e70
push str.path
push dword [ebp + 0x3c]
call fcn.0040eea8
pop ecx
pop ecx
test eax, eax
jne 0x407e9b
mov dword [ebp + 0x4c], 1
jmp 0x407eb1
push str.file
push dword [ebp + 0x3c]
call fcn.0040eea8
pop ecx
pop ecx
test eax, eax
jne 0x407eb1
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x44], ebx
call esi
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x407ec5
call esi
mov dword [ebp + 0x44], eax
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x407ed1
lea eax, [ebp + 0xc]
push eax
call fcn.0040f324
pop ecx
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov eax, dword [ebp + 0x60]
call fcn.0040aad2
mov eax, dword [ebp + 0x4c]
dec eax
mov byte [ebp - 4], 2
je 0x407f24
dec eax
jne 0x407f5a
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x407eff
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00409903
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.004033e8
lea esi, [ebp - 0xd0]
jmp 0x407f4b
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x407f30
lea eax, [ebp - 0x28]
push eax
lea ebx, [ebp - 0x44]
call fcn.004099f7
pop ecx
mov ebx, eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004033e8
lea esi, [ebp - 0x44]
push 1
xor edi, edi
mov byte [ebp - 4], 2
call fcn.00403438
xor ebx, ebx
mov esi, dword [ebp + 0x58]
push ebx
lea eax, [ebp - 0x28]
push eax
or eax, 0xffffffff
call fcn.00406542
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x44], 0x1780
mov dword [ebp + 0x48], ebx
jmp 0x407f85
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x44], eax
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
cmp eax, 2
jl 0x407f79
lea esi, [ebp - 0x28]
jmp 0x408151
mov eax, dword [ebp + 0xc]
push 0x10
pop edi
cmp dword [ebp + 0x20], edi
jae 0x407fa3
lea eax, [ebp + 0xc]
push str.unique
push eax
call fcn.0040eea8
pop ecx
pop ecx
test eax, eax
je 0x4080f4
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x20], edi
jae 0x407fc3
lea eax, [ebp + 0xc]
push 7
push str.unique:
push eax
call fcn.0040efd1
add esp, 0xc
test eax, eax
je 0x4080f4
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x20], edi
jae 0x407fe6
lea eax, [ebp + 0xc]
push str.guid
push eax
call fcn.0040eea8
pop ecx
pop ecx
test eax, eax
je 0x408052
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x20], edi
jae 0x408002
lea eax, [ebp + 0xc]
push 5
push str.guid:
push eax
call fcn.0040efd1
add esp, 0xc
test eax, eax
je 0x408052
mov ebx, dword [ebp + 0x60]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0040ab2f
push 0
mov byte [ebp - 4], 7
mov esi, dword [ebp + 0x58]
push eax
or eax, 0xffffffff
call fcn.00406542
push 1
xor edi, edi
lea esi, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.00403438
xor ebx, ebx
jmp 0x4080c8
mov dword [ebp + 0x4c], ebx
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x408071
push str.windows6019XP
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x408071
mov dword [ebp + 0x4c], ebx
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x20], edi
jae 0x40807c
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004077a6
pop ecx
pop ecx
push ebx
mov byte [ebp - 4], 6
mov esi, dword [ebp + 0x58]
push eax
or eax, 0xffffffff
call fcn.00406542
push 1
xor edi, edi
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00403438
mov dword [ebp + 0x4c], ebx
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x4080c8
push str.windows6020XP
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4080c8
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x4c], ebx
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x408269
push str.windows6021XP
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x408269
mov dword [ebp + 0x4c], ebx
jmp 0x408269
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x44], 0x1781
mov dword [ebp + 0x48], ebx
jmp 0x40810b
call esi
mov dword [ebp + 0x44], eax
inc dword [ebp + 0x48]
mov eax, dword [ebp + 0x48]
cmp eax, 2
jl 0x408103
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x20], edi
jae 0x40811e
lea ecx, [ebp + 0xc]
mov eax, dword [ebp + 0x58]
cmp dword [eax + 0x14], edi
jb 0x408128
mov eax, dword [eax]
push dword [ebp + 0x60]
push ecx
lea ecx, [ebp + 0x5c]
push ecx
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00407373
add esp, 0x14
push ebx
mov byte [ebp - 4], 5
mov esi, dword [ebp + 0x58]
push eax
or eax, 0xffffffff
call fcn.00406542
lea esi, [ebp - 0x7c]
xor edi, edi
push 1
mov byte [ebp - 4], 1
call fcn.00403438
jmp 0x408269
mov eax, dword [ebp + 0x5c]
movzx eax, byte [eax]
jmp 0x408180
cmp al, 0x25
je 0x408184
inc dword [ebp + 0x5c]
push eax
lea esi, [ebp + 0xc]
call fcn.0040b2a4
mov eax, dword [ebp + 0x5c]
mov al, byte [eax]
cmp al, bl
jne 0x40816b
mov eax, dword [ebp + 0x5c]
mov al, byte [eax]
inc dword [ebp + 0x5c]
test al, al
je 0x408285
mov dword [ebp + 0x4c], ebx
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x4081b3
push str.windows6024XP
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4081b3
mov dword [ebp + 0x4c], ebx
call fcn.0040d480
cdq
mov ecx, 0x3976f1a
idiv ecx
mov dword [ebp + 0x4c], edx
call fcn.0040d480
cdq
mov ecx, 0x1789
idiv ecx
lea edi, [ebp + 0x2d]
mov dword [ebp + 0x44], edx
mov eax, dword [ebp + 0x44]
add eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x4c]
imul eax, ecx
mov dword [ebp + 0x4c], eax
xor eax, eax
mov byte [ebp + 0x2c], bl
stosb byte es:[edi], al
mov al, byte [0x41aa8d]
cmp dword [ebp + 0x20], 0x10
mov byte [ebp + 0x2c], al
mov eax, dword [ebp + 0xc]
jae 0x4081ff
lea eax, [ebp + 0xc]
push 0x104
lea ecx, [ebp - 0x1d4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40824c
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xb4]
call fcn.0040337d
push ebx
mov byte [ebp - 4], 8
mov esi, dword [ebp + 0x58]
push eax
or eax, 0xffffffff
call fcn.00406542
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.00403438
mov dword [ebp + 0x4c], ebx
mov eax, dword [ebp + 0x4c]
add eax, 0x178c
je 0x408269
inc dword [ebp + 0x4c]
jmp 0x408269
push dword [ebp + 4]
mov esi, dword [ebp + 0x58]
call fcn.0040b2a4
push 1
xor edi, edi
lea esi, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00403438
mov eax, dword [ebp + 0x5c]
cmp byte [eax], bl
jne 0x407c34
jmp 0x408294
push 1
xor edi, edi
lea esi, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.00403438
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x50
leave
ret