Function at 0x40a990
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cb1d
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4b41e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x40], esi
mov ebx, ecx
mov dword [ebp - 0x58], ebx
cmp dword [ebx], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
jne 0x40a9e4
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebx], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebx + 4], ecx
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 8]
mov byte [ebx + 8], 1
mov edi, edx
mov ebx, dword [ebx]
test ebx, ebx
mov dword [ebp - 0x48], ecx
setne al
mov byte [ecx], al
test ebx, ebx
je 0x40aaa7
cmp edx, 1
jge 0x40aa18
xor edi, edi
cmp word [ebx], di
je 0x40aa18
inc edi
cmp word [ebx + edi*2], 0
jne 0x40aa10
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 4], 0
lea eax, [edi + 1]
mov dword [esi + 4], 0
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov ecx, dword [esi + 4]
add esp, 4
mov dword [esi], eax
cmp ecx, edi
jge 0x40aa88
nop dword [eax + eax]
lea edx, [ecx + ecx]
movzx eax, word [edx + ebx]
mov esi, eax
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x40]
test ax, ax
je 0x40aa88
mov eax, dword [esi]
mov ecx, dword [ebp - 0x30]
mov word [edx + eax], cx
mov ecx, dword [esi + 4]
inc ecx
mov dword [esi + 4], ecx
cmp ecx, edi
jl 0x40aa60
mov eax, dword [esi]
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40aaa7
push eax
call fcn.00469e73
add esp, 4
push 0
push 0
push 0x49eab8
push 0x49ef94
mov ecx, esi
call fcn.00402a20
cmp dword [esi], 0
je 0x40aafe
push 0x2000
call fcn.0046a22b
add esp, 4
mov edi, eax
push 0x1000
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
jne 0x40aaec
push edi
call fcn.00469e73
jmp 0x40aafb
push dword [esi]
call fcn.00469e73
lea eax, [ebx - 1]
mov dword [esi], edi
mov dword [esi + 4], eax
add esp, 4
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x49eab0
mov ecx, esi
call fcn.00402320
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor ebx, ebx
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 1
cmp eax, 2
jle 0x40ab71
cmp dword [esi], ebx
jne 0x40ab5b
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
push dword [esi]
lea ebx, [esi + 8]
mov byte [ebx], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40aeaf
push ecx
mov ecx, esi
call fcn.00401700
mov ebx, eax
mov byte [ebp - 0x1c], 0
xor edi, edi
test ebx, ebx
je 0x40ab98
cmp word [ebx], di
je 0x40ab98
nop word [eax + eax]
inc edi
cmp word [ebx + edi*2], 0
jne 0x40ab90
xor ecx, ecx
mov dword [ebp - 0x20], edi
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], eax
test edi, edi
jle 0x40abe0
mov ecx, eax
sub ebx, eax
mov edx, edi
nop word [eax + eax]
mov ax, word [ebx + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
jne 0x40abd0
mov ebx, dword [ebp - 0x4c]
xor eax, eax
mov byte [ebp - 0x1c], 1
mov word [ebx + edi*2], ax
cmp dword [ebp - 0x30], eax
je 0x40ad3f
test edi, edi
jne 0x40aea5
cmp word [ebx], ax
je 0x40ac0b
inc eax
cmp word [ebx + eax*2], 0
jne 0x40ac03
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x40aea5
mov edi, dword [esi + 4]
mov byte [esi + 8], al
test edi, edi
jne 0x40ac3b
mov eax, dword [esi]
test eax, eax
je 0x40ac38
cmp word [eax], di
je 0x40ac38
nop dword [eax + eax]
inc edi
cmp word [eax + edi*2], 0
jne 0x40ac30
mov dword [esi + 4], edi
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + str..exe], 0
jne 0x40ac40
add edi, eax
xor ecx, ecx
mov edx, 2
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov ebx, dword [esi]
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, eax
test ebx, ebx
je 0x40aca1
movzx ecx, word [ebx]
mov esi, ecx
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x40]
test cx, cx
je 0x40aca1
sub ebx, eax
mov eax, ecx
movzx ecx, ax
nop dword [eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edx + ebx]
mov ecx, eax
test ax, ax
jne 0x40ac90
mov ebx, str..exe
mov ecx, 0x2e
sub ebx, edx
nop dword [eax]
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + ebx]
mov ecx, eax
test ax, ax
jne 0x40acb0
xor eax, eax
mov word [edx], ax
mov eax, dword [esi]
test eax, eax
je 0x40acd5
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x2c]
lea ebx, [esi + 8]
mov dword [esi + 4], edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
mov dword [esi], eax
mov byte [ebx], 1
call edi
test eax, eax
jne 0x40aeaf
mov eax, dword [esi + 4]
test eax, eax
jne 0x40ad11
mov ecx, dword [esi]
test ecx, ecx
je 0x40ad0e
cmp word [ecx], ax
je 0x40ad0e
inc eax
cmp word [ecx + eax*2], 0
jne 0x40ad06
mov dword [esi + 4], eax
add eax, 0xfffffffe
push eax
push ecx
mov ecx, esi
call fcn.00402d00
cmp dword [esi], 0
jne 0x40ae9a
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
jmp 0x40ae9a
test edi, edi
jne 0x40ae27
cmp word [ebx], ax
je 0x40ad57
nop dword [eax]
inc edi
cmp word [ebx + edi*2], ax
jne 0x40ad50
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x40ae27
mov ebx, dword [esi + 4]
mov byte [esi + 8], al
test ebx, ebx
jne 0x40ad82
mov eax, dword [esi]
test eax, eax
je 0x40ad7f
cmp word [eax], bx
je 0x40ad7f
inc ebx
cmp word [eax + ebx*2], 0
jne 0x40ad77
mov dword [esi + 4], ebx
xor eax, eax
inc eax
cmp word [eax*2 + str..exe], 0
jne 0x40ad84
add ebx, eax
xor ecx, ecx
mov edx, 2
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov ecx, dword [esi]
add esp, 4
mov dword [ebp - 0x2c], eax
mov edx, eax
mov dword [ebp - 0x30], ecx
test ecx, ecx
je 0x40ade1
movzx ecx, word [ecx]
test cx, cx
je 0x40ade1
mov esi, dword [ebp - 0x30]
sub esi, eax
nop dword [eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x40add0
mov esi, str..exe
mov ecx, 0x2e
sub esi, edx
nop dword [eax]
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x40adf0
mov esi, dword [ebp - 0x40]
xor eax, eax
mov word [edx], ax
mov eax, dword [esi]
test eax, eax
je 0x40ae18
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x2c]
mov dword [esi + 4], ebx
mov ebx, dword [ebp - 0x4c]
mov dword [esi], eax
mov byte [esi + 8], 1
mov ecx, esi
call fcn.00408670
test al, al
jne 0x40aeac
test edi, edi
jne 0x40ae78
xor eax, eax
cmp word [ebx], ax
je 0x40ae48
nop dword [eax]
inc eax
cmp word [ebx + eax*2], 0
jne 0x40ae40
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x40ae78
mov eax, dword [esi + 4]
test eax, eax
jne 0x40ae6c
mov ecx, dword [esi]
test ecx, ecx
je 0x40ae69
cmp word [ecx], ax
je 0x40ae69
inc eax
cmp word [ecx + eax*2], 0
jne 0x40ae61
mov dword [esi + 4], eax
add eax, 0xfffffffe
push eax
push ecx
mov ecx, esi
call fcn.00402d00
cmp dword [esi], 0
jne 0x40ae91
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ebx, [esi + 8]
push dword [esi]
mov byte [ebx], 1
call edi
test eax, eax
jne 0x40aeaf
xor bl, bl
jmp 0x40b298
lea ebx, [esi + 8]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
test eax, eax
je 0x40aec2
cmp word [eax], 0
jne 0x40afa9
push 0
push 1
push 0xffffffffffffffff
push 1
push 0x49eab0
mov ecx, esi
call fcn.00402320
mov edi, eax
cmp edi, 2
jle 0x40afa9
cmp dword [esi], 0
jne 0x40aefa
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x28]
dec edi
mov byte [ebx], 1
mov ebx, dword [esi]
test ebx, ebx
mov dword [ebp - 0x30], edi
setne al
mov byte [ecx + 8], al
test ebx, ebx
je 0x40afa9
mov eax, dword [ecx]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
lea eax, [edi + 1]
mov dword [ecx + 4], 0
mov edx, 2
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, dword [ebp - 0x28]
add esp, 4
mov ecx, dword [edx + 4]
mov dword [edx], eax
cmp ecx, edi
jge 0x40af8d
mov esi, edi
nop dword [eax + eax]
lea edx, [ecx + ecx]
movzx eax, word [edx + ebx]
mov edi, eax
test ax, ax
je 0x40af87
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov word [edx + eax], di
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 4]
inc ecx
mov dword [edx + 4], ecx
cmp ecx, esi
jl 0x40af60
jmp 0x40af8a
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x40]
mov eax, dword [edx]
xor edx, edx
mov byte [ebp - 4], 1
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40afa9
push eax
call fcn.00469e73
add esp, 4
push 0
push 1
push 1
push 0
push 0x49ef64
mov ecx, esi
call fcn.00402320
test eax, eax
je 0x40b19a
cmp dword [esi], 0
jne 0x40afe5
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi], eax
xor ecx, ecx
lea ebx, [esi + 4]
mov dword [ebp - 0x38], ebx
mov word [eax], cx
mov ecx, ebx
jmp 0x40afed
lea ecx, [esi + 4]
mov dword [ebp - 0x38], ecx
mov ebx, ecx
mov edi, dword [esi]
mov edx, esi
mov dword [ebp - 0x2c], esi
mov eax, 0x49ef94
mov esi, dword [ebp - 0x48]
mov byte [ebp - 0x31], 0
mov dword [edx], 0
mov dl, byte [ebp - 0x31]
mov byte [esi], dl
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov edx, dword [ebp - 0x44]
mov dword [ecx], 0
xor ecx, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x3c], eax
inc ecx
cmp word [ecx*2 + 0x49ef94], 0
jne 0x40b022
test edi, edi
jne 0x40b043
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], edx
jmp 0x40b06a
xor eax, eax
cmp word [edi], ax
je 0x40b068
mov dword [ebp - 0x44], edx
mov edx, 0x49ef94
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], edx
nop
inc eax
cmp word [edi + eax*2], 0
jne 0x40b060
add ecx, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x49ef94], 0
jne 0x40b070
add ecx, eax
mov edx, 2
mov dword [ebp - 0x14], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, dword [ebp - 0x28]
mov ecx, eax
mov eax, dword [esi]
add esp, 4
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], edi
test eax, eax
je 0x40b104
movzx eax, word [eax]
mov dword [ebp - 0x48], edi
mov edx, eax
mov dword [ebp - 0x54], edx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x28]
test ax, ax
je 0x40b104
mov eax, ecx
mov dword [ebp - 0x48], edi
sub dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x54]
movzx esi, ax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], ebx
mov ebx, dword [ebp - 0x50]
mov dword [ebp - 0x2c], eax
nop word [eax + eax]
mov word [ecx], si
add ecx, 2
movzx eax, word [ebx + ecx]
mov esi, eax
test ax, ax
jne 0x40b0f0
mov ebx, dword [ebp - 0x54]
mov esi, 0x49ef94
mov edi, 0x22
sub esi, ecx
mov word [ecx], di
add ecx, 2
movzx eax, word [esi + ecx]
mov edi, eax
test ax, ax
jne 0x40b110
mov eax, dword [ebp - 0x48]
mov esi, dword [ebp - 0x40]
test eax, eax
je 0x40b146
movzx eax, word [eax]
mov edi, eax
test ax, ax
je 0x40b146
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x40b135
mov eax, 0x22
nop dword [eax + eax]
mov word [ecx], ax
lea ebx, [ebx + 2]
movzx eax, word [ebx]
lea ecx, [ecx + 2]
test ax, ax
jne 0x40b150
xor eax, eax
mov word [ecx], ax
mov eax, dword [esi]
test eax, eax
je 0x40b175
push eax
call fcn.00469e73
add esp, 4
mov ecx, dword [ebp - 0x2c]
lea edi, [esi + 8]
mov eax, dword [ebp - 0x30]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x44]
mov byte [edi], 1
test eax, eax
je 0x40b19d
push eax
call fcn.00469e73
add esp, 4
jmp 0x40b19d
lea edi, [esi + 8]
push dword [ebp + 0xc]
mov ebx, dword [ebp - 0x58]
mov ecx, ebx
call fcn.004022a0
cmp dword [esi], 0
jne 0x40b1c3
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], ecx
mov byte [edi], 1
mov edi, dword [esi]
mov esi, dword [ebx + 4]
mov byte [ebx + 8], 0
test esi, esi
jne 0x40b1eb
mov eax, dword [ebx]
test eax, eax
je 0x40b1e8
cmp word [eax], si
je 0x40b1e8
nop
inc esi
cmp word [eax + esi*2], 0
jne 0x40b1e0
mov dword [ebx + 4], esi
test edi, edi
je 0x40b200
xor eax, eax
cmp word [edi], ax
je 0x40b1fe
inc eax
cmp word [edi + eax*2], 0
jne 0x40b1f6
add esi, eax
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov ebx, dword [ebx]
add esp, 4
mov dword [ebp - 0x30], eax
mov edx, eax
test edi, edi
je 0x40b251
movzx ecx, word [edi]
mov eax, ecx
mov dword [ebp - 0x14], eax
mov eax, edx
test cx, cx
je 0x40b251
movzx ecx, cx
sub edi, eax
nop dword [eax + eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edi + edx]
mov ecx, eax
test ax, ax
jne 0x40b240
mov edi, dword [ebp - 0x58]
cmp dword [edi], 0
je 0x40b276
movzx eax, word [ebx]
mov ecx, eax
test ax, ax
je 0x40b276
sub ebx, edx
mov word [edx], cx
add edx, 2
movzx eax, word [ebx + edx]
mov ecx, eax
test ax, ax
jne 0x40b265
xor eax, eax
mov word [edx], ax
mov eax, dword [edi]
test eax, eax
je 0x40b28a
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x30]
mov bl, 1
mov dword [edi], eax
mov dword [edi + 4], esi
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x40b2a8
push eax
call fcn.00469e73
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00469e65
mov esp, ebp
pop ebp
ret 8