Function at 0x40b149
Capabilities:
Get file attributes
Query environment variable
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x45b480]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
xor eax, eax
mov dword [esp + 0x60], edx
push edi
mov dword [esp + 0x10], eax
call fcn.00402506
push eax
lea ecx, [esp + 0x10]
call fcn.00402331
lea edx, [esp + 0xc]
xor ecx, ecx
call fcn.004141aa
mov ebx, eax
test ebx, ebx
je 0x40b1a4
jle 0x40bc67
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40bc67
xor eax, eax
push eax
push eax
push 3
push eax
push 7
push 0x100080
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x74], eax
cmp eax, 0xffffffff
jne 0x40b1ce
call fcn.0041390d
mov ebx, eax
jmp 0x40b203
push 4
push 0x28
lea ecx, [esp + 0x130]
push ecx
lea ecx, [esp + 0xdc]
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
je 0x40b211
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
test ebx, ebx
jle 0x40b203
movzx ebx, bx
or ebx, 0x80070000
lea ecx, [esp + 0x74]
call fcn.00411dea
jmp 0x40bc67
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0x74]
add eax, 0x3c773000
mov dword [esp + 0x40], eax
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x144]
adc eax, 0xffffffef
mov dword [esp + 0x5c], eax
mov dword [esp + 0x144], eax
call fcn.00411dea
push dword [esp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
test eax, eax
jne 0x40b25e
mov ebx, 0x80004005
jmp 0x40bc67
sub eax, dword [esp + 0xc]
lea ecx, [esp + 0xc]
sar eax, 1
dec eax
push eax
call fcn.004020f5
call fcn.00402506
push eax
lea ecx, [esp + 0x38]
call fcn.00402331
push str.WindowsSystem32_ntdll.dll
lea edx, [esp + 0x10]
lea ecx, [esp + 0xb8]
call fcn.00401ec9
pop ecx
mov ecx, dword [eax]
call fcn.0041427a
mov ecx, dword [esp + 0xb4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.004025d7
test esi, esi
je 0x40b324
cmp esi, 9
je 0x40b2f6
cmp esi, 0xc
je 0x40b2c8
mov edi, dword [esp + 0x34]
mov ebx, 0x80004002
jmp 0x40bc5f
push str.WindowsSysWOW64downlevel_
lea edx, [esp + 0x10]
mov esi, str.Wow6432NodeMicrosoftWindowsCurrentVersionComponent_Based_Servicing
lea ecx, [esp + 0x90]
call fcn.00401ec9
pop ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00402280
mov ecx, dword [esp + 0x8c]
jmp 0x40b350
push str.WindowsSysWOW64downlevel_
lea edx, [esp + 0x10]
mov esi, str.Wow6432NodeMicrosoftWindowsCurrentVersionComponent_Based_Servicing
lea ecx, [esp + 0x94]
call fcn.00401ec9
pop ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00402280
mov ecx, dword [esp + 0x90]
jmp 0x40b350
push str.WindowsSystem32downlevel_
lea edx, [esp + 0x10]
mov esi, str.MicrosoftWindowsCurrentVersionComponent_Based_Servicing
lea ecx, [esp + 0x98]
call fcn.00401ec9
pop ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00402280
mov ecx, dword [esp + 0x94]
lea ecx, [ecx - 0x10]
call fcn.004025d7
call fcn.00402506
push eax
lea ecx, [esp + 0x54]
call fcn.00402331
push str.WindowsSystem32configSOFTWARE
lea edx, [esp + 0x10]
lea ecx, [esp + 0x9c]
call fcn.00401ec9
pop ecx
lea edx, [esp + 0x50]
mov ecx, dword [eax]
call fcn.0040b08b
mov ecx, dword [esp + 0x98]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov edi, dword [esp + 0x34]
mov dword [esp + 0x48], edi
test ebx, ebx
je 0x40b3b9
jle 0x40bc53
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40bc53
lea eax, [esp + 0x50]
mov dword [esp + 0xd8], 0x44e74c
mov dword [esp + 0xdc], eax
lea ecx, [esp + 0x178]
lea eax, [esp + 0xd8]
push eax
mov dword [esp + 0x100], eax
call fcn.00411b06
mov ecx, dword [esp + 0xfc]
test ecx, ecx
je 0x40b415
mov edx, dword [ecx]
lea eax, [esp + 0xd8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov dword [esp + 0xfc], eax
jmp 0x40b417
xor eax, eax
push esi
lea edx, [esp + 0x54]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0xa0]
call fcn.00401ec9
pop ecx
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 4
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x9c]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.004025d7
test ebx, ebx
je 0x40b46f
jle 0x40bc2e
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40bc2e
call fcn.00402506
push eax
lea ecx, [esp + 0x28]
call fcn.00402331
lea eax, [esp + 0x20]
mov dword [esp + 0xc4], eax
lea ecx, [esp + 0xc4]
lea eax, [esp + 0x24]
mov dword [esp + 0xc8], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xcc], eax
call fcn.0040bc8a
mov ebx, eax
test ebx, ebx
je 0x40b4c5
jle 0x40bc22
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40bc22
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x24]
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.00411cbd
push 0x5c
pop ecx
cmp ax, cx
je 0x40b4e9
push ecx
lea ecx, [esp + 0x28]
call fcn.00401c04
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40b57e
lea ecx, [edi - 0x10]
call fcn.00402227
add eax, 0x10
lea ecx, [esp + 0x38]
push 0x3b
mov dword [esp + 0x3c], eax
call fcn.00401c04
mov esi, dword [esp + 0x38]
xor eax, eax
push eax
push eax
push 0x44c510
mov ebx, dword [esi - 0xc]
mov dword [esp + 0x60], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [esp + 0x58], eax
test eax, eax
je 0x40b56a
lea esi, [eax + ebx]
push esi
lea ecx, [esp + 0x3c]
call fcn.00402070
push esi
lea ecx, [esp + 0x3c]
mov ebx, eax
call fcn.004020f5
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
inc ecx
push ecx
lea eax, [ebx + eax*2]
push eax
push 0x44c510
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [esp + 0x38]
push esi
push 0x44c510
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [esi - 0x10]
call fcn.004025d7
push str.SetDllDirectoryW
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x40b5a1
push dword [esp + 0x24]
call eax
push str.CbsCore.dll
lea edx, [esp + 0x28]
lea ecx, [esp + 0xa4]
call fcn.00401ec9
pop ecx
push 8
xor edx, edx
push edx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [esp + 0xa0]
mov esi, eax
mov dword [esp + 0xbc], esi
lea ecx, [ecx - 0x10]
call fcn.004025d7
test esi, esi
jne 0x40b5ec
call fcn.0041390d
mov ebx, eax
jmp 0x40bc16
push str.CbsCoreInitialize
push esi
call ebx
push str.CbsCoreFinalize
push esi
mov dword [esp + 0x5c], eax
call ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x7c], eax
test ebx, ebx
je 0x40bc11
test eax, eax
je 0x40bc11
lea eax, [esp + 0x7c]
mov dword [esp + 0x100], 0x44e734
mov dword [esp + 0x104], eax
lea ecx, [esp + 0x150]
lea eax, [esp + 0x100]
push eax
mov dword [esp + 0x128], eax
call fcn.00411b06
mov ecx, dword [esp + 0x124]
test ecx, ecx
je 0x40b672
mov edx, dword [ecx]
lea eax, [esp + 0x100]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov dword [esp + 0x124], eax
push ecx
mov ecx, dword [esp + 0x10]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00402227
add eax, 0x10
mov ecx, 0x47e688
push ebx
mov dword [esi], eax
call fcn.0040753c
mov ebx, eax
test ebx, ebx
jne 0x40bc03
xor ecx, ecx
lea edx, [esp + 0x44]
mov eax, ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x2c], eax
mov esi, ecx
mov dword [esp + 0x80], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x84], eax
mov eax, dword [0x47e714]
push edx
push 0x130
push eax
mov ecx, dword [eax]
mov dword [esp + 0x74], esi
mov dword [esp + 0x94], esi
call dword [ecx + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x4c], ebx
test ebx, ebx
js 0x40b6f2
test eax, eax
jne 0x40b705
mov ebx, 0x80004003
test eax, eax
je 0x40bc03
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40bc03
mov ecx, dword [eax]
lea edx, [esp + 0xc0]
push edx
lea edx, [esp + 0x2c]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x40ba24
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x5c]
xor eax, eax
mov ecx, 0x47e688
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x2c]
call fcn.00407704
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x4c], ebx
test ebx, ebx
js 0x40b9ca
test eax, eax
je 0x40b9d4
xor edx, edx
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x3c]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x10]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x40b9c6
xor ecx, ecx
cmp word [eax], cx
je 0x40b9c6
push 0xc
push str.Package_for_
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x40b9c6
mov dword [esp + 0x60], eax
lea edx, [esp + 0x60]
mov eax, dword [esp + 0x1c]
push edx
push 0xb
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
cmp dword [esp + 0x60], 0
je 0x40b7d0
push 0x44d9c0
push dword [esp + 0x64]
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x40b9c6
xor eax, eax
lea edx, [esp + 0x78]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x1c]
push edx
push 0x11
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
js 0x40b828
mov eax, dword [esp + 0x78]
test eax, eax
je 0x40b828
xor ecx, ecx
cmp word [eax], cx
je 0x40b828
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x74]
push ecx
push 0x44d9c4
push eax
call fcn.0040f214
add esp, 0x10
cmp eax, 2
je 0x40b98a
jmp 0x40b9c6
or edi, 3
lea ecx, [esp + 0xb0]
mov dword [esp + 0x10], edi
xor eax, eax
push dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
push str.PackagesPending_
call fcn.00401e23
mov edx, eax
lea ecx, [esp + 0xb0]
call fcn.00401ec9
pop ecx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 4
push dword [eax]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b8ca
or edi, 0xc
lea ecx, [esp + 0xa8]
mov dword [esp + 0x10], edi
push dword [esp + 0x3c]
push str.Packages_
call fcn.00401e23
mov edx, eax
lea ecx, [esp + 0xa8]
call fcn.00401ec9
pop ecx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 4
push dword [eax]
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b8ca
xor eax, eax
mov byte [esp + 0x17], al
mov eax, edi
mov dword [esp + 0x10], eax
jmp 0x40b8d3
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], 1
test al, 8
je 0x40b8f1
and eax, 0xfffffff7
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xa4]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov eax, dword [esp + 0x10]
test al, 4
je 0x40b90b
and eax, 0xfffffffb
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xa8]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov ecx, dword [esp + 0xac]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov ecx, dword [esp + 0xb0]
mov edi, dword [esp + 0x10]
and edi, 0xfffffffc
lea ecx, [ecx - 0x10]
call fcn.004025d7
cmp byte [esp + 0x17], 0
je 0x40b971
lea eax, [esp + 0x6c]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x40b971
cmp dword [esp + 0x18], 0
je 0x40b9c6
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [esp + 0x18], eax
jmp 0x40b9c6
cmp dword [esp + 0x18], 0
je 0x40b98a
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [esp + 0x18], eax
cmp esi, dword [esp + 0x70]
jb 0x40b99c
ja 0x40b9c6
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x6c]
ja 0x40b9c6
push dword [esp + 0x3c]
lea ecx, [esp + 0x60]
call fcn.00401e23
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x84]
call fcn.0040cae6
mov ecx, dword [esp + 0x5c]
lea ecx, [ecx - 0x10]
call fcn.004025d7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b9d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x44]
lea edx, [esp + 0xc0]
push edx
lea edx, [esp + 0x2c]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40b72a
mov eax, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 0x48]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x68], esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40ba32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x30]
mov eax, ecx
sub eax, dword [esp + 0x2c]
mov dword [esp + 0xb8], eax
sar eax, 2
mov dword [esp + 0x58], eax
test eax, eax
je 0x40bbc1
push 0x1c
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov ecx, eax
xor edx, edx
mov dword [esp + 0x40], ecx
test ecx, ecx
je 0x40ba97
mov eax, dword [esp + 0x64]
mov dword [ecx], 0x44e8d4
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [ecx + 4], 1
mov dword [ecx], 0x44eacc
mov dword [ecx + 8], 0x40930c
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], edx
jmp 0x40ba9d
mov ecx, edx
mov dword [esp + 0x40], edx
test ecx, ecx
jne 0x40baeb
mov eax, dword [esp + 0x2c]
mov ebx, 0x8007000e
test eax, eax
je 0x40bc03
mov ecx, eax
cmp ecx, dword [esp + 0x30]
je 0x40badd
mov esi, dword [esp + 0x30]
mov edi, eax
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.004025d7
add edi, 4
cmp edi, esi
jne 0x40bac0
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x68]
mov eax, dword [esp + 0x2c]
sub esi, eax
mov ecx, eax
and esi, 0xfffffffc
mov edx, esi
jmp 0x40bbfe
cmp dword [esp + 0xb8], 4
mov eax, edx
mov dword [esp + 0x28], edx
jb 0x40bbb5
mov edi, dword [esp + 0x40]
push ecx
mov dword [edi + 0x10], eax
mov esi, esp
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402227
push dword [esp + 0x58]
add eax, 0x10
mov ecx, 0x47e688
mov dword [esi], eax
call fcn.0040753c
mov esi, eax
test esi, esi
jne 0x40bb83
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x30]
push dword [eax + ecx*4]
mov ecx, 0x47e688
call fcn.004076a7
mov esi, eax
test esi, esi
jne 0x40bb75
mov eax, dword [esp + 0x10]
xor edx, edx
push edi
push edx
push 5
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
js 0x40bb75
push ecx
mov ecx, 0x47e688
call fcn.00407753
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bb83
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0x47e714], 0
jne 0x40bb90
call dword [esp + 0x7c]
test esi, esi
je 0x40bb96
mov ebx, esi
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [esp + 0x58]
jne 0x40bb03
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x4c], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0x30]
jmp 0x40bbc8
xor ebx, ebx
inc ebx
mov dword [esp + 0x4c], ebx
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x40bc03
cmp esi, ecx
je 0x40bbf3
mov ebx, dword [esp + 0x30]
mov edi, esi
mov ecx, dword [edi]
sub ecx, 0x10
call fcn.004025d7
add edi, 4
cmp edi, ebx
jne 0x40bbda
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov edx, dword [esp + 0x68]
mov ecx, esi
sub edx, esi
and edx, 0xfffffffc
call fcn.00401abc
lea ecx, [esp + 0x150]
call fcn.00411ad6
jmp 0x40bc16
mov ebx, 0x80004002
lea ecx, [esp + 0xbc]
call fcn.00411b4e
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.004025d7
cmp dword [esp + 0x20], 0
je 0x40bc47
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb eax, eax
and dword [esp + 0x20], eax
lea ecx, [esp + 0x178]
call fcn.00411ad6
mov ecx, dword [esp + 0x50]
lea ecx, [ecx - 0x10]
call fcn.004025d7
lea ecx, [edi - 0x10]
call fcn.004025d7
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.004025d7
mov ecx, dword [esp + 0x1a4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004488a4
mov esp, ebp
pop ebp
ret