Function at 0x481b50
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
cmp byte [0x505e4c], 0
jne 0x48284e
push ebx
push edi
push esi
sub esp, 0x114
mov byte [0x505e4c], 1
mov dword [0x505e50], 0
mov dword [0x505e54], 0
mov esi, dword [0x5052b0]
mov dword [0x505e58], esi
mov dword [0x505e5c], 0x104
push 0x104
call sym._malloc
add esp, 4
mov byte [eax], 0
mov dword [0x505e64], eax
mov dword [0x505e60], 0
mov dword [0x505e74], 0x4fb140
mov dword [0x505e78], 0
mov dword [0x505e7c], 0
mov dword [0x505e80], esi
mov dword [0x505e68], 0
mov dword [0x505e6c], 0
mov dword [0x505e70], esi
mov dword [0x505e84], 0
mov dword [0x505e88], 0
mov dword [0x505e8c], esi
mov dword [0x505e90], 0
mov dword [0x505e94], 0
mov dword [0x505e98], esi
mov dword [0x505e9c], 0
mov dword [0x505ea0], 0
call dbg.ffDetectShell
mov esi, dword [0x505e44]
test esi, esi
je 0x481df7
mov dword [esp + 0x14], 0
mov ebx, esp
lea edi, [esp + 0x14]
jmp 0x481c88
mov eax, dword [0x505e80]
mov byte [eax], 0
mov dword [0x505e7c], 0
mov dword [0x505e74], 0x4fb140
mov esi, dword [esp + 0x14]
test esi, esi
je 0x481df7
mov ecx, esi
mov edx, edi
push ebx
push 0x505e78
push 0x505e74
push 0x505e5c
push 0x505e50
call sym._getProcessInfo
add esp, 0x14
test al, al
je 0x481df7
cmp byte [esp], 0
jne 0x481d60
cmp dword [0x505e50], 0
je 0x481cd0
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x481cda
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
cmp dword [0x505e68], 0
je 0x481d00
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x481d0a
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
cmp dword [0x505e5c], 0
je 0x481d30
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x481d3a
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
cmp dword [0x505e78], 0
jne 0x481c60
mov eax, dword [0x5052b0]
mov dword [0x505e80], eax
jmp 0x481c68
push 0x505e50
push 0x505e68
call dbg.ffStrbufSet
add esp, 8
mov eax, dword [0x505e6c]
cmp eax, 4
jb 0x481db0
mov ecx, dword [0x505e70]
add eax, ecx
add eax, 0xfffffffc
push str..exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x481db0
mov eax, dword [0x505e6c]
add eax, 0xfffffffc
push eax
push 0x505e68
call sym._ffStrbufSubstrBefore
add esp, 8
push str.sihost
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x481f79
push str.explorer
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x481f79
mov dword [0x505e9c], esi
mov eax, dword [esp + 0x14]
mov dword [0x505ea0], eax
cmp dword [0x505e54], 0
jne 0x48262b
push str.ConEmuPID
call sym._getenv
add esp, 4
test eax, eax
je 0x481eb3
push 0xa
push 0
push eax
call sym._strtoul
add esp, 0xc
mov dword [0x505e9c], eax
mov ecx, eax
xor edx, edx
push 0
push 0x505e78
push 0x505e74
push 0x505e5c
push 0x505e50
call sym._getProcessInfo
add esp, 0x14
mov esi, str.ConEmu
test al, al
je 0x481eb5
push 0x505e50
push 0x505e68
call dbg.ffStrbufSet
add esp, 8
mov eax, dword [0x505e6c]
cmp eax, 4
jb 0x4822a9
mov ecx, dword [0x505e70]
add eax, ecx
add eax, 0xfffffffc
push str..exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4822a9
mov eax, dword [0x505e6c]
add eax, 0xfffffffc
push eax
push 0x505e68
call sym._ffStrbufSubstrBefore
add esp, 8
jmp 0x4822a9
xor esi, esi
push str.SSH_CONNECTION
call sym._getenv
add esp, 4
test eax, eax
je 0x481ed5
push str.SSH_TTY
call sym._getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x481f66
push str.WT_SESSION
call sym._getenv
add esp, 4
mov esi, str.WindowsTerminal
test eax, eax
jne 0x481f66
push str.WT_PROFILE_ID
call sym._getenv
add esp, 4
test eax, eax
jne 0x481f66
push str.ALACRITTY_SOCKET
call sym._getenv
add esp, 4
mov esi, str.Alacritty
test eax, eax
jne 0x481f66
push str.ALACRITTY_LOG
call sym._getenv
add esp, 4
test eax, eax
jne 0x481f66
push str.ALACRITTY_WINDOW_ID
call sym._getenv
add esp, 4
test eax, eax
jne 0x481f66
push str.TERM_PROGRAM
call sym._getenv
add esp, 4
mov esi, eax
test eax, eax
jne 0x481f66
push str.TERM
call sym._getenv
add esp, 4
mov esi, eax
test eax, eax
je 0x4822a9
cmp dword [0x505e50], 0
je 0x481f93
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x481f9d
cmp dword [0x505e50], 0
je 0x48201a
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x482024
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
push esi
call sym._strlen
add esp, 4
test esi, esi
je 0x4820fb
mov edi, eax
test eax, eax
je 0x4820fb
mov eax, dword [0x505e50]
mov ecx, eax
sub ecx, 1
jb 0x481fde
cmp ecx, edi
jb 0x481fde
xor ecx, ecx
mov eax, dword [0x505e58]
jmp 0x4820d8
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, edi
inc edx
nop dword [eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x481ff0
test eax, eax
je 0x4820bf
push ebx
push dword [0x505e58]
call sym._realloc
add esp, 8
mov ecx, dword [0x505e54]
jmp 0x4820cd
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
cmp dword [0x505e68], 0
je 0x482041
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x48204b
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
cmp dword [0x505e5c], 0
je 0x482068
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x482072
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
cmp dword [0x505e78], 0
je 0x48208f
mov eax, dword [0x505e80]
mov byte [eax], 0
jmp 0x482099
mov eax, dword [0x5052b0]
mov dword [0x505e80], eax
mov dword [0x505e7c], 0
mov dword [0x505e74], 0x4fb140
cmp dword [0x505e54], 0
jne 0x48262b
jmp 0x481e04
push ebx
call sym._malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
mov dword [0x505e58], eax
mov dword [0x505e50], ebx
add ecx, eax
push edi
push esi
push ecx
call sym._memcpy
add esp, 0xc
mov eax, dword [0x505e54]
add eax, edi
mov dword [0x505e54], eax
mov ecx, dword [0x505e58]
mov byte [ecx + eax], 0
cmp dword [0x505e68], 0
je 0x48210e
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x482118
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
push esi
call sym._strlen
add esp, 4
test esi, esi
je 0x4821cf
mov edi, eax
test eax, eax
je 0x4821cf
mov eax, dword [0x505e68]
mov ecx, eax
sub ecx, 1
jb 0x482156
cmp ecx, edi
jb 0x482156
xor ecx, ecx
mov eax, dword [0x505e70]
jmp 0x4821ac
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, edi
inc edx
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x482170
test eax, eax
je 0x482193
push ebx
push dword [0x505e70]
call sym._realloc
add esp, 8
mov ecx, dword [0x505e6c]
jmp 0x4821a1
push ebx
call sym._malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
mov dword [0x505e70], eax
mov dword [0x505e68], ebx
add ecx, eax
push edi
push esi
push ecx
call sym._memcpy
add esp, 0xc
mov eax, dword [0x505e6c]
add eax, edi
mov dword [0x505e6c], eax
mov ecx, dword [0x505e70]
mov byte [ecx + eax], 0
cmp dword [0x505e5c], 0
je 0x4821e2
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x4821ec
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
push esi
call sym._strlen
add esp, 4
test esi, esi
je 0x48229f
mov edi, eax
test eax, eax
je 0x48229f
mov eax, dword [0x505e5c]
mov ecx, eax
sub ecx, 1
jb 0x48222a
cmp ecx, edi
jb 0x48222a
xor ecx, ecx
mov eax, dword [0x505e64]
jmp 0x48227c
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, edi
inc edx
nop dword [eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x482240
test eax, eax
je 0x482263
push ebx
push dword [0x505e64]
call sym._realloc
add esp, 8
mov ecx, dword [0x505e60]
jmp 0x482271
push ebx
call sym._malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
mov dword [0x505e64], eax
mov dword [0x505e5c], ebx
add ecx, eax
push edi
push esi
push ecx
call sym._memcpy
add esp, 0xc
mov eax, dword [0x505e60]
add eax, edi
mov dword [0x505e60], eax
mov ecx, dword [0x505e64]
mov byte [ecx + eax], 0
mov dword [0x505e74], 0x4fb140
cmp dword [0x505e54], 0
jne 0x48262b
lea esi, [esp + 0x14]
push 0x100
push str.SOFTWAREClassesPackagedComClassIndex_
push esi
call sym._memcpy
add esp, 0xc
lea edi, [esp + 0x64]
mov dword [esp + 0x10], 0x50
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 2
push str.DelegationTerminal
push str.Console__Startup
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x482390
push str.SystemRoot
call sym._getenv
add esp, 4
push eax
push str._sSystem32conhost.exe
push 0x505e5c
call dbg.ffStrbufSetF
add esp, 0xc
push dword [0x505e64]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x482376
cmp dword [0x505e50], 0
je 0x482483
mov eax, dword [0x505e58]
mov byte [eax], 0
mov ecx, dword [0x505e50]
mov dword [0x505e54], 0
test ecx, ecx
je 0x482497
cmp ecx, 0xc
jae 0x482854
xor eax, eax
cmp ecx, 1
ja 0x4824a0
jmp 0x482499
cmp dword [0x505e5c], 0
je 0x482544
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x48254e
push str.00000000_0000_0000_0000_000000000000
push edi
call sym._wcscmp
add esp, 8
test eax, eax
je 0x482300
push str.B23D10C0_E52E_411E_9D5B_C09FDF709C7D
push edi
call sym._wcscmp
add esp, 8
test eax, eax
je 0x482300
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48246b
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
mov eax, esp
push 0
push eax
push 0
push dword [esp + 0x18]
call dbg.ffRegGetSubKey
add esp, 0x10
test al, al
je 0x48244a
cmp dword [esp + 4], 0x19
jb 0x48244a
mov eax, dword [esp + 8]
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 9]
pcmpeqb xmm1, xmmword [str..WindowsTerminalMicrosoft.Window]
pcmpeqb xmm0, xmmword [0x4fb130]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x48286c
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x48246b
mov dword [esp], 0
push dword [esp + 8]
call sym._free
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x482300
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x482300
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
mov al, 1
mov ecx, 0x20
nop
mov esi, ecx
add ecx, ecx
cmp esi, 0xc
jb 0x4824a0
test al, al
je 0x4824bd
push esi
call sym._malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
jmp 0x4824d2
push esi
push dword [0x505e58]
call sym._realloc
add esp, 8
mov ecx, dword [0x505e54]
mov dword [0x505e58], eax
mov dword [0x505e50], esi
mov dword [eax + ecx + 7], 0x6578652e
mov dword [eax + ecx + 4], 0x2e74736f
mov dword [eax + ecx], 0x686e6f63
mov eax, dword [0x505e54]
lea ecx, [eax + 0xb]
mov dword [0x505e54], ecx
mov ecx, dword [0x505e58]
mov byte [ecx + eax + 0xb], 0
cmp dword [0x505e68], 0
je 0x48255d
mov eax, dword [0x505e70]
mov byte [eax], 0
mov ecx, dword [0x505e68]
mov dword [0x505e6c], 0
test ecx, ecx
je 0x482571
cmp ecx, 8
jae 0x482860
xor eax, eax
cmp ecx, 1
ja 0x482580
jmp 0x482573
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
jmp 0x48261e
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
mov al, 1
mov ecx, 0x20
nop dword [eax + eax]
mov esi, ecx
add ecx, ecx
cmp esi, 8
jb 0x482580
test al, al
je 0x48259d
push esi
call sym._malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
jmp 0x4825b2
push esi
push dword [0x505e70]
call sym._realloc
add esp, 8
mov ecx, dword [0x505e6c]
mov dword [0x505e70], eax
mov dword [0x505e68], esi
mov dword [eax + ecx + 3], 0x74736f68
mov dword [eax + ecx], 0x686e6f63
mov eax, dword [0x505e6c]
lea ecx, [eax + 7]
mov dword [0x505e6c], ecx
mov ecx, dword [0x505e70]
mov byte [ecx + eax + 7], 0
mov eax, dword [0x505e64]
mov edx, dword [0x505e60]
test edx, edx
je 0x482610
mov esi, edx
mov ecx, edx
nop dword [eax + eax]
sub ecx, 1
jb 0x482614
cmp byte [eax + esi - 1], 0x5c
mov esi, ecx
jne 0x482600
jmp 0x482616
xor ecx, ecx
jmp 0x482616
mov ecx, edx
add eax, ecx
inc eax
mov dword [0x505e74], eax
cmp dword [0x505e54], 0
je 0x482845
push str.WindowsTerminal
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4826f6
push str.conhost
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x48275f
push str.Code
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4827a3
push str.explorer
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4827e4
mov esi, dword [0x505e70]
push str.wezterm_gui
push esi
call sym._strcmp
add esp, 8
test eax, eax
jne 0x48282e
cmp dword [0x505e68], 0
je 0x4826dd
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push esi
call sym._free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.WezTerm
mov eax, 7
jmp 0x482823
push str..WindowsTerminalPreview_
push dword [0x505e64]
call sym._StrStrIA_8
mov esi, eax
test eax, eax
mov eax, str.Windows_Terminal
mov edi, str.Windows_Terminal_Preview
cmove edi, eax
cmp dword [0x505e68], 0
je 0x482742
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sym._free
add esp, 4
xor eax, eax
test esi, esi
setne al
mov dword [0x505e68], 0
lea eax, [eax*8 + 0x10]
jmp 0x482823
cmp dword [0x505e68], 0
je 0x48278a
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sym._free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.Console_Window_Host
mov eax, 0x13
jmp 0x482823
cmp dword [0x505e68], 0
je 0x4827ce
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sym._free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.Visual_Studio_Code
mov eax, 0x12
jmp 0x482823
cmp dword [0x505e68], 0
je 0x48280f
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sym._free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.Windows_Explorer
mov eax, 0x10
mov dword [0x505e6c], eax
mov dword [0x505e70], edi
push 0x505e84
push 0x505e5c
push 0x505e50
call dbg.fftsGetTerminalVersion
add esp, 0xc
add esp, 0x114
pop esi
pop edi
pop ebx
mov eax, 0x505e50
ret
xor ecx, ecx
mov eax, dword [0x505e58]
jmp 0x4824dd
xor ecx, ecx
mov eax, dword [0x505e70]
jmp 0x4825bd
cmp dword [0x505e50], 0
je 0x48287f
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x482889
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
push str.WindowsTerminal.exe
push 0x13
push 0x505e50
call sym._ffStrbufAppendNS
add esp, 0xc
cmp dword [0x505e68], 0
je 0x4828ba
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x4828c4
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
push str.WindowsTerminal
push 0xf
push 0x505e68
call sym._ffStrbufAppendNS
add esp, 0xc
push str.ProgramFiles
call sym._getenv
add esp, 4
push dword [esp + 8]
push eax
push str._sWindowsApps_sWindowsTerminal.exe
push 0x505e5c
call dbg.ffStrbufSetF
add esp, 0x10
push dword [0x505e64]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x482939
mov eax, dword [0x505e64]
mov edx, dword [0x505e60]
test edx, edx
je 0x48298b
mov esi, edx
mov ecx, edx
sub ecx, 1
jb 0x48298f
cmp byte [eax + esi - 1], 0x5c
mov esi, ecx
jne 0x482929
jmp 0x482991
cmp dword [0x505e5c], 0
mov dword [0x505e60], 0
je 0x482964
mov dword [0x505e5c], 0
push dword [0x505e64]
call sym._free
add esp, 4
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x505e5c], eax
mov eax, dword [esp + 8]
mov dword [0x505e64], eax
mov dword [0x505e60], ecx
mov dword [0x505e74], 0x4fb140
jmp 0x4829ba
xor ecx, ecx
jmp 0x482991
mov ecx, edx
add eax, ecx
inc eax
mov dword [0x505e74], eax
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x4829ba
mov dword [esp], 0
push dword [esp + 8]
call sym._free
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x48261e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48261e