Function at 0x40c790
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415074
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x84c
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_swprintf]
cmp eax, ebx
push edi
jne 0x40c7f1
lea eax, [esp + 0x14]
push eax
call fcn.00407450
mov ecx, dword [eax]
add esp, 4
lea edx, [esp + 0x244]
push str.tvt.txt
push ecx
push 0x41c15c
push edx
call esi
add esp, 0x10
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::CString
jmp 0x40c803
push eax
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::CString_1
mov eax, dword [esp + 0x86c]
mov dword [esp + 0x864], ebx
cmp eax, 1
mov dword [esp + 0x24], ebx
je 0x40c83e
lea ecx, [esp + 0x10]
mov dword [esp + 0x864], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
jmp 0x40ce09
mov edi, dword [esp + 0x874]
lea ecx, [esp + 0x244]
push edi
lea edx, [esp + 0x34]
push ecx
push edx
push 1
call fcn.004077b0
mov eax, dword [esp + 0x40]
add esp, 0x10
cmp ax, bx
jne 0x40c8bc
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x41c198
call fcn.00413dc4
push ecx
mov byte [esp + 0x870], 1
mov ecx, esp
mov dword [esp + 0x28], esp
push str.SetFilter_couldnt_get_backup_drive_letter
call fcn.00413dc4
mov byte [esp + 0x870], bl
call fcn.00406ff0
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x864], 0xffffffff
call sub.MFC42u.DLL_CString::CString
or eax, 0xffffffff
jmp 0x40ce09
lea ecx, [esp + 0x40]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
call fcn.004085a0
mov eax, dword [esp + 0x3c]
mov ebp, dword [sym.imp.MSVCRT.dll__wgetenv]
mov edx, 1
push 0x41de54
lea ecx, [eax - 0x41]
shl edx, cl
mov dword [esp + 0x34], edx
call ebp
add esp, 0x10
push eax
lea eax, [esp + 0x450]
push str._spreboot
push eax
call esi
push 0x41de54
call ebp
add esp, 0x10
lea ecx, [esp + 0x654]
push eax
push str._sminint
push ecx
call esi
push 0x41de54
call ebp
mov cx, word [eax]
mov eax, 1
sub ecx, 0x41
lea edx, [esp + 0x254]
shl eax, cl
mov ecx, dword [esp + 0x34]
push edi
push edx
or ecx, eax
lea eax, [esp + 0x28]
push eax
push 1
mov dword [esp + 0x44], ecx
call fcn.00407c60
mov ecx, dword [esp + 0x30]
push 0x4207b8
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x28
cmp eax, ebx
je 0x40cdf0
cmp dword [esp + 0x24], ebx
je 0x40cdf0
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x44]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
push edx
push ebx
lea eax, [esp + 0x4c]
push 0x80
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
mov byte [esp + 0x884], 2
mov dword [esp + 0x54], ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [esp + 0x878], bl
jne 0x40c9d5
push 0x4207b8
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::operator_2
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x34]
lea eax, [esp + 0x20]
push edx
push eax
push str.IBMFilter
call fcn.0040df20
mov eax, dword [esp + 0x40]
add esp, 0xc
cmp eax, ebx
je 0x40ca3c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 3
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_load_driver
call fcn.00413dc4
push ebx
mov byte [esp + 0x870], 2
call fcn.00406a10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40cd8f
mov al, byte [esp + 0x87c]
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp al, bl
je 0x40cae0
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push 0x83000004
push edx
call esi
cmp eax, ebx
jne 0x40ca92
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 4
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_STARTFILTER_IOCTL
jmp 0x40ca19
lea eax, [esp + 0x28]
push ebx
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push 4
push ecx
lea edx, [esp + 0x34]
push 4
push edx
push 0x83000000
push eax
call esi
cmp eax, ebx
jne 0x40cae0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 5
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_SETDRIVES_IOCTL
jmp 0x40ca19
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ebx
push ecx
push ebx
push ebx
lea edx, [esp + 0x54]
push 0x80
push edx
push 0x830000c0
push eax
call esi
cmp eax, ebx
jne 0x40cb2c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 6
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_SENDBACKUPFILE_IOCTL
jmp 0x40ca19
cmp byte [esp + 0x878], bl
je 0x40cb5c
push str.SystemDrive
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
lea ecx, [esp + 0x144]
push eax
push 0x41f468
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x40cb6c
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push ebx
push edx
push ebx
push ebx
lea eax, [esp + 0x154]
push 0x80
push eax
push 0x830000c4
push ecx
call esi
cmp eax, ebx
jne 0x40cbbb
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 7
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_SENDPREBOOTFILE_IOCTL
jmp 0x40ca19
cmp byte [esp + 0x878], bl
je 0x40cbeb
push str.SystemDrive
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
lea edx, [esp + 0xc4]
push eax
push 0x41f410
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x40cbfb
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0xc4]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push ebx
push eax
push ebx
push ebx
lea ecx, [esp + 0xd4]
push 0x80
push ecx
push 0x830000c8
push edx
call esi
cmp eax, ebx
jne 0x40cc4a
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_SENDDATAFILE_IOCTL
jmp 0x40ca19
lea ecx, [esp + 0x2c]
call sub.MFC42u.DLL_CString::CString_1
push str.RRUbackups
push 0x41de54
mov byte [esp + 0x86c], 9
call ebp
add esp, 4
push eax
lea eax, [esp + 0x34]
push 0x41c15c
push eax
call sub.MFC42u.DLL_CString::Format
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x18
cmp eax, ebx
je 0x40cd21
cmp byte [esp + 0x878], bl
je 0x40ccc5
push str.SystemDrive
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
push eax
lea eax, [esp + 0x1c8]
push str._sRRUbackups
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x40ccd5
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x1c4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ebx
push ecx
push ebx
push ebx
lea edx, [esp + 0x1d4]
push 0x80
push edx
push 0x830000cc
push eax
call esi
cmp eax, ebx
jne 0x40cd21
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 0xa
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_IOCTL_FFDRIVER_SENDSECONDBACKUPFILE_IOCTL
jmp 0x40cd60
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push 0x83000038
push edx
call esi
cmp eax, ebx
jne 0x40cdb7
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SetFilter
call fcn.00413dc4
push ecx
mov byte [esp + 0x86c], 0xb
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Unable_to_send_ENCRYPT_OFF_IOCTL
call fcn.00413dc4
push ebx
mov byte [esp + 0x870], 9
call fcn.00406a10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x864], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x864], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x864], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, esi
jmp 0x40ce09
lea ecx, [esp + 0x2c]
mov byte [esp + 0x864], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x864], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x864], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
jmp 0x40ce09
lea ecx, [esp + 0x10]
mov dword [esp + 0x864], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x858
ret