Function at 0x453e00
Capabilities:
Contain obfuscated stackstrings
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
mov eax, 0x8228
mov ebp, esp
push edi
push esi
push ebx
call fcn.0057e5f0
sub esp, eax
mov eax, dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
lea ebx, [ebp - 0x810c]
mov dword [esp + 4], str.Long_long_value
mov dword [esp], str.EnvVar
mov dword [ebp - 0x8214], eax
call eax
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsA]
sub esp, 8
mov dword [esp + 8], 0x100
mov dword [esp + 4], ebx
mov dword [esp], 0
call edi
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x188
xor eax, eax
cmp esi, 2
setbe al
mov dword [esp + 8], esi
lea esi, [ebp - 0x820c]
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_n
mov dword [esp], eax
call fcn.00453360
mov byte [ebp - 0x8204], 0
mov dword [ebp - 0x820c], 0x766e4525
mov dword [ebp - 0x8208], 0x25726156
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [ebp - 0x8210], edi
call edi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
test edi, 0xffffffdf
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x18e
sete al
mov dword [esp + 8], edi
sub edi, 0x10
cmp edi, 1
mov dword [esp + 0x14], 0
setbe dl
mov dword [esp + 0x10], 0x11
or eax, edx
mov dword [esp + 0xc], 0x10
movzx eax, al
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_instead_of__d___d_or__d_n
mov dword [esp], eax
call fcn.00453360
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov edi, dword [ebp - 0x8210]
call edi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x198
lea eax, [edi - 0x10]
cmp eax, 1
mov dword [esp + 8], edi
setbe al
cmp edi, 0x20
mov dword [esp + 0xc], 0x10
sete dl
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_instead_of__d_n
or eax, edx
movzx eax, al
mov dword [esp], eax
call fcn.00453360
mov dword [esp + 8], 0xc
mov dword [esp + 4], ebx
mov dword [esp], esi
mov edi, dword [ebp - 0x8210]
call edi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1a0
lea eax, [edi - 0x10]
cmp eax, 1
mov dword [esp + 8], edi
setbe al
cmp edi, 0x20
mov dword [esp + 0xc], 0x10
sete dl
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_instead_of__d_n
or eax, edx
movzx eax, al
mov dword [esp], eax
call fcn.00453360
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], esi
mov edi, dword [ebp - 0x8210]
call edi
sub esp, 0xc
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1a8
lea eax, [edi - 0x10]
cmp eax, 1
mov dword [esp + 0xc], 0x10
setbe al
cmp edi, 0x20
mov dword [esp + 8], edi
sete dl
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_instead_of__d_n
or eax, edx
movzx eax, al
mov dword [esp], eax
call fcn.00453360
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1ac
cmp dword [ebp - 0x810c], 0x676e6f4c
je 0x454478
mov eax, 1
xor eax, 1
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned___s__n
call fcn.00453360
mov edx, 0x25
mov dword [ebp - 0x820c], 0x746f4e25
mov word [ebp - 0x8200], dx
mov dword [ebp - 0x8208], 0x6e456e41
mov dword [ebp - 0x8204], 0x72615676
mov dword [esp + 8], 0x100
mov dword [esp + 4], ebx
mov dword [esp], esi
mov eax, dword [ebp - 0x8210]
call eax
sub esp, 0xc
mov edi, eax
call fcn.0057d110
cmp edi, 0xe
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1b1
sete al
cmp edi, 0x1c
sete dl
mov dword [esp + 0xc], 0xe
or eax, edx
mov dword [esp + 8], edi
movzx eax, al
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_instead_of__d_n
mov dword [esp], eax
call fcn.00453360
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1b4
cmp dword [ebp - 0x810c], 0x746f4e25
je 0x454440
mov eax, 1
xor eax, 1
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned___s__n
call fcn.00453360
mov eax, 0x35
mov dword [ebp - 0x820c], 0x34333231
mov word [ebp - 0x8208], ax
lea eax, [ebp - 0x800c]
mov dword [esp + 8], 0x8000
mov dword [esp + 4], eax
mov dword [esp], esi
mov eax, dword [ebp - 0x8210]
call eax
sub esp, 0xc
mov edi, eax
call fcn.0057d110
lea edx, [ebp - 0x800c]
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1b9
mov eax, dword [sym.imp.msvcrt.dll_strcmp]
mov dword [esp + 4], edx
mov dword [esp], esi
mov dword [ebp - 0x8218], eax
call eax
lea edx, [ebp - 0x800c]
mov dword [esp + 0x10], edi
test eax, eax
mov dword [esp + 0xc], edx
sete al
mov dword [esp + 8], esi
movzx eax, al
mov dword [esp + 4], str.ExpandEnvironmentStrings_failed__s_vs__s._ret_size___ld_n
mov dword [esp], eax
call fcn.00453360
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 0xdeadbeef
mov dword [ebp - 0x821c], edx
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
sub esp, 8
mov edi, eax
call fcn.0057d110
sub edi, 1
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1bd
xor eax, eax
cmp edi, 0xfe
setbe al
mov dword [esp + 4], str.GetWindowsDirectory_Failed_n
mov dword [esp], eax
call fcn.00453360
mov dword [esp + 8], 0x100
mov dword [esp + 4], esi
mov dword [esp], str._SystemRoot_
mov ecx, dword [ebp - 0x8210]
call ecx
mov edx, dword [ebp - 0x821c]
sub esp, 0xc
mov edi, eax
cmp dword [edx + 0x34], 0xcb
je 0x45428e
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1c1
mov dword [esp + 4], ebx
mov dword [esp], esi
mov eax, dword [ebp - 0x8218]
call eax
mov dword [esp + 0x10], edi
test eax, eax
mov dword [esp + 0xc], ebx
sete al
mov dword [esp + 8], esi
movzx eax, al
mov dword [esp + 4], str.ExpandEnvironmentStrings_failed__s_vs__s._ret_size___ld_n
mov dword [esp], eax
call fcn.00453360
mov dword [esp + 4], str.Foo_EnvVar_Bar
mov dword [esp], str.IndirectVar
mov eax, dword [ebp - 0x8214]
call eax
mov byte [ebp - 0x7fec], 0
mov dword [ebp - 0x820c], 0x69646e49
sub esp, 8
mov dword [ebp - 0x8208], 0x74636572
mov dword [ebp - 0x8204], 0x6e49252d
mov dword [ebp - 0x8200], 0x65726964
mov dword [ebp - 0x81fc], 0x61567463
mov dword [ebp - 0x81f8], 0x492d2572
mov dword [ebp - 0x81f4], 0x7269646e
mov dword [ebp - 0x81f0], 0x746365
mov dword [ebp - 0x800c], 0x69646e49
mov dword [ebp - 0x8008], 0x74636572
mov dword [ebp - 0x8004], 0x6f6f462d
mov dword [ebp - 0x8000], 0x766e4525
mov dword [ebp - 0x7ffc], 0x25726156
mov dword [ebp - 0x7ff8], 0x2d726142
mov dword [ebp - 0x7ff4], 0x69646e49
mov dword [ebp - 0x7ff0], 0x74636572
mov dword [esp], esi
mov dword [esp + 8], 0x100
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x8210]
call eax
sub esp, 0xc
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1c9
lea eax, [ebp - 0x800c]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_strlen]
mov edx, 1
add eax, 1
cmp eax, esi
je 0x4543a3
lea edx, [eax + eax]
cmp edx, esi
sete dl
movzx edx, dl
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned__ld_instead_of__d_n
call fcn.00453360
call fcn.0057d110
mov dword [eax], 0x595e93
mov dword [eax + 4], 0x1cc
lea eax, [ebp - 0x800c]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8218]
call eax
mov dword [esp + 8], ebx
test eax, eax
mov dword [esp + 4], str.ExpandEnvironmentStrings_returned___s__n
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00453360
mov dword [esp + 4], 0
mov dword [esp], str.IndirectVar
mov ebx, dword [ebp - 0x8214]
mov eax, ebx
call eax
mov eax, ebx
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], str.EnvVar
call eax
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x8108], 0x6e456e41
jne 0x454116
cmp dword [ebp - 0x8104], 0x72615676
jne 0x454116
xor eax, eax
cmp word [ebp - 0x8100], 0x25
jne 0x454116
jmp 0x45411b
cmp dword [ebp - 0x8108], 0x6e6f6c20
jne 0x454053
cmp dword [ebp - 0x8104], 0x61762067
jne 0x454053
xor eax, eax
cmp dword [ebp - 0x8100], 0x65756c
jne 0x454053
jmp 0x454058