Function at 0x4010ab
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push 0x2a8
mov eax, 0x488e66
call fcn.00458e5d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x294], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
mov esi, ecx
call fcn.004504c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push str._APPDATA_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x401186
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
call fcn.004017d2
push str.Trend_MicroUTCollector
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 4], ebx
call fcn.00401817
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.00425d30
pop ecx
pop ecx
test eax, eax
je 0x401172
push str.lic
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.00401e38
add esp, 0xc
push 0xffffffffffffffff
push edi
mov byte [ebp - 4], 1
call fcn.0040191e
push ebx
push 1
lea esi, [ebp - 0x2b4]
call fcn.004019bb
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x234]
call fcn.004019bb
jmp 0x4011be
push str.lic
lea eax, [ebp - 0x2b4]
push esi
push eax
call fcn.00401e38
add esp, 0xc
push 0xffffffffffffffff
push edi
xor ebx, ebx
mov dword [ebp - 4], 2
call fcn.0040191e
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x2b4]
call fcn.004019bb
cmp dword [edi + 0x18], 8
jb 0x4011c9
mov eax, dword [edi + 4]
jmp 0x4011cc
lea eax, [edi + 4]
push ebx
push 0x80
push 3
push ebx
push ebx
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40120a
lea eax, [edi + 0x1f]
push eax
call sym.SupportWrapper.exe_PR_initializeLicenseProfile
pop ecx
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
cmp eax, ebx
sete al
mov byte [edi + 0x1c], al
xor al, al
jmp 0x401363
push ebx
lea eax, [ebp - 0x298]
push eax
push 0x50
mov dword [ebp - 0x298], ebx
pop ebx
push ebx
lea eax, [ebp - 0x288]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40123d
mov byte [ebp - 0x289], 1
cmp dword [ebp - 0x298], ebx
je 0x401244
mov byte [ebp - 0x289], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x289], 0
je 0x401340
push ebx
lea eax, [ebp - 0x288]
push eax
lea esi, [edi + 0x1f]
push ebx
push esi
call fcn.004505a2
lea eax, [ebp - 0x290]
push eax
mov ebx, 0x60010108
push esi
mov dword [ebp - 0x290], ebx
call sym.SupportWrapper.exe_PR_getLicenseStatus
mov ecx, dword [ebp - 0x294]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
jne 0x401340
cmp dword [ebp - 0x290], 0x60010106
mov byte [edi + 0x1c], 1
jne 0x4012ae
mov byte [edi + 0x1d], 1
jmp 0x401340
cmp dword [ebp - 0x290], 0x60010107
jne 0x4012e8
lea eax, [ebp - 0x290]
push eax
push esi
mov byte [edi + 0x1d], 1
call sym.SupportWrapper.exe_PR_isPerformOnlineUpdateLicenseBySchedule
pop ecx
pop ecx
test eax, eax
jne 0x401340
cmp dword [ebp - 0x290], 1
jne 0x401340
push dword [ebp - 0x294]
push edi
call fcn.00401587
jmp 0x401340
cmp dword [ebp - 0x290], ebx
jne 0x401340
push ecx
push edi
mov byte [edi + 0x1e], 1
call fcn.00401587
test al, al
je 0x401340
lea eax, [ebp - 0x290]
push eax
push esi
call sym.SupportWrapper.exe_PR_getLicenseStatus
pop ecx
pop ecx
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
test eax, eax
jne 0x401340
cmp dword [ebp - 0x290], 0x60010106
je 0x401332
cmp dword [ebp - 0x290], 0x60010107
jne 0x401335
xor eax, eax
inc eax
test al, al
mov byte [edi + 0x1d], al
sete al
mov byte [edi + 0x1e], al
cmp byte [edi + 0x1c], 0
jne 0x401360
lea eax, [edi + 0x1f]
push eax
call sym.SupportWrapper.exe_PR_initializeLicenseProfile
pop ecx
mov ecx, dword [ebp - 0x294]
mov dword [ecx], eax
test eax, eax
sete al
mov byte [edi + 0x1c], al
mov al, byte [edi + 0x1d]
call fcn.00458ee0
ret 4