Function at 0x40a820
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x51dfc6
push eax
mov eax, 0x208c
mov dword fs:[0], esp
call fcn.004c79b0
mov al, byte [esp + 3]
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
lea ecx, [esp + 0x60]
mov byte [esp + 0x60], al
call fcn.0040d630
mov cl, byte [esp + 0x13]
push ebp
mov byte [esp + 0x50], cl
lea ecx, [esp + 0x50]
mov dword [esp + 0x20a8], ebp
call fcn.0040d630
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push str.HKCUSoftwareClasses_
call edi
add esp, 4
lea ecx, [esp + 0x4c]
push eax
push str.HKCUSoftwareClasses_
call fcn.0040fea0
mov dl, byte [esp + 0x13]
push ebp
lea ecx, [esp + 0x40]
mov byte [esp + 0x20a8], 1
mov byte [esp + 0x40], dl
call fcn.0040d630
push str.HKCR_
call edi
add esp, 4
lea ecx, [esp + 0x3c]
push eax
push str.HKCR_
call fcn.0040fea0
push 0xc
mov byte [esp + 0x20a8], 2
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x20ac]
cmp eax, ebp
mov byte [esp + 0x20a4], 3
je 0x40a8f5
push ebx
mov ecx, eax
call fcn.0040d500
jmp 0x40a8f7
xor eax, eax
cmp eax, ebp
mov byte [esp + 0x20a4], 2
mov dword [esp + 0x14], eax
jne 0x40a915
push 0x8007000e
call fcn.004c7dcc
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x20a4], 4
je 0x40a925
mov esi, dword [eax]
jmp 0x40a927
xor esi, esi
push esi
call edi
add esp, 4
lea ecx, [esp + 0x4c]
push eax
push esi
call fcn.0040fbf0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20a4], 2
call fcn.0040d4b0
push 0xc
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebp
mov byte [esp + 0x20a4], 5
je 0x40a96d
push ebx
mov ecx, eax
call fcn.0040d500
jmp 0x40a96f
xor eax, eax
cmp eax, ebp
mov byte [esp + 0x20a4], 2
mov dword [esp + 0x14], eax
jne 0x40a98d
push 0x8007000e
call fcn.004c7dcc
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov byte [esp + 0x20a4], 6
je 0x40a99d
mov esi, dword [eax]
jmp 0x40a99f
xor esi, esi
push esi
call edi
add esp, 4
lea ecx, [esp + 0x3c]
push eax
push esi
call fcn.0040fbf0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20a4], 2
call fcn.0040d4b0
mov byte [esp + 0x13], 0
mov al, byte [esp + 0x13]
push ebp
lea ecx, [esp + 0x30]
mov byte [esp + 0x30], al
call fcn.0040d630
lea ecx, [esp + 0x4c]
push str._shell_
lea edx, [esp + 0x70]
push ecx
push edx
mov byte [esp + 0x20b0], 7
call fcn.00413ae0
add esp, 0xc
mov eax, dword [eax + 4]
mov byte [esp + 0x20a4], 8
cmp eax, ebp
jne 0x40aa0b
mov eax, 0x535104
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.004a2520
add esp, 8
test eax, eax
je 0x40aa2c
cmp dword [esp + 0x34], ebp
sete al
test al, al
jne 0x40aa2c
xor bl, bl
jmp 0x40aa2e
mov bl, 1
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x20a8], 7
call fcn.0040d630
test bl, bl
je 0x40aacc
lea edx, [esp + 0x3c]
push str._shell_
lea eax, [esp + 0x70]
push edx
push eax
call fcn.00413ae0
add esp, 0xc
mov eax, dword [eax + 4]
mov byte [esp + 0x20a4], 9
cmp eax, ebp
jne 0x40aa74
mov eax, 0x535104
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.004a2520
add esp, 8
test eax, eax
je 0x40aa95
cmp dword [esp + 0x34], ebp
sete al
test al, al
jne 0x40aa95
xor bl, bl
jmp 0x40aa97
mov bl, 1
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x20a8], 7
call fcn.0040d630
test bl, bl
je 0x40aacc
push 0x560790
mov byte [esp + 0x17], 1
call edi
add esp, 4
lea ecx, [esp + 0x2c]
push eax
push 0x560790
call fcn.0040fea0
lea edx, [esp + 0x4c]
push str._shell_
lea eax, [esp + 0x80]
push edx
push eax
call fcn.00413ae0
lea ecx, [esp + 0x38]
lea edx, [esp + 0x98]
push ecx
push eax
push edx
mov byte [esp + 0x20bc], 0xa
call fcn.00413bf0
push str.command_
push eax
lea eax, [esp + 0x8c]
mov byte [esp + 0x20c4], 0xb
push eax
call fcn.00413ae0
add esp, 0x24
mov eax, dword [eax + 4]
mov byte [esp + 0x20a4], 0xc
cmp eax, ebp
jne 0x40ab30
mov eax, 0x535104
lea ecx, [esp + 0x5c]
push ecx
push eax
call fcn.004a2520
add esp, 8
test eax, eax
je 0x40ab51
cmp dword [esp + 0x64], ebp
seta al
test al, al
je 0x40ab51
mov bl, 1
jmp 0x40ab53
xor bl, bl
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x20a8], 0xb
call fcn.0040d630
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x20a8], 0xa
call fcn.0040d630
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0x20a8], 7
call fcn.0040d630
test bl, bl
jne 0x40ae1b
lea edx, [esp + 0x3c]
push str._shell_
lea eax, [esp + 0x70]
push edx
push eax
call fcn.00413ae0
lea ecx, [esp + 0x38]
lea edx, [esp + 0x98]
push ecx
push eax
push edx
mov byte [esp + 0x20bc], 0xd
call fcn.00413bf0
push str.command_
push eax
lea eax, [esp + 0x9c]
mov byte [esp + 0x20c4], 0xe
push eax
call fcn.00413ae0
add esp, 0x24
mov eax, dword [eax + 4]
mov byte [esp + 0x20a4], 0xf
cmp eax, ebp
jne 0x40abfb
mov eax, 0x535104
lea ecx, [esp + 0x5c]
push ecx
push eax
call fcn.004a2520
add esp, 8
test eax, eax
je 0x40ac1c
cmp dword [esp + 0x64], ebp
seta al
test al, al
je 0x40ac1c
mov bl, 1
jmp 0x40ac1e
xor bl, bl
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0x20a8], 0xe
call fcn.0040d630
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x20a8], 0xd
call fcn.0040d630
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x20a8], 7
call fcn.0040d630
test bl, bl
jne 0x40ae1b
mov al, byte [esp + 0x13]
test al, al
je 0x40ae1b
mov dl, byte [esp + 0x13]
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x18], dl
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x3c]
push str._shell_
lea ecx, [esp + 0x80]
push eax
push ecx
mov byte [esp + 0x20b0], 0x10
call fcn.00413ae0
add esp, 0xc
mov eax, dword [eax + 4]
mov byte [esp + 0x20a4], 0x11
cmp eax, ebp
jne 0x40acbb
mov eax, 0x535104
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004a1ee0
add esp, 8
test eax, eax
je 0x40acef
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jne 0x40acd9
xor eax, eax
jmp 0x40ace2
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 4
cmp eax, ebp
seta al
test al, al
je 0x40acef
mov bl, 1
jmp 0x40acf1
xor bl, bl
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0x20a8], 0x10
call fcn.0040d630
test bl, bl
je 0x40ade7
mov eax, dword [0x535110]
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push ecx
lea ecx, [esp + 0x38]
call fcn.0040fca0
lea edx, [esp + 0x3c]
push str._shell_
lea eax, [esp + 0x70]
push edx
push eax
call fcn.00413ae0
lea ecx, [esp + 0x38]
lea edx, [esp + 0x98]
push ecx
push eax
push edx
mov byte [esp + 0x20bc], 0x12
call fcn.00413bf0
push str.command_
push eax
lea eax, [esp + 0x9c]
mov byte [esp + 0x20c4], 0x13
push eax
call fcn.00413ae0
add esp, 0x24
mov eax, dword [eax + 4]
mov byte [esp + 0x20a4], 0x14
cmp eax, ebp
jne 0x40ad85
mov eax, 0x535104
lea ecx, [esp + 0x5c]
push ecx
push eax
call fcn.004a2520
add esp, 8
test eax, eax
je 0x40ada6
cmp dword [esp + 0x64], ebp
seta al
test al, al
je 0x40ada6
mov bl, 1
jmp 0x40ada8
xor bl, bl
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0x20a8], 0x13
call fcn.0040d630
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x20a8], 0x12
call fcn.0040d630
push 1
lea ecx, [esp + 0x70]
mov byte [esp + 0x20a8], 0x10
call fcn.0040d630
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x20ac], 7
call fcn.0040f810
mov ecx, dword [esp + 0x1c]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x20a8], 2
call fcn.0040d630
push 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x20a8], 1
call fcn.0040d630
push 1
lea ecx, [esp + 0x50]
mov byte [esp + 0x20a8], 0
call fcn.0040d630
mov eax, dword [esp + 0x64]
mov ebx, dword [esp + 0x20b0]
cmp eax, ebp
je 0x40af12
mov eax, dword [esp + 0x60]
cmp eax, ebp
jne 0x40ae74
mov eax, 0x535104
lea edx, [esp + 0x9c]
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40af12
push 0xc
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebp
mov byte [esp + 0x20a4], 0x15
je 0x40aebd
lea ecx, [esp + 0x9c]
push ecx
mov ecx, eax
call fcn.0040d540
mov esi, eax
jmp 0x40aebf
xor esi, esi
cmp esi, ebp
mov byte [esp + 0x20a4], 0
mov dword [esp + 0x28], esi
jne 0x40aed9
push 0x8007000e
call fcn.004c7dcc
cmp esi, ebp
mov byte [esp + 0x20a4], 0x16
je 0x40aef0
mov ecx, esi
call fcn.0040d5d0
mov edx, eax
jmp 0x40aef2
xor edx, edx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, ebx
call fcn.0040fa00
cmp esi, ebp
je 0x40af12
mov ecx, esi
call fcn.0040d580
mov esi, dword [ebx + 8]
mov ecx, dword [esp + 0x60]
xor edx, edx
cmp edx, esi
sbb esi, esi
neg esi
cmp ecx, ebp
je 0x40af43
mov al, byte [ecx - 1]
test al, al
je 0x40af37
cmp al, 0xff
je 0x40af37
dec al
mov byte [ecx - 1], al
jmp 0x40af43
add ecx, 0xfffffffe
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x209c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2098
ret