Function at 0x411363
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1488
call fcn.00444090
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x1b98]
xor esi, esi
cmp dword [eax], esi
je 0x4113ab
mov ebx, edi
call fcn.0040a15e
lea eax, [edi + 0xac]
push eax
call fcn.00408d7f
lea eax, [edi + 0x98]
call fcn.0040a5e2
lea eax, [edi + 0x1b70]
call fcn.004439b4
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 4], esi
je 0x411642
push 0x208
lea eax, [ebp - 0x672]
push esi
push eax
mov dword [edi + 0x1b94], esi
mov word [ebp - 0x674], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea ebx, [ebp - 0x674]
call fcn.0040fedb
mov eax, ebx
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
cmp eax, esi
pop ecx
pop ecx
je 0x4113fa
mov word [eax], si
mov eax, dword [edi + 0x1b98]
mov ebx, dword [eax + 0x20]
cmp ebx, esi
lea edx, [ebp - 0x674]
mov dword [ebp - 8], esi
je 0x41141a
lea ecx, [eax + 0x28]
cmp word [ecx], si
je 0x41141a
mov edx, ecx
cmp dword [eax + 0x24], esi
je 0x41142d
lea ecx, [eax + 0x232]
cmp word [ecx], si
je 0x41142d
mov dword [ebp - 8], ecx
cmp ebx, esi
je 0x41149a
cmp word [eax + 0x28], si
je 0x41149a
push dword [ebp - 8]
add eax, 0x43c
push edx
lea ecx, [edi + 0xb0]
push eax
push ecx
call fcn.0040731d
lea eax, [ebp - 0x2c]
call fcn.00408595
push eax
mov eax, dword [edi + 0x1b98]
add eax, 0x28
push eax
call fcn.004112e7
cmp dword [ebp - 0x10], esi
mov ebx, 0x43c
jle 0x4114db
push dword [ebp - 8]
mov ecx, esi
lea eax, [ebp - 0x2c]
call fcn.004086e7
push eax
mov eax, dword [edi + 0x1b98]
add eax, ebx
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.0040731d
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x41146f
jmp 0x4114db
lea eax, [ebp - 0x2c]
call fcn.00408595
push eax
call fcn.0041045e
cmp dword [ebp - 0x10], esi
mov ebx, 0x43c
jle 0x4114db
push dword [ebp - 8]
mov ecx, esi
lea eax, [ebp - 0x2c]
call fcn.004086e7
push eax
mov eax, dword [edi + 0x1b98]
add eax, ebx
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.0040731d
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x4114b2
lea esi, [ebp - 0x2c]
call fcn.004085b7
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 0x20], 0
jne 0x411640
lea eax, [ebp - 0x44]
call fcn.004128d0
push eax
call fcn.00412922
lea eax, [ebp - 0x44]
push eax
call fcn.00412b7b
test eax, eax
mov dword [ebp - 0xc], eax
je 0x411635
and word [ebp - 0x884], 0
mov esi, 0x208
push esi
lea eax, [ebp - 0x882]
push 0
push eax
call sub.msvcrt.dll_memset
and word [ebp - 0xa94], 0
add esp, 0xc
push esi
lea eax, [ebp - 0xa92]
push 0
push eax
call sub.msvcrt.dll_memset
and word [ebp - 0x254], 0
add esp, 0xc
push esi
lea eax, [ebp - 0x252]
push 0
push eax
call sub.msvcrt.dll_memset
and word [ebp - 0x464], 0
add esp, 0xc
push esi
lea eax, [ebp - 0x462]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xc]
add eax, 4
add esp, 0xc
push eax
lea esi, [ebp - 0x884]
call fcn.00407be3
mov eax, esi
pop ecx
push eax
lea esi, [ebp - 0xa94]
call fcn.00407be3
mov eax, esi
pop ecx
push eax
lea esi, [ebp - 0x254]
call fcn.00407be3
cmp word [ebp - 0x254], 0
pop ecx
je 0x411635
push 0x44b7a8
call sub.msvcrt.dll_wcslen
mov esi, eax
pop ecx
lea eax, [ebp - 0x254]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [esi + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x4115fd
lea eax, [ebp - 0x254]
push 0x44b7a8
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411605
and word [ebp - 0x464], 0
lea eax, [ebp - 0x464]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
je 0x411635
push dword [ebp - 8]
lea eax, [ebp - 0x464]
push eax
mov eax, dword [edi + 0x1b98]
add eax, ebx
push eax
add edi, 0xb0
push edi
call fcn.0040731d
lea edi, [ebp - 0x44]
call fcn.004128ff
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 0x14], esi
je 0x411728
lea eax, [ebp - 0x2c]
mov dword [edi + 0x1b94], 0xb
call fcn.00408595
push eax
call fcn.0041024d
push 0x208
lea eax, [ebp - 0x252]
push esi
push eax
mov word [ebp - 0x254], si
call sub.msvcrt.dll_memset
add esp, 0xc
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_seamonkey.exe
push 0x80000002
lea esi, [ebp - 0x254]
call fcn.004133a2
add esp, 0xc
cmp word [ebp - 0x254], 0
je 0x4116b9
mov eax, esi
push eax
call fcn.00407b0b
test eax, eax
pop ecx
jne 0x4116ee
push 0x104
lea eax, [ebp - 0x254]
push eax
push str._programfiles_Sea_Monkey
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x254]
push eax
xor edi, edi
call fcn.00406412
test eax, eax
mov edi, dword [ebp + 8]
jne 0x4116ee
and word [ebp - 0x254], ax
jmp 0x41171e
xor esi, esi
cmp dword [ebp - 0x10], esi
jle 0x41171e
lea ebx, [edi + 0xb0]
lea eax, [ebp - 0x254]
push eax
mov ecx, esi
lea eax, [ebp - 0x2c]
call fcn.004086e7
push eax
push 0x44551c
push ebx
call fcn.0040731d
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x4116fb
lea esi, [ebp - 0x2c]
call fcn.004085b7
xor esi, esi
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 0x18], esi
je 0x4117ec
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x252]
push esi
push eax
mov word [ebp - 0x254], si
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x672]
push esi
push eax
mov word [ebp - 0x674], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
pop eax
lea ebx, [ebp - 0x674]
call fcn.00413a56
mov eax, ebx
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.YandexYandexBrowserUser_DataDefaultLogin_Data
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x4117b7
lea eax, [ebp - 0x674]
push str.YandexYandexBrowserUser_DataDefaultLogin_Data
push eax
lea eax, [ebp - 0x254]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x4117be
mov word [ebp - 0x254], si
lea eax, [ebp - 0x254]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
je 0x4117ec
lea eax, [ebp - 0x254]
push eax
lea eax, [edi + 0x2e0]
push eax
mov dword [edi + 0x1b94], 0xd
call fcn.00402879
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 0x1c], esi
je 0x4118b0
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x252]
push esi
push eax
mov word [ebp - 0x254], si
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x672]
push esi
push eax
mov word [ebp - 0x674], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
pop eax
lea ebx, [ebp - 0x674]
call fcn.00413a56
mov eax, ebx
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.VivaldiUser_DataDefaultLogin_Data
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x41187b
lea eax, [ebp - 0x674]
push str.VivaldiUser_DataDefaultLogin_Data
push eax
lea eax, [ebp - 0x254]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411882
mov word [ebp - 0x254], si
lea eax, [ebp - 0x254]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
je 0x4118b0
lea eax, [ebp - 0x254]
push eax
lea eax, [edi + 0x2e0]
push eax
mov dword [edi + 0x1b94], 0xe
call fcn.00402879
mov ebx, dword [edi + 0x1b98]
cmp dword [ebx + 0xc], esi
je 0x411a6b
push 0x208
lea eax, [ebp - 0x252]
push esi
push eax
mov dword [edi + 0x1b94], 7
mov word [ebp - 0x254], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x672]
push esi
push eax
mov word [ebp - 0x674], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
lea eax, [ebp - 0x462]
push esi
push eax
mov word [ebp - 0x464], si
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebx + 0x63c], esi
je 0x411962
lea eax, [ebx + 0x640]
cmp word [eax], si
je 0x411962
push eax
mov eax, 0x104
lea edi, [ebp - 0x674]
call fcn.00407a0a
pop ecx
mov eax, edi
push eax
push dword [ebp + 8]
call fcn.004111f2
mov eax, edi
push eax
push dword [ebp + 8]
call fcn.00411178
mov edi, dword [ebp + 8]
xor esi, esi
jmp 0x411a6b
push 0x1c
pop eax
lea ebx, [ebp - 0x254]
call fcn.00413a56
mov eax, ebx
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.GoogleChromeUser_Data
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x4119ad
lea eax, [ebp - 0x254]
push str.GoogleChromeUser_Data
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x4119b4
mov word [ebp - 0x464], si
lea eax, [ebp - 0x464]
push eax
push edi
call fcn.00411178
lea eax, [ebp - 0x254]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.GoogleChrome_SxSUser_Data
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411a02
lea eax, [ebp - 0x254]
push str.GoogleChrome_SxSUser_Data
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411a09
mov word [ebp - 0x464], si
lea eax, [ebp - 0x464]
push eax
push edi
call fcn.00411178
lea eax, [ebp - 0x254]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.ChromiumUser_Data
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411a57
lea eax, [ebp - 0x254]
push str.ChromiumUser_Data
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411a5e
mov word [ebp - 0x464], si
lea eax, [ebp - 0x464]
push eax
push edi
call fcn.00411178
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 0x10], esi
je 0x411abd
push 0x208
lea eax, [ebp - 0x672]
push esi
push eax
mov word [ebp - 0x674], si
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [ebp - 0x674]
call fcn.00401b01
cmp word [ebp - 0x674], 0
je 0x411ab8
mov ecx, dword [ebp + 8]
add ecx, 0x1af4
mov eax, dword [ecx]
mov edx, edi
push edx
call dword [eax + 0x14]
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi + 0x1b98]
cmp dword [eax + 8], esi
je 0x411e02
mov dword [edi + 0x1b94], 8
cmp dword [eax + 0x84c], esi
je 0x411b21
lea ecx, [eax + 0x850]
call fcn.00407bc5
push str.Login_Data
push eax
call sub.msvcrt.dll__wcsicmp
pop ecx
test eax, eax
mov eax, dword [edi + 0x1b98]
pop ecx
jne 0x411b0a
add eax, 0x850
jmp 0x411df5
add eax, 0x850
push eax
add edi, 0x2e4
push edi
call fcn.004437f6
jmp 0x411e02
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x252]
push esi
push eax
mov word [ebp - 0x254], si
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x462]
push esi
push eax
mov word [ebp - 0x464], si
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x672]
push esi
push eax
mov word [ebp - 0x674], si
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1a
pop eax
lea ebx, [ebp - 0x254]
call fcn.00413a56
mov eax, ebx
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.OperaOperawand.dat
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411bb9
lea eax, [ebp - 0x254]
push str.OperaOperawand.dat
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411bc0
mov word [ebp - 0x464], si
lea eax, [ebp - 0x464]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
jne 0x411bd8
mov word [ebp - 0x464], si
cmp word [ebp - 0x464], si
jne 0x411c4a
lea eax, [ebp - 0x254]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.OperaOpera7profilewand.dat
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411c22
lea eax, [ebp - 0x254]
push str.OperaOpera7profilewand.dat
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411c29
mov word [ebp - 0x464], si
lea eax, [ebp - 0x464]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
jne 0x411c41
mov word [ebp - 0x464], si
cmp word [ebp - 0x464], si
je 0x411c62
lea eax, [ebp - 0x464]
push eax
lea eax, [edi + 0x2e4]
push eax
call fcn.004437f6
jmp 0x411d96
push 0x208
lea eax, [ebp - 0x882]
push esi
push eax
mov word [ebp - 0x884], si
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x254]
add esp, 0xc
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], 0x44b974
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411cbf
lea eax, [ebp - 0x254]
push 0x44b974
push eax
lea eax, [ebp - 0x884]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411cc6
mov word [ebp - 0x884], si
or dword [ebp - 0x1484], 0xffffffff
lea eax, [ebp - 0x884]
push eax
push 0x445c04
lea eax, [ebp - 0x1484]
mov word [ebp - 0x1480], si
mov word [ebp - 0xd20], si
mov word [ebp - 0xfa8], si
call fcn.00408b4a
jmp 0x411d76
lea eax, [ebp - 0x1484]
call fcn.00408b06
test eax, eax
je 0x411d76
lea eax, [ebp - 0xfa8]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.wand.dat
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411d4b
lea eax, [ebp - 0xfa8]
push str.wand.dat
push eax
lea eax, [ebp - 0x464]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411d52
mov word [ebp - 0x464], si
lea eax, [ebp - 0x464]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
je 0x411d76
lea eax, [ebp - 0x464]
push eax
lea eax, [edi + 0x2e4]
push eax
call fcn.004437f6
lea eax, [ebp - 0x1484]
call fcn.00408ba7
test eax, eax
jne 0x411cfb
lea esi, [ebp - 0x1484]
call fcn.00408c40
xor esi, esi
lea eax, [ebp - 0x254]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
mov dword [esp], str.Opera_SoftwareOpera_StableLogin_Data
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x411dd7
lea eax, [ebp - 0x254]
push str.Opera_SoftwareOpera_StableLogin_Data
push eax
lea eax, [ebp - 0x674]
call fcn.00407c91
pop ecx
pop ecx
jmp 0x411dde
mov word [ebp - 0x674], si
lea eax, [ebp - 0x674]
push eax
call fcn.00407b0b
test eax, eax
pop ecx
je 0x411e02
lea eax, [ebp - 0x674]
push eax
add edi, 0x2e0
push edi
call fcn.00402879
pop edi
pop esi
pop ebx
leave
ret 4