Function at 0x40d61e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4233cc]
mov edx, dword [ebp + 0x1c]
test edx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], edx
je 0x40d65f
and dword [edx], 0
test ebx, ebx
je 0x40d6a3
push 0xa
lea eax, [ebp - 0x224]
push eax
push ebx
call dword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
mov eax, dword [ebp - 0x224]
add esp, 0xc
cmp word [eax], 0
mov dword [ebp - 0x218], ecx
jne 0x40d69c
cmp eax, ebx
je 0x40d69c
test esi, esi
mov edx, dword [ebp - 0x21c]
je 0x40d6ad
mov dword [esi], ecx
jmp 0x40d6ad
push 0xd
jmp 0x40da64
mov eax, dword [esi]
mov dword [ebp - 0x218], eax
mov ecx, eax
xor eax, eax
cmp dword [ebp - 0x214], eax
jne 0x40d6c1
mov dword [ebp - 0x214], 0x401460
cmp ecx, 0x18
ja 0x40d82b
je 0x40d806
cmp ecx, 0x11
ja 0x40d732
je 0x40d727
mov eax, ecx
sub eax, 0
je 0x40da8c
dec eax
je 0x40d70e
sub eax, 9
je 0x40d8b5
dec eax
je 0x40d703
dec eax
jne 0x40d8fc
mov esi, dword [0x4235e0]
jmp 0x40da35
mov esi, dword [0x4235dc]
jmp 0x40da35
mov esi, dword [ebp - 0x220]
test esi, esi
jne 0x40da39
mov esi, dword [0x4235e4]
jmp 0x40da35
mov esi, dword [0x4235d4]
jmp 0x40da35
mov eax, ecx
sub eax, 0x12
je 0x40d7e0
dec eax
dec eax
je 0x40d7ba
dec eax
je 0x40d794
dec eax
dec eax
jne 0x40d8fc
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp dword [0x424c50], 2
push 0
lea eax, [ebp - 0x20c]
push ebx
jne 0x40d77e
push 0x4028f8
jmp 0x40d783
push 0x4028ec
push eax
call fcn.0041a306
lea esi, [ebp - 0x20c]
jmp 0x40da39
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028dc
jmp 0x40d92a
mov ebx, 0x104
push ebx
push dword [0x4235d0]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028d0
jmp 0x40d92a
mov ebx, 0x104
push ebx
push dword [0x4235d0]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028c4
jmp 0x40d92a
push 0x104
push dword [0x4235d0]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
and word [ebp - 0x208], 0
jmp 0x40d789
cmp ecx, 0x35
ja 0x40d8d9
je 0x40d8c0
mov eax, ecx
sub eax, 0x19
je 0x40d8b5
sub eax, 5
je 0x40d967
sub eax, 0x14
je 0x40d8aa
dec eax
je 0x40d884
dec eax
jne 0x40d8fc
lea eax, [ebp - 0x210]
push eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
test eax, eax
jne 0x40d789
jmp 0x40da6a
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x4028b8
jmp 0x40d92a
mov esi, dword [0x4235d8]
jmp 0x40da35
mov esi, dword [0x4235d0]
jmp 0x40da35
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x4028a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x40d877
cmp ecx, 0x36
je 0x40d967
cmp ecx, 0x37
je 0x40d946
cmp ecx, 0xffff
je 0x40da8c
cmp ecx, 0xffffffff
je 0x40da8c
cmp ecx, 0x8000
jae 0x40d93f
test ch, 0x40
jne 0x40d935
mov ebx, 0x104
push ebx
push dword [0x4235dc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0
push ebx
push 0x402890
lea eax, [ebp - 0x20c]
jmp 0x40d783
test edx, edx
je 0x40d93f
mov dword [edx], 1
push 0
jmp 0x40da64
lea ecx, [ebp - 0x210]
push ecx
push 0x208
lea ecx, [ebp - 0x20c]
push ecx
push 1
push eax
push eax
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryW
jmp 0x40d877
test edi, edi
je 0x40d987
mov eax, dword [edi]
test eax, eax
je 0x40d987
mov ebx, 0x104
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x40d9ea
lea eax, [ebp - 0x210]
push eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.004111a9
test eax, eax
je 0x40d9ac
push eax
jmp 0x40da64
test edi, edi
je 0x40d9ea
mov eax, dword [ebp - 0x210]
add eax, eax
push eax
mov dword [ebp - 0x210], eax
call fcn.0041a065
test eax, eax
mov dword [edi], eax
je 0x40da62
mov ecx, dword [ebp - 0x210]
mov edi, eax
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x218], 0x1e
jne 0x40da2f
cmp word [ebp - 0x20c], 0
je 0x40da1b
cmp word [ebp - 0x20a], 0x3a
jne 0x40da1b
cmp word [ebp - 0x208], 0x5c
jne 0x40da1b
and word [ebp - 0x206], 0
jmp 0x40da2f
push ebx
push dword [0x4235c8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea esi, [ebp - 0x20c]
test esi, esi
je 0x40da8c
lea eax, [ebp - 0x210]
push eax
push 0
push dword [ebp - 0x214]
push esi
call fcn.0041a306
mov eax, dword [ebp - 0x210]
add eax, eax
push eax
call fcn.0041a065
mov ebx, eax
test ebx, ebx
jne 0x40da6e
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40dad9
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push ebx
call fcn.0041a306
jmp 0x40da99
push dword [ebp - 0x214]
call fcn.0041a138
mov ebx, eax
test ebx, ebx
je 0x40dad7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
mov dword [ebp - 0x210], eax
je 0x40dad7
lea eax, [ebx + eax*2]
push eax
push ebx
call dword [sym.imp.USER32.dll_CharPrevW]
cmp word [eax], 0x5c
jne 0x40dad7
mov eax, dword [ebp - 0x210]
cmp eax, 3
jne 0x40dad1
cmp word [ebx + 2], 0x3a
je 0x40dad7
and word [ebx + eax*2 - 2], 0
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00419805
leave
ret 0x18