Function at 0x430e40
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x443756
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.0043f560
mov eax, dword [0x451050]
xor eax, esp
mov dword [esp + 0x203c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451050]
xor eax, esp
push eax
lea eax, [esp + 0x2054]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2064]
xor edi, edi
mov dword [esp + 0x14], edi
xor ecx, ecx
mov word [esp + 0x38], cx
mov ecx, eax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x430ea4
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x38]
call fcn.00403960
mov dword [esp + 0x205c], edi
mov eax, dword [esp + 0x48]
cmp eax, edi
jg 0x430ee7
cmp dword [esp + 0x4c], 8
jb 0x430ee0
mov edx, dword [esp + 0x38]
push edx
call fcn.00434772
add esp, 4
xor eax, eax
jmp 0x431132
cmp eax, 4
jle 0x430f30
lea edx, [eax - 4]
lea eax, [esp + 0x34]
push eax
mov ecx, 4
lea esi, [esp + 0x1c]
call fcn.004173d0
mov esi, 8
mov dword [esp + 0x14], 1
cmp dword [eax + 0x18], esi
jb 0x430f19
mov eax, dword [eax + 4]
jmp 0x430f1c
add eax, 4
push str..exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x430f30
xor bl, bl
jmp 0x430f37
mov bl, 1
mov esi, 8
test byte [esp + 0x14], 1
je 0x430f51
cmp dword [esp + 0x30], esi
jb 0x430f51
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00434772
add esp, 4
test bl, bl
je 0x430f65
push 4
mov eax, str..exe
lea ecx, [esp + 0x38]
call fcn.004037d0
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], esi
jae 0x430f73
lea eax, [esp + 0x38]
mov dword [esp + 0x14], edi
push 1
cmp dword [esp + 0x206c], edi
je 0x43107c
lea edx, [esp + 0x18]
push edx
push edi
push edi
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x431087
mov ebp, dword [esp + 0x14]
cmp ebp, edi
jne 0x43111c
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x38]
mov dword [esp + 0x18], 0x3a
call fcn.004078c0
cmp eax, 0xffffffff
jne 0x43111c
push 0x1000
lea eax, [esp + 0x54]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x43111c
lea esi, [esp + 0x50]
mov edi, esi
lea ebx, [ebx]
movzx eax, word [edi]
cmp ax, 0x3b
je 0x431012
lea esp, [esp]
test ax, ax
je 0x431012
movzx eax, word [edi + 2]
add edi, 2
cmp ax, 0x3b
jne 0x431000
mov edx, edi
sub edx, esi
sar edx, 1
xor ecx, ecx
mov eax, esi
xor ebp, ebp
push edx
lea esi, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebp
mov word [esp + 0x20], cx
call fcn.00403960
mov byte [esp + 0x205c], 1
mov eax, dword [esp + 0x2c]
cmp eax, ebp
jle 0x43108e
lea esi, [eax - 1]
cmp esi, eax
jbe 0x431055
call fcn.004344ed
mov eax, dword [esp + 0x1c]
mov ebx, 8
cmp dword [esp + 0x30], ebx
jae 0x431068
lea eax, [esp + 0x1c]
cmp word [eax + esi*2], 0x5c
je 0x431093
push 0x5c
lea esi, [esp + 0x1c]
call fcn.0040b8c0
jmp 0x431093
push edi
lea ecx, [esp + 0x1c]
push ecx
jmp 0x430f8c
xor ebp, ebp
jmp 0x430fa8
mov ebx, 8
push ebp
lea eax, [esp + 0x38]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x20]
call fcn.00403710
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebx
jae 0x4310b3
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], ebp
push 1
cmp dword [esp + 0x206c], ebp
je 0x4310ca
lea ecx, [esp + 0x18]
push ecx
push ebp
jmp 0x4310d0
push ebp
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x4310e4
mov ebp, dword [esp + 0x14]
test ebp, ebp
jne 0x431113
cmp word [edi], 0x3b
jne 0x431113
add edi, 2
mov byte [esp + 0x205c], 0
mov esi, edi
cmp dword [esp + 0x30], ebx
jb 0x430ff0
mov eax, dword [esp + 0x1c]
push eax
call fcn.00434772
add esp, 4
jmp 0x430ff0
lea esi, [esp + 0x18]
call fcn.004034a0
cmp dword [esp + 0x4c], 8
jb 0x431130
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00434772
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x2054]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x203c]
xor ecx, esp
call fcn.00433c32
add esp, 0x204c
ret