Function at 0x40cbd3
Capabilities:
Query environment variable

Disassembly:
push 0x410
mov eax, 0x60aec1
call fcn.0042d958
push 0x208
xor esi, esi
lea eax, [ebp - 0x3e4]
push esi
push eax
call fcn.0042e9f0
add esp, 0xc
lea eax, [ebp - 0x3e4]
push 0x104
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, 0x1000
push 8
pop edi
test eax, eax
je 0x40ccc5
xor eax, eax
mov dword [ebp - 0x400], esi
mov word [ebp - 0x400], ax
lea ecx, [ebp - 0x400]
lea eax, [ebp - 0x3e4]
mov dword [ebp - 0x3f0], esi
push eax
mov dword [ebp - 0x3ec], 7
call fcn.00414483
mov dword [ebp - 4], esi
lea eax, [ebp - 0x400]
cmp dword [ebp - 0x3ec], edi
push str._UserProfile_
cmovae eax, dword [ebp - 0x400]
push eax
call fcn.0045ec0c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3ec]
cmp eax, edi
jb 0x40ccc5
mov ecx, dword [ebp - 0x400]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x3e8], ecx
cmp eax, ebx
jb 0x40ccbc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x3e8]
push eax
call fcn.00415d5a
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x3e8]
push eax
push ecx
call fcn.0042d678
pop ecx
pop ecx
push 0xc8
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0042e9f0
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x64
push eax
push str.USERDNSDOMAIN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40cd9f
xor eax, eax
mov dword [ebp - 0x400], esi
mov word [ebp - 0x400], ax
lea ecx, [ebp - 0x400]
lea eax, [ebp - 0x114]
mov dword [ebp - 0x3f0], esi
push eax
mov dword [ebp - 0x3ec], 7
call fcn.00414483
mov dword [ebp - 4], 1
lea eax, [ebp - 0x400]
cmp dword [ebp - 0x3ec], edi
push str._UserDnsDomain_
cmovae eax, dword [ebp - 0x400]
push eax
call fcn.0045ec0c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3ec]
cmp eax, edi
jb 0x40cd9f
mov ecx, dword [ebp - 0x400]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x41c], ecx
cmp eax, ebx
jb 0x40cd96
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00415d5a
mov eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x41c]
push eax
push ecx
call fcn.0042d678
pop ecx
pop ecx
push 0xc8
lea eax, [ebp - 0x1dc]
push esi
push eax
call fcn.0042e9f0
add esp, 0xc
lea eax, [ebp - 0x1dc]
push 0x64
push eax
push str.USERNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40ce79
xor eax, eax
mov dword [ebp - 0x400], esi
mov word [ebp - 0x400], ax
lea ecx, [ebp - 0x400]
lea eax, [ebp - 0x1dc]
mov dword [ebp - 0x3f0], esi
push eax
mov dword [ebp - 0x3ec], 7
call fcn.00414483
mov dword [ebp - 4], 2
lea eax, [ebp - 0x400]
cmp dword [ebp - 0x3ec], edi
push str._UserName_
cmovae eax, dword [ebp - 0x400]
push eax
call fcn.0045ec0c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3ec]
cmp eax, edi
jb 0x40ce79
mov ecx, dword [ebp - 0x400]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x41c], ecx
cmp eax, ebx
jb 0x40ce70
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00415d5a
mov eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x41c]
push eax
push ecx
call fcn.0042d678
pop ecx
pop ecx
push 0x3c
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.0042e9f0
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x1e
push eax
push str.COMPUTERNAME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40cf43
xor eax, eax
mov dword [ebp - 0x418], esi
mov word [ebp - 0x418], ax
lea ecx, [ebp - 0x418]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x408], esi
push eax
mov dword [ebp - 0x404], 7
call fcn.00414483
mov dword [ebp - 4], 3
lea eax, [ebp - 0x418]
cmp dword [ebp - 0x404], edi
push str._ComputerName_
cmovae eax, dword [ebp - 0x418]
push eax
call fcn.0045ec0c
mov eax, dword [ebp - 0x404]
cmp eax, edi
jb 0x40cf43
mov ecx, dword [ebp - 0x418]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x41c], ecx
cmp eax, ebx
jb 0x40cf3a
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00415d5a
mov eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x41c]
push eax
push ecx
call fcn.0042d678
pop ecx
pop ecx
call fcn.0042d907
ret