Function at 0x417e87
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
and byte [eax + 4], 0
mov eax, dword [ebp + 8]
fldz
fstp dword [eax + 8]
mov eax, dword [ebp + 8]
and dword [eax + 0xc], 0
mov eax, dword [ebp + 8]
fld dword [0x4d11ac]
fstp dword [eax + 0x34]
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0x3e8
mov eax, dword [ebp + 8]
and dword [eax], 0
fld dword [0x4f07f4]
fcomp dword [0x4d11a8]
fnstsw ax
test ah, 0x41
jne 0x417ee9
fild dword [0x4f07f8]
fmul qword [0x4d04b0]
fdiv dword [0x4f07f4]
fstp qword [ebp - 0x1c]
jmp 0x417ef2
fld qword [0x4f0800]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fcomp qword [0x4d11a0]
fnstsw ax
test ah, 0x41
jp 0x417f11
fld qword [0x4f0800]
fstp qword [ebp - 8]
and byte [0x4f5630], 0
push 0xff
push 0x4f5630
push str.ALTUSERNAME
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x417f73
push 0x4f5630
call fcn.004b3ac0
pop ecx
test eax, eax
je 0x417f73
push str.DEFAULT
push 0x4f5630
call fcn.004c826a
pop ecx
pop ecx
test eax, eax
je 0x417f73
push 0x4d1180
push 0x4f5630
call fcn.004c826a
pop ecx
pop ecx
test eax, eax
je 0x417f73
mov dword [ebp - 0x20], 1
jmp 0x417f77
and dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x20]
mov byte [eax + 4], cl
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
test eax, eax
je 0x417fee
push 0x23
push 0x4f5630
call fcn.004b59c0
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417fc0
mov eax, dword [ebp - 0x10]
and byte [eax], 0
push 0xffffffffffffffaa
mov eax, dword [ebp - 0x10]
inc eax
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.0049dc12
add esp, 0xc
jmp 0x417fd6
push 0xffffffffffffffaa
push 0x4d07b3
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.0049dc12
add esp, 0xc
push 0xffffffffffffffaa
push 0x4f5630
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call fcn.0049dc12
add esp, 0xc
jmp 0x41801a
push 0xffffffffffffffaa
push 0x4d07b3
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call fcn.0049dc12
add esp, 0xc
push 0xffffffffffffffaa
push 0x4d07b3
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.0049dc12
add esp, 0xc
and byte [0x4f5a30], 0
push 0xff
push 0x4f5a30
push str.USERKEY
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x418061
push 0x4f5a30
call fcn.004b3ac0
pop ecx
test eax, eax
je 0x418061
push 0xffffffffffffffaa
push 0x4f5a30
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
call fcn.0049dc12
add esp, 0xc
jmp 0x41807e
push 0xffffffffffffffaa
push 0x4d07b3
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
call fcn.0049dc12
add esp, 0xc
mov eax, dword [ebp + 8]
and byte [eax + 4], 0
and byte [0x4f5e30], 0
push 0xff
push 0x4f5e30
push str.CLOCKBACK
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
setne al
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0xa]
test eax, eax
je 0x4180b3
mov eax, dword [ebp + 8]
mov dword [eax], 4
and byte [0x4f5e30], 0
push 0xff
push 0x4f5e30
push 0x4d115c
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4180fb
push 0x4f5e30
call fcn.004b3ac0
pop ecx
test eax, eax
je 0x4180fb
push 0x4f5e30
call fcn.004b58f8
pop ecx
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
mov eax, dword [ebp + 8]
fstp dword [eax + 8]
jmp 0x418110
mov eax, dword [ebp + 8]
fld dword [0x4d1158]
fstp dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax], 5
and byte [0x4f5e30], 0
push 0xff
push 0x4f5e30
push str.TOTALUSESALLKEYS
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x418152
push 0x4f5e30
call fcn.004b3ac0
pop ecx
test eax, eax
je 0x418152
push 0x4f5e30
call fcn.004b58f8
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
jmp 0x418165
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x2710
mov eax, dword [ebp + 8]
mov dword [eax], 5
and byte [0x4f5e30], 0
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
test eax, eax
jne 0x418255
mov byte [ebp - 0x11], 1
push 0xff
push 0x4f5e30
push str.DAYSLEFT
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4181d6
push 0x4f5e30
call fcn.004b3ac0
pop ecx
test eax, eax
je 0x4181d6
push 0x4f5e30
call fcn.004b58f8
pop ecx
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
mov eax, dword [ebp + 8]
fstp dword [eax + 0x34]
mov eax, dword [ebp + 8]
fld dword [eax + 0x34]
fmul qword [ebp - 8]
call fcn.004b2f7c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], eax
and byte [ebp - 0x11], 0
and byte [0x4f5e30], 0
push 0xff
push 0x4f5e30
push str.USESLEFT
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x418229
push 0x4f5e30
call fcn.004b3ac0
pop ecx
test eax, eax
je 0x418229
push 0x4f5e30
call fcn.004b58f8
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], eax
mov eax, dword [ebp + 8]
fild dword [eax + 0x38]
fdiv qword [ebp - 8]
mov eax, dword [ebp + 8]
fstp dword [eax + 0x34]
and byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x418255
mov eax, dword [ebp + 8]
and dword [eax + 0x38], 0
mov eax, dword [ebp + 8]
fldz
fstp dword [eax + 0x34]
mov eax, dword [ebp + 8]
fld dword [0x4d1158]
fstp dword [eax + 8]
mov eax, dword [ebp + 8]
mov dword [eax], 5
and byte [0x4f5630], 0
push 0xff
push 0x4f5630
push str.EXPIRED
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
setne al
mov byte [ebp - 9], al
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
test eax, eax
je 0x418295
movzx eax, byte [ebp - 9]
test eax, eax
jne 0x418295
mov dword [ebp - 0x2c], 1
jmp 0x418299
and dword [ebp - 0x2c], 0
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x2c]
mov byte [eax + 4], cl
leave
ret