Function at 0x40d115
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jne 0x40d3ed
mov eax, 0
jmp 0x40d3fa
mov dword [esp + 4], 0x20
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40d1a2
mov eax, dword [ebp - 0x14]
add eax, 1
movzx eax, byte [eax]
cmp al, 0x26
jne 0x40d1a2
mov eax, dword [ebp - 0x14]
add eax, 2
movzx eax, byte [eax]
cmp al, 0x26
jne 0x40d1a2
mov eax, dword [ebp - 0x14]
add eax, 3
movzx eax, byte [eax]
cmp al, 0x20
jne 0x40d1a2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
add dword [ebp - 0x14], 4
jmp 0x40d1a9
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp al, 0x21
jne 0x40d1cc
add dword [ebp + 0xc], 1
mov dword [ebp - 0xc], 1
mov dword [esp + 8], 2
mov dword [esp + 4], 0x4eb5ee
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
jne 0x40d219
add dword [ebp + 0xc], 2
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__stricmp]
call eax
test eax, eax
jne 0x40d3a9
mov dword [ebp - 0x10], 1
jmp 0x40d3a9
mov dword [esp + 8], 2
mov dword [esp + 4], 0x4eb49f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
jne 0x40d29e
add dword [ebp + 0xc], 2
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dbg.OS_Regex
test eax, eax
je 0x40d3a9
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.Pattern:__s_matches__s.
mov dword [esp + 0xc], global___func__.211
mov dword [esp + 8], 0x146
mov dword [esp + 4], str.rootcheck_common.c
mov dword [esp], 0x4eb50a
call dbg._mtdebug2
mov dword [ebp - 0x10], 1
jmp 0x40d3a9
mov dword [esp + 8], 2
mov dword [esp + 4], 0x4eb609
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
jne 0x40d2e9
add dword [ebp + 0xc], 2
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jns 0x40d3a9
mov dword [ebp - 0x10], 1
jmp 0x40d3a9
mov dword [esp + 8], 2
mov dword [esp + 4], 0x4eb60c
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__strnicmp]
call eax
test eax, eax
jne 0x40d331
add dword [ebp + 0xc], 2
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jle 0x40d3a9
mov dword [ebp - 0x10], 1
jmp 0x40d3a9
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
cmp al, 0x25
jne 0x40d36a
mov byte [ebp - 0x819], 0
mov byte [ebp - 0x19], 0
mov dword [esp + 8], 0x7ff
lea eax, [ebp - 0x819]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call eax
sub esp, 0xc
jmp 0x40d387
mov dword [esp + 8], 0x7ff
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x819]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x819]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__stricmp]
call eax
test eax, eax
jne 0x40d3a9
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x18], 0
je 0x40d3bc
mov eax, dword [ebp - 0x18]
mov byte [eax], 0x20
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0xc], 1
jne 0x40d3d1
cmp dword [ebp - 0x10], 0
je 0x40d3e0
mov dword [ebp - 0x10], 0
jmp 0x40d3f7
cmp dword [ebp - 0x10], 0
jne 0x40d3e0
mov dword [ebp - 0x10], 0
jmp 0x40d3f7
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x14], 0
jne 0x40d14d
mov eax, dword [ebp - 0x10]
leave
ret