Function at 0x4ba550
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov edi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [ecx]
movsx eax, byte [ecx + 0xb]
test eax, eax
jns 0x4ba575
mov eax, dword [ecx + 4]
test eax, eax
je 0x4ba5c5
mov ecx, dword [edi + 4]
lea esi, [ebp - 0x1c]
push str.single_profile
push esi
call fcn.004bb880
cmp byte [esi + 1], 1
jne 0x4ba66a
test byte [ebp - 0x1c], 1
je 0x4ba66a
mov ecx, dword [edi]
push 7
push str.profile
push esi
call fcn.005e6cd0
mov ecx, esi
push 4
push 0x73d3c4
push ebx
call fcn.005e6cd0
mov ecx, esi
call fcn.005e5500
jmp 0x4ba5cc
mov ecx, ebx
call fcn.005e5390
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov bl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
movzx eax, bl
test bl, bl
cmovs eax, edx
cmovs edi, ecx
test eax, eax
js 0x4babb1
sete cl
test edi, edi
setne dl
or dl, cl
mov ebx, dword [ebp + 8]
je 0x4babb1
lea ecx, [ebp - 0x28]
push eax
push edi
push ebx
call fcn.0053e470
cmp byte [ebp - 0x11], 0
jns 0x4ba62d
push dword [ebp - 0x1c]
call fcn.006507ee
add esp, 4
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x44]
cmp byte [ebp - 0x29], 0
jns 0x4ba644
push dword [ebp - 0x34]
call fcn.006507ee
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.005e5500
cmp byte [edi + 0x14], 1
jne 0x4ba662
cmp byte [edi + 0x13], 0
jns 0x4ba662
push dword [esi]
call fcn.006507ee
add esp, 4
mov esp, dword [ebp - 0x74]
jmp 0x4ba5cc
mov dword [ebp - 0x74], esp
push eax
sub esp, 0x14
mov ebx, esp
lea eax, [ebx + 8]
mov ecx, dword [edi + 4]
mov edi, eax
push str.profile_path
push eax
call fcn.004bb8d0
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
cmp byte [ebx + 0x14], 1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x58], edi
jne 0x4ba8da
xor esi, esi
dec esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
movsx eax, byte [ebx + 0x13]
mov ecx, edi
test eax, eax
jns 0x4ba6c0
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
test eax, eax
mov ebx, dword [ebp + 8]
js 0x4babb1
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4babb1
lea edx, [ebp - 0x1c]
push eax
push ecx
push edx
call fcn.00535b70
add esp, 0xc
lea edi, [ebp - 0x28]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov esi, str._USERNAME_
push esi
call fcn.0066e590
add esp, 4
push eax
push esi
push edi
call fcn.00535b70
add esp, 0xc
mov dword [ebp - 0x5c], edi
movsx edi, byte [edi + 0xb]
test edi, edi
jns 0x4ba721
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
movsx eax, byte [ebp - 0x11]
test eax, eax
mov esi, dword [ebp - 0x1c]
lea edx, [ebp - 0x1c]
mov ecx, edx
cmovs ecx, esi
test edi, edi
je 0x4ba7b0
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x45], al
test al, al
mov ecx, dword [ebp - 0x18]
mov esi, eax
cmovs esi, ecx
cmp esi, edi
jge 0x4ba819
mov edi, dword [ebp - 0x44]
cmp byte [ebp - 0x45], 0
cmovs eax, ecx
cmovs edx, dword [ebp - 0x68]
test eax, eax
js 0x4babb1
mov esi, eax
sete al
test edx, edx
setne cl
or cl, al
je 0x4babb1
mov ecx, ebx
push esi
push edx
call fcn.005e5420
mov esi, dword [ebp - 0x58]
cmp byte [ebp - 0x1d], 0
jns 0x4ba796
push dword [ebp - 0x28]
call fcn.006507ee
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x4ba64c
push dword [ebp - 0x1c]
call fcn.006507ee
add esp, 4
jmp 0x4ba64c
xor esi, esi
xorps xmm0, xmm0
lea edi, [ebp - 0x34]
movsd qword [edi], xmm0
mov dword [edi + 8], 0
push edi
call fcn.004badb0
add esp, 4
mov ebx, eax
test al, al
jne 0x4babe3
mov ecx, dword [ebp + 8]
call fcn.005e5390
cmp byte [ebp - 0x29], 0
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x44]
lea edx, [ebp - 0x1c]
jns 0x4ba7fb
push dword [ebp - 0x34]
call fcn.006507ee
lea edx, [ebp - 0x1c]
add esp, 4
test bl, bl
mov ebx, dword [ebp + 8]
je 0x4ba785
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x68], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x45], al
movzx eax, al
jmp 0x4ba754
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
lea eax, [esi + esi]
mov edx, dword [ebp - 0x64]
lea ecx, [edx + esi*2]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x5c]
movzx ecx, word [ecx]
mov word [ebp - 0x60], cx
lea ecx, [edx + eax]
add ecx, 0xfffffffe
mov dword [ebp - 0x70], ecx
mov eax, esi
sub eax, edi
inc eax
je 0x4ba85a
inc esi
xor eax, eax
movzx ecx, word [ebp - 0x60]
cmp word [edx + eax], cx
je 0x4ba882
add eax, 2
dec esi
cmp edi, esi
jne 0x4ba848
mov edi, dword [ebp - 0x44]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
jmp 0x4ba754
mov esi, dword [ebp - 0x70]
sub esi, edx
add edx, eax
add edx, 2
sub esi, eax
sar esi, 1
cmp esi, edi
mov ebx, dword [ebp + 8]
jge 0x4ba83e
jmp 0x4ba85a
mov ecx, edx
add ecx, eax
je 0x4ba85a
mov dword [ebp - 0x54], ecx
xor esi, esi
mov ecx, dword [ebp - 0x54]
movzx ebx, word [ecx + esi*2]
mov ecx, dword [ebp - 0x5c]
cmp bx, word [ecx + esi*2]
jne 0x4ba86b
inc esi
cmp edi, esi
jne 0x4ba88d
mov ebx, dword [ebp - 0x54]
cmp ebx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x44]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
je 0x4ba8d2
sub ebx, dword [ebp - 0x64]
mov dword [ebp - 0x54], ebx
cmp ebx, 0xfffffffe
mov ebx, dword [ebp + 8]
je 0x4ba754
mov esi, dword [ebp - 0x54]
sar esi, 1
jmp 0x4ba7b2
mov ebx, dword [ebp + 8]
jmp 0x4ba754
xor ebx, ebx
dec ebx
lea ecx, [ebp - 0x28]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.005e5390
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
xor edi, edi
push edi
push edi
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4baa05
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp eax, 0x7ffffff8
jae 0x4bac0d
cmp eax, 5
jae 0x4babb3
lea edi, [ebp - 0x1c]
mov byte [edi + 0xb], al
mov ebx, eax
add eax, eax
push eax
push 0
push edi
call fcn.006547d0
add esp, 0xc
mov word [edi + ebx*2], 0
cmp byte [ebp - 0x11], 0
jns 0x4ba94f
mov esi, dword [ebp - 0x1c]
push ebx
push esi
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ba9c7
movsx edx, byte [ebp - 0x11]
test edx, edx
mov ecx, dword [ebp - 0x18]
mov esi, edx
cmovs esi, ecx
cmp eax, esi
jae 0x4ba9c7
test dl, dl
mov ebx, dword [ebp + 8]
jns 0x4ba9aa
cmp ecx, eax
jb 0x4ba9b8
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov word [ecx + eax*2], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
xorps xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
jmp 0x4ba9d9
mov ecx, edx
cmp eax, edx
ja 0x4ba9b8
lea ecx, [ebp - 0x1c]
mov byte [ecx + 0xb], al
jmp 0x4ba983
sub eax, ecx
lea ecx, [ebp - 0x1c]
push 0
push eax
call fcn.005ce320
jmp 0x4ba989
xorps xmm0, xmm0
movsd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], 0
mov ebx, dword [ebp + 8]
cmp byte [ebp - 0x11], 0
jns 0x4ba9ea
push dword [ebp - 0x1c]
call fcn.006507ee
add esp, 4
mov cl, byte [ebp - 0x29]
mov edi, dword [ebp - 0x30]
test cl, cl
movzx eax, cl
cmovs eax, edi
test eax, eax
je 0x4baa1b
test cl, cl
jns 0x4baa3f
mov edx, dword [ebp - 0x34]
jmp 0x4baa42
xorps xmm0, xmm0
movsd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x2c], 0
xor ecx, ecx
mov ebx, dword [ebp + 8]
jmp 0x4ba9f0
lea eax, [ebp - 0x28]
push eax
push 0x6f
call fcn.0052f1b0
add esp, 8
test al, al
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x44]
jne 0x4baa6e
mov ecx, ebx
call fcn.005e5390
jmp 0x4ba633
lea edx, [ebp - 0x34]
test eax, eax
js 0x4babb1
test edx, edx
je 0x4babb1
lea esi, [ebp - 0x1c]
mov ecx, esi
push eax
push edx
call fcn.005e5420
lea ecx, [ebp - 0x28]
push esi
call fcn.005e5580
mov ecx, esi
call fcn.005e5500
push 0x30
call fcn.006507be
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x80000030
mov dword [ebp - 0x18], 0x2c
lea ecx, [eax + 0x2c]
mov edx, str.CompanyName_ProductName_InternalStream
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x4babb1
movups xmm0, xmmword [0x73d3fa]
movups xmmword [eax + 0x1c], xmm0
movups xmm0, xmmword [0x73d3ee]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [str.CompanyName_ProductName_InternalStream]
movups xmmword [eax], xmm0
mov byte [eax + 0x2c], 0
call fcn.004bb3f0
test eax, eax
je 0x4babb1
mov esi, eax
push eax
call fcn.0066e590
add esp, 4
lea edi, [ebp - 0x1c]
push eax
push esi
push 0xd
push 0x73d40b
push 0
push edi
call fcn.005daf40
add esp, 0x18
call fcn.004bb420
test eax, eax
je 0x4babb1
mov esi, eax
push eax
call fcn.0066e590
add esp, 4
push eax
push esi
push 0xd
push 0x73d419
push 0
push edi
call fcn.005daf40
add esp, 0x18
lea esi, [ebp - 0x40]
mov eax, dword [ebp - 0x44]
push dword [eax + 4]
push esi
call fcn.004bbb70
add esp, 8
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x4bab42
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
test eax, eax
js 0x4babb1
sete cl
test esi, esi
setne dl
or dl, cl
je 0x4babb1
push eax
push esi
push 0x10
push str.InternalStream
push 0
push edi
call fcn.005daf40
add esp, 0x18
cmp byte [ebp - 0x35], 0
jns 0x4bab77
push dword [ebp - 0x40]
call fcn.006507ee
add esp, 4
movsx eax, byte [ebp - 0x11]
test eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov esi, edi
cmovs esi, ecx
mov ebx, eax
cmovs ebx, edx
test ebx, ebx
je 0x4bab95
xor eax, eax
jmp 0x4baba9
mov ebx, eax
jmp 0x4ba5ee
mov byte [esi + eax], 0x5c
inc eax
cmp ebx, eax
je 0x4ba5e2
cmp byte [esi + eax], 0x2f
jne 0x4baba0
jmp 0x4bab9c
ud2
mov ebx, eax
or ebx, 3
inc ebx
mov dword [ebp - 0x60], eax
js 0x4bac15
lea eax, [ebx + ebx]
push eax
call fcn.006507be
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], eax
or ebx, 0x80000000
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x18], eax
jmp 0x4ba930
movsx eax, byte [ebp - 0x1d]
test eax, eax
jns 0x4babee
mov eax, dword [ebp - 0x24]
movsx edx, byte [ebp - 0x29]
test edx, edx
cmovs edx, dword [ebp - 0x30]
cmovs edi, dword [ebp - 0x34]
lea ecx, [ebp - 0x1c]
push edx
push edi
push eax
push esi
call fcn.0069e3d0
jmp 0x4ba7de
lea ecx, [ebp - 0x1c]
call fcn.006837c0
call fcn.006837b0
int3