Function at 0x447810
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4e699d
mov eax, dword fs:[0]
push eax
mov eax, 0x2048
call fcn.004d8ec0
mov eax, dword [0x512054]
xor eax, esp
mov dword [esp + 0x2040], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x512054]
xor eax, esp
push eax
lea eax, [esp + 0x205c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x206c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x40], eax
mov eax, dword [0x51a22c]
mov esi, ecx
mov dword [esp + 0x2c], ebx
cmp eax, ebx
je 0x447878
lea ecx, [esp + 0x2c]
push ecx
push 0x16
call eax
mov dword [esp + 0x2064], ebx
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x38]
push edx
mov ecx, str.HKCUSoftwareClasses_
mov byte [esp + 0x2068], 1
call fcn.00406bd0
lea eax, [esp + 0x24]
push eax
mov ecx, str.HKCR_
mov byte [esp + 0x2068], 2
call fcn.00406bd0
mov byte [esp + 0x2064], 3
cmp esi, ebx
jne 0x4478c1
xor eax, eax
jmp 0x4478d5
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4478c6
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x40]
push ecx
call fcn.00415640
cmp esi, ebx
jne 0x4478e9
xor eax, eax
jmp 0x4478ff
mov eax, esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4478f0
sub eax, edx
sar eax, 1
push eax
push esi
lea edx, [esp + 0x2c]
push edx
call fcn.00415640
mov byte [esp + 0x23], bl
mov dword [esp + 0x18], ebx
lea esi, [esp + 0x44]
lea eax, [esp + 0x2c]
call fcn.0044b590
mov byte [esp + 0x2064], 5
mov esi, dword [eax]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ebx, str._shell_
mov dword [esp + 0x1c], 1
call fcn.0040ab10
add esp, 8
mov ebp, eax
mov dword [esp + 0x2064], 6
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0x14], 3
cmp eax, ebx
je 0x447974
mov dword [esp + 0x18], ebx
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
mov ebp, dword [ebp]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x10]
push ebx
push ebp
push esi
call eax
test eax, eax
je 0x4479a6
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4479a6
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
cmp eax, ebx
je 0x4479a6
xor bl, bl
jmp 0x4479a8
mov bl, 1
mov dword [esp + 0x2064], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x14], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4479db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x2064], ebp
call fcn.00409540
test bl, bl
je 0x447b15
lea esi, [esp + 0x44]
lea eax, [esp + 0x2c]
call fcn.0044b590
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
mov byte [esp + 0x2068], 7
mov esi, dword [eax]
push edx
mov ebx, str._shell_
mov dword [esp + 0x1c], ebp
call fcn.0040ab10
add esp, 8
mov ebx, eax
mov dword [esp + 0x2064], 8
mov eax, dword [esp + 0x18]
xor ebp, ebp
mov dword [esp + 0x14], 0xc
cmp eax, ebp
je 0x447a55
mov dword [esp + 0x18], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], ebp
mov ebx, dword [ebx]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push ebp
push ebx
push esi
call edx
test eax, eax
je 0x447a86
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x447a86
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
cmp eax, ebp
je 0x447a86
xor bl, bl
jmp 0x447a88
mov bl, 1
mov dword [esp + 0x2064], 7
mov eax, dword [esp + 0x30]
mov esi, 4
add eax, 0xfffffff0
mov dword [esp + 0x14], esi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447abc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2064], esi
call fcn.00409540
test bl, bl
je 0x447b15
mov eax, dword [esp + 0x18]
mov byte [esp + 0x23], 1
test eax, eax
je 0x447aed
mov dword [esp + 0x18], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [0x51a22c]
test ecx, ecx
je 0x447b04
lea eax, [esp + 0x18]
push eax
push 3
call ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x447b15
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0x4f6260
push eax
call edx
lea esi, [esp + 0x44]
lea eax, [esp + 0x2c]
call fcn.0044b590
mov byte [esp + 0x2064], 9
mov ebp, dword [eax]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ebx, str._shell_
mov dword [esp + 0x1c], 0x10
call fcn.0040ab10
add esp, 8
mov esi, eax
mov dword [esp + 0x2064], 0xa
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], 0x30
test eax, eax
je 0x447b72
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x28]
call eax
jmp 0x447b77
mov eax, 0x4f05c4
lea ecx, [esp + 0x3c]
push esi
push ecx
mov ebx, eax
call fcn.0040ab10
push eax
lea edx, [esp + 0x3c]
mov dword [esp + 0x2070], 0xb
mov edi, 0x70
push edx
mov ebx, str.command_
mov dword [esp + 0x24], edi
call fcn.0040ab10
add esp, 0x10
mov esi, eax
mov dword [esp + 0x2064], 0xc
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], 0xf0
cmp eax, ebx
je 0x447bd6
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
mov esi, dword [esi]
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push ebx
push esi
push ebp
call edx
test eax, eax
je 0x447c08
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x447c08
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
cmp eax, ebx
jle 0x447c08
mov bl, 1
jmp 0x447c0a
xor bl, bl
mov dword [esp + 0x2064], 0xb
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x14], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447c39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2064], 0xa
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0x30
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447c6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2064], 9
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447c9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2064], 4
call fcn.00409540
test bl, bl
jne 0x44816f
lea esi, [esp + 0x44]
lea eax, [esp + 0x2c]
call fcn.0044b590
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
mov byte [esp + 0x2068], 0xd
mov ebp, dword [eax]
push edx
mov ebx, str._shell_
mov dword [esp + 0x1c], 0x100
call fcn.0040ab10
add esp, 8
mov esi, eax
mov dword [esp + 0x2064], 0xe
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], 0x300
test eax, eax
je 0x447d18
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push eax
call edx
jmp 0x447d1d
mov eax, 0x4f05c4
lea ecx, [esp + 0x3c]
push esi
push ecx
mov ebx, eax
call fcn.0040ab10
push eax
lea edx, [esp + 0x34]
mov dword [esp + 0x2070], 0xf
mov edi, 0x700
push edx
mov ebx, str.command_
mov dword [esp + 0x24], edi
call fcn.0040ab10
add esp, 0x10
mov esi, eax
mov dword [esp + 0x2064], 0x10
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], 0xf00
cmp eax, ebx
je 0x447d7c
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
mov esi, dword [esi]
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push ebx
push esi
push ebp
call edx
test eax, eax
je 0x447daf
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x447daf
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
cmp eax, ebx
mov byte [esp + 0x22], 1
jg 0x447db3
mov byte [esp + 0x22], bl
mov dword [esp + 0x2064], 0xf
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x14], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447de2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2064], 0xe
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0x300
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447e15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2064], 0xd
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0x100
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447e48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2064], 4
call fcn.00409540
cmp byte [esp + 0x22], bl
je 0x447e75
mov byte [esp + 0x2064], 3
mov eax, dword [esp + 0x18]
cmp eax, ebx
jmp 0x44817d
cmp byte [esp + 0x23], bl
jne 0x447e8e
mov byte [esp + 0x2064], 3
mov eax, dword [esp + 0x18]
cmp eax, ebx
jmp 0x44817d
mov dword [esp + 0x34], ebx
lea esi, [esp + 0x44]
lea eax, [esp + 0x2c]
call fcn.0044b590
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
mov byte [esp + 0x2068], 0x12
mov esi, dword [eax]
mov edi, 0x1000
push edx
mov ebx, str._shell_
mov dword [esp + 0x1c], edi
call fcn.0040ab10
add esp, 8
mov ebx, eax
mov dword [esp + 0x2064], 0x13
mov eax, dword [esp + 0x34]
xor ebp, ebp
mov dword [esp + 0x14], 0x3000
cmp eax, ebp
je 0x447ef4
mov dword [esp + 0x34], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], ebp
mov ebx, dword [ebx]
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push ebp
push ebx
push esi
call edx
test eax, eax
je 0x447f25
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x447f25
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push eax
call edx
cmp eax, ebp
jbe 0x447f25
mov bl, 1
jmp 0x447f27
xor bl, bl
mov dword [esp + 0x2064], 0x12
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x14], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447f56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2064], 0x11
call fcn.00409540
test bl, bl
je 0x448157
lea esi, [esp + 0x28]
lea ecx, [esp + 0x34]
call fcn.0044b530
mov esi, dword [eax]
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x447fa9
cmp esi, ebp
je 0x447f99
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x447fa5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x447fb9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea esi, [esp + 0x44]
lea eax, [esp + 0x2c]
call fcn.0044b590
mov byte [esp + 0x2064], 0x14
mov ebp, dword [eax]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ebx, str._shell_
mov dword [esp + 0x1c], 0x4000
call fcn.0040ab10
add esp, 8
mov esi, eax
mov dword [esp + 0x2064], 0x15
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], 0xc000
test eax, eax
je 0x448016
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x28]
call eax
jmp 0x44801b
mov eax, 0x4f05c4
lea ecx, [esp + 0x3c]
push esi
push ecx
mov ebx, eax
call fcn.0040ab10
push eax
lea edx, [esp + 0x34]
mov dword [esp + 0x2070], 0x16
mov edi, 0x1c000
push edx
mov ebx, str.command_
mov dword [esp + 0x24], edi
call fcn.0040ab10
add esp, 0x10
mov esi, eax
mov dword [esp + 0x2064], 0x17
mov eax, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x14], 0x3c000
cmp eax, ebx
je 0x44807a
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
mov esi, dword [esi]
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
push ebx
push esi
push ebp
call edx
test eax, eax
je 0x4480ac
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4480ac
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
cmp eax, ebx
jle 0x4480ac
mov bl, 1
jmp 0x4480ae
xor bl, bl
mov dword [esp + 0x2064], 0x16
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x14], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4480dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2064], 0x15
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xc000
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x448110
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2064], 0x14
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0x4000
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x448143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x2064], 0x11
call fcn.00409540
mov byte [esp + 0x2064], 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x44816f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x2064], 3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x448187
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x2064], 2
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4481af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2064], 1
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4481d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x448201
mov dword [esp + 0x2064], 0xffffffff
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4481fa
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
jmp 0x44828d
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push eax
call edx
test eax, eax
je 0x448246
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44821f
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push eax
call edx
jmp 0x448224
mov eax, 0x4f05c4
push 0x1000
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x448246
mov edi, dword [esp + 0x40]
lea edx, [esp + 0x54]
call fcn.00406b90
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
mov eax, dword [eax - 0xc]
xor ecx, ecx
test eax, eax
setg cl
mov byte [esp + 0x2064], 0
mov eax, dword [esp + 0x1c]
mov esi, ecx
test eax, eax
je 0x448270
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x2064], 0xffffffff
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x44828b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x205c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2040]
xor ecx, esp
call fcn.004c961b
add esp, 0x2054
ret