Function at 0x40d64e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4233cc]
mov edx, dword [ebp + 0x1c]
test edx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], edx
je 0x40d68f
and dword [edx], 0
test ebx, ebx
je 0x40d6d3
push 0xa
lea eax, [ebp - 0x224]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
mov eax, dword [ebp - 0x224]
add esp, 0xc
cmp word [eax], 0
mov dword [ebp - 0x218], ecx
jne 0x40d6cc
cmp eax, ebx
je 0x40d6cc
test esi, esi
mov edx, dword [ebp - 0x21c]
je 0x40d6dd
mov dword [esi], ecx
jmp 0x40d6dd
push 0xd
jmp 0x40da94
mov eax, dword [esi]
mov dword [ebp - 0x218], eax
mov ecx, eax
xor eax, eax
cmp dword [ebp - 0x214], eax
jne 0x40d6f1
mov dword [ebp - 0x214], 0x401460
cmp ecx, 0x18
ja 0x40d85b
je 0x40d836
cmp ecx, 0x11
ja 0x40d762
je 0x40d757
mov eax, ecx
sub eax, 0
je 0x40dabc
dec eax
je 0x40d73e
sub eax, 9
je 0x40d8e5
dec eax
je 0x40d733
dec eax
jne 0x40d92c
mov esi, dword [0x4235e0]
jmp 0x40da65
mov esi, dword [0x4235dc]
jmp 0x40da65
mov esi, dword [ebp - 0x220]
test esi, esi
jne 0x40da69
mov esi, dword [0x4235e4]
jmp 0x40da65
mov esi, dword [0x4235d4]
jmp 0x40da65
mov eax, ecx
sub eax, 0x12
je 0x40d810
dec eax
dec eax
je 0x40d7ea
dec eax
je 0x40d7c4
dec eax
dec eax
jne 0x40d92c
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [0x424c50], 2
push 0
lea eax, [ebp - 0x20c]
push ebx
jne 0x40d7ae
push 0x4028f8
jmp 0x40d7b3
push 0x4028ec
push eax
call fcn.0041a5b7
lea esi, [ebp - 0x20c]
jmp 0x40da69
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028dc
jmp 0x40d95a
mov ebx, 0x104
push ebx
push dword [0x4235d0]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028d0
jmp 0x40d95a
mov ebx, 0x104
push ebx
push dword [0x4235d0]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028c4
jmp 0x40d95a
push 0x104
push dword [0x4235d0]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
and word [ebp - 0x208], 0
jmp 0x40d7b9
cmp ecx, 0x35
ja 0x40d909
je 0x40d8f0
mov eax, ecx
sub eax, 0x19
je 0x40d8e5
sub eax, 5
je 0x40d997
sub eax, 0x14
je 0x40d8da
dec eax
je 0x40d8b4
dec eax
jne 0x40d92c
lea eax, [ebp - 0x210]
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
test eax, eax
jne 0x40d7b9
jmp 0x40da9a
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028b8
jmp 0x40d95a
mov esi, dword [0x4235d8]
jmp 0x40da65
mov esi, dword [0x4235d0]
jmp 0x40da65
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x4028a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x40d8a7
cmp ecx, 0x36
je 0x40d997
cmp ecx, 0x37
je 0x40d976
cmp ecx, 0xffff
je 0x40dabc
cmp ecx, 0xffffffff
je 0x40dabc
cmp ecx, 0x8000
jae 0x40d96f
test ch, 0x40
jne 0x40d965
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x402890
lea eax, [ebp - 0x20c]
jmp 0x40d7b3
test edx, edx
je 0x40d96f
mov dword [edx], 1
push 0
jmp 0x40da94
lea ecx, [ebp - 0x210]
push ecx
push 0x208
lea ecx, [ebp - 0x20c]
push ecx
push 1
push eax
push eax
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryW
jmp 0x40d8a7
test edi, edi
je 0x40d9b7
mov eax, dword [edi]
test eax, eax
je 0x40d9b7
mov ebx, 0x104
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x40da1a
lea eax, [ebp - 0x210]
push eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.004111d9
test eax, eax
je 0x40d9dc
push eax
jmp 0x40da94
test edi, edi
je 0x40da1a
mov eax, dword [ebp - 0x210]
add eax, eax
push eax
mov dword [ebp - 0x210], eax
call fcn.0041a316
test eax, eax
mov dword [edi], eax
je 0x40da92
mov ecx, dword [ebp - 0x210]
mov edi, eax
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x218], 0x1e
jne 0x40da5f
cmp word [ebp - 0x20c], 0
je 0x40da4b
cmp word [ebp - 0x20a], 0x3a
jne 0x40da4b
cmp word [ebp - 0x208], 0x5c
jne 0x40da4b
and word [ebp - 0x206], 0
jmp 0x40da5f
push ebx
push dword [0x4235c8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea esi, [ebp - 0x20c]
test esi, esi
je 0x40dabc
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0x214]
push esi
call fcn.0041a5b7
mov eax, dword [ebp - 0x210]
add eax, eax
push eax
call fcn.0041a316
mov ebx, eax
test ebx, ebx
jne 0x40da9e
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40db09
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push ebx
call fcn.0041a5b7
jmp 0x40dac9
push dword [ebp - 0x214]
call fcn.0041a3e9
mov ebx, eax
test ebx, ebx
je 0x40db07
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
mov dword [ebp - 0x210], eax
je 0x40db07
lea eax, [ebx + eax*2]
push eax
push ebx
call dword [sym.imp.USER32.dll_CharPrevW]
cmp word [eax], 0x5c
jne 0x40db07
mov eax, dword [ebp - 0x210]
cmp eax, 3
jne 0x40db01
cmp word [ebx + 2], 0x3a
je 0x40db07
and word [ebx + eax*2 - 2], 0
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00419835
leave
ret 0x18