Function at 0x40fe60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1040
call fcn.0041bfd0
mov eax, dword [0x4417c0]
xor eax, esp
mov dword [esp + 0x103c], eax
mov eax, dword [esp + 0x1058]
push ebx
mov ebx, dword [esp + 0x1048]
push ebp
mov ebp, dword [esp + 0x1068]
push esi
mov esi, dword [esp + 0x105c]
push edi
mov edi, dword [esp + 0x1058]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
cmp ebx, 0xc
ja case.0x40feb3.1
movzx ecx, byte [ebx + 0x410160]
jmp dword [ecx*4 + 0x410158]
call fcn.00408db0
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0x28], eax
test eax, eax
je 0x4100cb
mov ebp, dword [esp + 0x1064]
mov ecx, dword [esp + 0x105c]
push ebp
push esi
push ecx
xor edx, edx
xor eax, eax
push edi
mov word [edi], dx
push ebx
mov word [esi], ax
call fcn.0040fb80
push str.smss.exe
push edi
call fcn.0041c8c0
add esp, 0x1c
test eax, eax
jne 0x40ff1c
push ebp
push esi
push str._SystemRoot_System32_smss.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40ff5f
push 4
push str.___
push esi
call fcn.0041ee98
add esp, 0xc
test eax, eax
jne 0x40ff5f
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ff35
sub eax, edx
sar eax, 1
mov edi, eax
lea edx, [edi + edi - 8]
push edx
lea eax, [esi + 8]
push eax
push esi
call fcn.0041da00
add esp, 0xc
xor ecx, ecx
mov word [esi + edi*2 - 8], cx
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ffe1
lea edx, [esp + 0x44]
push edx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx edx, word [esp + 0x38]
movzx eax, word [esp + 0x36]
movzx ecx, word [esp + 0x34]
push edx
movzx edx, word [esp + 0x36]
push eax
movzx eax, word [esp + 0x36]
push ecx
movzx ecx, word [esp + 0x38]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push str._04d__02d__02d__02d:_02d:_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
push esi
call ebx
jmp 0x40ffff
mov edx, dword [esp + 0x1c]
mov eax, 0x433c58
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40fff0
mov eax, dword [esp + 0x106c]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
push 8
push ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0x800
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x410057
mov edx, dword [esp + 0x14]
mov eax, str.SYSTEM
sub edx, eax
jmp 0x410040
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x410040
push ebp
call ebx
jmp case.0x40feb3.0
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 1
push eax
call edi
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0041a6f2
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x40]
push edx
push eax
push esi
push 1
push ecx
call edi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x54]
push ecx
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov edx, dword [esp + 0x10]
push edx
call ebx
push esi
call fcn.0041a615
add esp, 4
push ebp
call ebx
jmp case.0x40feb3.0
mov eax, str.___Cannot_Access__
sub edi, eax
movzx ecx, word [eax]
mov word [edi + eax], cx
add eax, 2
test cx, cx
jne 0x4100d2
mov eax, 0x4349b0
sub esi, eax
jmp 0x4100f0
movzx ecx, word [eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x4100f0
mov eax, 0x4349b0
mov edx, ebp
sub edx, eax
jmp 0x410110
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x410110
mov edx, dword [esp + 0x14]
mov eax, 0x4349b0
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x410130
mov ecx, dword [esp + 0x104c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041a7bc
add esp, 0x1040
ret