Function at 0x435af2
Capabilities:
Query environment variable

Disassembly:
push 0xc0
mov eax, 0x44c62a
call fcn.004386f7
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x10]
push 7
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xa4], eax
pop ecx
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
mov dword [ebp - 4], edi
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x88], edi
mov word [ebp - 0x98], ax
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xb4], edi
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 2
call fcn.0042c4ac
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 3
call fcn.0042c4ac
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0042c4b9
mov esi, 0x2000000
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov ebx, edi
push 0x80000002
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 5
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], edi
call fcn.0042cc14
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0042c897
push esi
push 0x44d8ac
push 0x80000003
lea ecx, [ebp - 0xc4]
call fcn.0042cc14
mov esi, dword [ebp - 0xbc]
mov dword [ebp - 0xac], eax
jmp 0x43608b
cmp dword [esi + 0x14], 8
jb 0x435bef
mov eax, dword [esi]
jmp 0x435bf1
mov eax, esi
push eax
lea ecx, [ebp - 0xc4]
call fcn.0042cb86
test eax, eax
je 0x435e0d
cmp dword [esi + 0x14], 8
jb 0x435c0f
mov edi, dword [esi]
jmp 0x435c11
mov edi, esi
xor eax, eax
cmp word [edi], ax
je 0x435c1f
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401db2
mov edi, 0x44d8a8
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004053dd
mov edi, dword [ebp - 0xb0]
xor eax, eax
cmp word [edi], ax
je 0x435c53
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004053dd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push eax
push dword [ebp - 0xac]
lea ecx, [ebp - 0x80]
call fcn.0042cc14
test eax, eax
je 0x436086
mov edi, dword [ebp - 0xa8]
push edi
lea ecx, [ebp - 0x80]
call fcn.0042cb68
test eax, eax
je 0x435da7
push edi
lea ecx, [ebp - 0x80]
call fcn.0042c785
cmp eax, 2
jne 0x435dcc
xor edi, edi
push dword [ebp - 0x9c]
call fcn.0042afb6
lea ebx, [edi + 1]
mov dword [esp], 0x549
lea eax, [ebx + ebx]
push str...CommonW32_CommonFunctions.cpp
push eax
call fcn.0042ae50
add esp, 0xc
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x435db6
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.0042caac
mov edi, eax
xor eax, eax
cmp word [edi], ax
je 0x435d16
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00401db2
cmp dword [ebp - 0x2c], 8
push ebx
push dword [ebp - 0x9c]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x435d7f
push ebx
push dword [ebp - 0x9c]
call fcn.0043965b
pop ecx
pop ecx
test eax, eax
je 0x435d7f
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x58]
call fcn.00403477
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 7
call fcn.00413089
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x58]
call fcn.00401ba5
xor eax, eax
inc eax
mov dword [ebp - 0xa0], eax
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.00401ba5
cmp edi, ebx
jae 0x435caf
mov ebx, dword [ebp - 0xa0]
xor edi, edi
lea ecx, [ebp - 0x80]
call fcn.0042c5a8
jmp 0x436088
push str.AllocMem_failed._n
push str.GetUsersRegistryStringsW
push 4
call fcn.00405a24
add esp, 0xc
jmp 0x435da1
push edi
lea ecx, [ebp - 0x80]
call fcn.0042caac
push eax
lea ecx, [ebp - 0x58]
call fcn.00403477
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 8
call fcn.00413089
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00401ba5
xor ebx, ebx
inc ebx
mov dword [ebp - 0xa0], ebx
jmp 0x435da9
push 1
push str.SeRestorePrivilege
call fcn.004369a5
pop ecx
pop ecx
test eax, eax
je 0x436088
cmp dword [esi + 0x14], 8
jb 0x435e2d
mov eax, dword [esi]
jmp 0x435e2f
mov eax, esi
push eax
call fcn.00436806
pop ecx
test eax, eax
je 0x436077
cmp dword [esi + 0x14], 8
jb 0x435e48
mov edi, dword [esi]
jmp 0x435e4a
mov edi, esi
xor eax, eax
cmp word [edi], ax
je 0x435e58
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00401db2
mov edi, 0x44d8a8
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004053dd
mov edi, dword [ebp - 0xb0]
xor eax, eax
cmp word [edi], ax
je 0x435e8c
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004053dd
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push eax
push dword [ebp - 0xac]
lea ecx, [ebp - 0x80]
call fcn.0042cc14
test eax, eax
je 0x436005
mov edi, dword [ebp - 0xa8]
push edi
lea ecx, [ebp - 0x80]
call fcn.0042cb68
test eax, eax
je 0x435ffd
push edi
lea ecx, [ebp - 0x80]
call fcn.0042c785
cmp eax, 2
jne 0x43602b
xor eax, eax
mov edi, eax
push dword [ebp - 0x9c]
call fcn.0042afb6
lea ebx, [edi + 1]
mov dword [esp], 0x56b
lea eax, [ebx + ebx]
push str...CommonW32_CommonFunctions.cpp
push eax
call fcn.0042ae50
add esp, 0xc
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x43600f
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 9
call fcn.0042caac
mov edi, eax
xor eax, eax
cmp word [edi], ax
je 0x435f50
push edi
call fcn.0043860f
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.00401db2
cmp dword [ebp - 0x2c], 8
push ebx
push dword [ebp - 0x9c]
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x435fa7
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x58]
call fcn.00403477
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0xa
call fcn.00413089
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x58]
call fcn.00401ba5
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.00401ba5
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x58]
call fcn.00403477
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0xb
call fcn.00413089
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00401ba5
xor eax, eax
inc eax
mov dword [ebp - 0xa0], eax
cmp edi, ebx
jae 0x435eea
mov ebx, eax
lea ecx, [ebp - 0x80]
call fcn.0042c5a8
cmp dword [esi + 0x14], 8
jb 0x43606c
mov eax, dword [esi]
jmp 0x43606e
push str.AllocMem_failed._n
push str.GetUsersRegistryStringsW
push 4
call fcn.00405a24
mov ebx, dword [ebp - 0xa0]
add esp, 0xc
jmp 0x435ffd
push edi
lea ecx, [ebp - 0x80]
call fcn.0042caac
push eax
lea ecx, [ebp - 0x58]
call fcn.00403477
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0xc
call fcn.00413089
xor eax, eax
push eax
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00401ba5
xor ebx, ebx
inc ebx
mov dword [ebp - 0xa0], ebx
jmp 0x435ffd
mov eax, esi
push eax
call fcn.00436a9f
pop ecx
xor edi, edi
push edi
push str.SeRestorePrivilege
call fcn.004369a5
pop ecx
pop ecx
jmp 0x436088
xor edi, edi
add esi, 0x18
cmp esi, dword [ebp - 0xb8]
jne 0x435be5
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0042c507
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 3
call fcn.0042c4fc
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 2
call fcn.0042c4fc
lea ecx, [ebp - 0xbc]
call fcn.004052ea
push edi
push 1
lea ecx, [ebp - 0x98]
call fcn.00401ba5
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00401ba5
mov eax, ebx
call fcn.004386a6
ret