Function at 0x46ed76
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
cmp dword [ebp + 0x1c], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], 0x7f2bb707
je 0x46f5c3
mov eax, dword [ebp + 0x1c]
cmp dword [eax], 0x7f2bb707
jne 0x46f5c3
lea eax, [ebp - 0x1c]
mov dword [esp], 0xc8
mov dword [esp + 4], eax
call fcn.00468b4c
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x46f5c3
mov ebx, dword [ebp - 0x1c]
mov ecx, 0x31
lea eax, [ebx + 4]
mov edi, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x7f2bb701
mov dword [ebx + 0x5c], 0x12
or ah, 2
mov dword [ebx + 8], eax
mov dword [esp], str.E2FSPROGS_FAKE_TIME
call sub.msvcrt.dll_getenv
test eax, eax
je 0x46ee10
xor edi, edi
mov dword [esp], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edi
call sub.msvcrt.dll_strtoul
mov dword [ebx + 0x60], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebx + 0xc]
inc eax
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00468b4c
mov edx, eax
test eax, eax
jne 0x46f59b
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x3f
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test esi, esi
jne 0x46ee6e
test eax, eax
je 0x46ee6e
cmp byte [eax + 1], 0x5c
je 0x46ee6e
mov byte [eax], 0
lea esi, [eax + 1]
mov eax, dword [ebp + 0x10]
and eax, 1
bt dword [ebp + 0x10], 0xe
mov dword [ebp - 0x30], eax
mov edx, eax
jae 0x46ee83
or edx, 2
mov eax, edx
mov edi, dword [ebp - 0x38]
or eax, 4
test dword [ebp + 0x10], 0x80000
cmove eax, edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
mov eax, dword [ebp + 0x1c]
call dword [eax + 8]
mov edx, eax
test eax, eax
jne 0x46f59b
mov eax, dword [ebx + 4]
test esi, esi
jne 0x46eee8
mov eax, dword [ebx + 4]
lea edx, [ebx + 0x10]
mov dword [ebx + 0x88], eax
mov dword [eax + 0x5c], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], 0xfffffc00
mov dword [esp], eax
call fcn.0046b374
mov edx, eax
test eax, eax
je 0x46eeff
jmp 0x46f59b
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0046b09c
mov edx, eax
test eax, eax
je 0x46eeba
jmp 0x46f59b
mov eax, dword [ebp + 0x10]
and eax, 0x2000
mov dword [ebp - 0x44], eax
je 0x46ef7c
lea eax, [ebx + 0x58]
mov dword [esp], 0x14c
mov dword [esp + 4], eax
call fcn.00468b4c
mov edx, eax
test eax, eax
jne 0x46f59b
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x58]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 8], 0xfffffeb4
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x14]
mov edx, eax
test eax, eax
jne 0x46f59b
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x2c], 0x7f2bb710
cmp dword [eax], 0x7f2bb710
jne 0x46f5c3
mov eax, dword [eax + 0xcc]
mov dword [ebp + 0x14], 1
mov dword [ebp + 0x18], eax
jmp 0x46ef82
cmp dword [ebp + 0x14], 0
je 0x46efb2
cmp dword [ebp + 0x18], 0
je 0x46f552
mov eax, dword [ebx + 4]
mov edi, dword [ebp + 0x18]
mov edx, dword [eax + 4]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
sar eax, 0x1f
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebx + 0x54], eax
jmp 0x46eff2
mov eax, dword [ebx + 4]
mov edx, dword [eax + 4]
mov dword [esp + 4], 0x400
mov dword [esp], eax
call dword [edx + 0x10]
lea eax, [ebx + 0x54]
mov dword [esp], 0x400
mov dword [esp + 4], eax
call fcn.00468b4c
mov edx, eax
test eax, eax
jne 0x46f59b
xor eax, eax
mov dword [ebp + 0x14], 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 4
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x10]
mov edi, dword [ebp + 0x14]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0xfffffc00
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [edx + 0x14]
mov edx, eax
test eax, eax
jne 0x46f59b
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x46f038
mov esi, dword [ebx + 0x10]
mov ecx, 0x100
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 8]
and eax, 0x200000
mov dword [ebp - 0x2c], eax
jne 0x46f087
mov eax, dword [ebx + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0046123f
test eax, eax
mov eax, 0x7f2bb799
cmovne eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00461265
test eax, eax
jne 0x46f08c
dec dword [ebp - 0x40]
jne 0x46eff9
mov dword [ebp - 0x2c], 0x7f2bb798
jmp 0x46f08c
xor eax, eax
mov dword [ebp - 0x2c], eax
test byte [ebx + 8], 0x40
jne 0x46f559
mov eax, dword [ebx + 0x10]
cmp word [eax + 0x38], 0xef53
jne 0x46f560
cmp dword [ebp - 0x2c], 0
jne 0x46f567
mov esi, dword [eax + 0x4c]
cmp esi, 1
ja 0x46f56c
bt dword [ebp + 0x10], 0xa
jb 0x46f100
mov ecx, dword [eax + 0x60]
test ecx, 0xfffc1921
jne 0x46f57a
bt dword [ebp + 0x10], 0xf
mov edx, dword [eax + 0x64]
jae 0x46f0de
and dh, 0xf7
cmp dword [ebp - 0x30], 0
je 0x46f0f0
and edx, 0xffff0884
jne 0x46f573
bt dword [ebp + 0x10], 0xc
jb 0x46f100
and cl, 8
jne 0x46f57a
mov edi, dword [eax + 0x18]
mov dword [ebp - 0x30], edi
cmp edi, 6
jbe 0x46f115
mov edx, 0x7f2bb73c
jmp 0x46f59b
test byte [eax + 0x65], 2
je 0x46f127
bt dword [ebp + 0x10], 0x11
jb 0x46f12f
jmp 0x46f581
mov edi, dword [ebp - 0x30]
cmp edi, dword [eax + 0x1c]
jne 0x46f10b
mov cl, byte [ebp - 0x30]
mov edx, 0x400
shl edx, cl
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
test esi, esi
je 0x46f159
movzx esi, word [eax + 0x58]
cmp edx, esi
jb 0x46f10b
cmp esi, 0x7f
jbe 0x46f10b
lea ecx, [esi - 1]
test ecx, esi
jne 0x46f10b
jmp 0x46f15e
mov esi, pe_nt_image_headers32
test byte [eax + 0x60], 0x80
je 0x46f172
cmp word [eax + 0xfe], 0x3f
jbe 0x46f588
mov ecx, dword [eax + 0x1c]
mov edi, dword [ebp - 0x30]
sub ecx, edi
mov edi, dword [eax + 0x24]
mov dword [ebx + 0x64], ecx
shl edi, cl
cmp dword [eax + 0x20], edi
jne 0x46f10b
imul esi, dword [eax + 0x28]
mov ecx, dword [ebp - 0x30]
add ecx, 0xa
lea eax, [edx + esi - 1]
shr eax, cl
mov dword [ebx + 0x28], eax
cmp edx, dword [ebp + 0x18]
je 0x46f1a9
cmp dword [ebp + 0x18], 0
jne 0x46f58f
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ecx + 0x10]
mov eax, dword [ebx + 0x10]
mov edi, dword [eax + 0x60]
and edi, 8
mov dword [ebp - 0x30], edi
je 0x46f1d1
xor eax, eax
mov dword [ebx + 0x1c], eax
jmp 0x46f54b
cmp dword [eax + 0x28], 0
je 0x46f10b
mov dword [esp], ebx
call fcn.0046116c
mov esi, dword [ebx + 0x10]
mov edi, dword [esi + 0x20]
test edi, edi
je 0x46f10b
mov ecx, dword [esi + 0x18]
mov eax, 0x400
mov edx, eax
shl edx, cl
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x40], edx
shl eax, cl
cdq
idiv dword [ebp - 0x40]
imul eax, eax, 0xfff8
cmp eax, edi
jb 0x46f10b
mov eax, dword [ebx + 0x28]
cmp dword [esi + 0x4c], 0
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x48], eax
je 0x46f22c
movzx ecx, word [esi + 0x58]
mov eax, dword [ebp - 0x40]
cdq
idiv ecx
mov edx, 0x10000
sub edx, eax
mov eax, dword [ebp - 0x48]
cmp edx, eax
jb 0x46f10b
mov ecx, 0x20
test byte [esi + 0x60], 0x80
je 0x46f256
movzx ecx, word [esi + 0xfe]
mov eax, dword [ebp - 0x40]
cdq
idiv ecx
test eax, eax
je 0x46f10b
mov eax, dword [esi + 0x14]
mov dword [esp], esi
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], eax
call fcn.0045ea6e
cmp dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
sbb eax, edx
jae 0x46f10b
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.0045ea6e
mov esi, dword [ebx + 0x10]
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 0xc], edi
sub eax, dword [esi + 0x14]
sbb edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00468e09
mov edi, eax
test edx, edx
jne 0x46f10b
bt dword [ebp + 0x10], 0x17
mov dword [ebx + 0x1c], eax
jb 0x46f2d6
mul dword [esi + 0x28]
test edx, edx
jne 0x46f10b
cmp eax, dword [esi]
jne 0x46f10b
mov ecx, dword [esi + 0x18]
mov eax, 0x400
shl eax, cl
mov ecx, 0x20
test byte [esi + 0x60], 0x80
je 0x46f2f2
movzx ecx, word [esi + 0xfe]
cdq
mov dword [esp], edi
idiv ecx
mov dword [esp + 4], eax
call fcn.00468df6
bt dword [ebp + 0x10], 0xb
mov dword [ebx + 0x20], eax
jb 0x46f4d5
lea edx, [ebx + 0x24]
mov dword [esp + 8], edx
mov edx, dword [ebx + 0x14]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00468ba4
mov edx, eax
test eax, eax
jne 0x46f59b
cmp dword [ebp - 0x34], 0
mov eax, dword [ebx + 0x10]
jne 0x46f35b
cmp dword [ebp - 0x38], 0
jne 0x46f35b
mov esi, dword [eax + 0x14]
xor edi, edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], 0
jne 0x46f35b
xor edx, edx
cmp dword [ebx + 0x14], 0x400
sete dl
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x20]
test byte [eax + 0x60], 0x10
je 0x46f378
cmp dword [ebp - 0x44], 0
jne 0x46f378
mov eax, dword [eax + 0x104]
cmp edi, eax
cmova edi, eax
test edi, edi
je 0x46f3b2
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 4]
mov dword [esp], eax
mov dword [esp + 0xc], esi
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], edi
add edx, ecx
inc edx
mov dword [esp + 4], edx
call dword [eax + 0x14]
mov edx, eax
test eax, eax
jne 0x46f59b
mov eax, dword [ebx + 0x14]
imul eax, edi
add esi, eax
mov ecx, edi
cmp ecx, dword [ebx + 0x20]
jae 0x46f448
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [ebp - 0x40], ecx
call fcn.0046ec1d
xor ecx, ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0046b3bc
mov ecx, dword [ebp - 0x40]
inc ecx
jmp 0x46f3b4
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [esp + 0xc], edi
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0046ec1d
mov dword [esp + 0x10], esi
mov dword [esp + 8], edx
mov dword [esp + 0xc], 1
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call fcn.0046b1d0
mov edx, eax
test eax, eax
jne 0x46f59b
add esi, dword [ebx + 0x14]
inc edi
cmp edi, dword [ebx + 0x20]
jb 0x46f401
mov eax, dword [ebx + 0x10]
cmp dword [ebp + 0x14], 1
movzx edx, word [eax + 0x164]
mov dword [ebx + 0x50], edx
jle 0x46f4d5
test dword [eax + 0x64], 0x410
je 0x46f4d5
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebx + 0x1c]
jae 0x46f4c8
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], 2
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045f24f
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], 1
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045f24f
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0045f167
mov eax, dword [ebp - 0x30]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00461c53
inc dword [ebp - 0x30]
jmp 0x46f469
mov eax, dword [ebx + 8]
test al, 1
je 0x46f4d5
or eax, 6
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0x10]
test byte [eax + 0x61], 1
je 0x46f50e
bt dword [ebp + 0x10], 0x14
jb 0x46f50e
test dword [ebp + 0x10], 0x4001
je 0x46f50e
mov dword [esp], ebx
call fcn.0046d8ba
test eax, eax
je 0x46f50e
or dword [ebx + 8], 0x100000
mov dword [esp], ebx
mov dword [ebp - 0x2c], eax
call fcn.0046d8c0
jmp 0x46f567
test byte [ebx + 0xa], 0x40
je 0x46f544
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x46ec18
mov dword [esp], 0x4676c4
call fcn.004676e7
mov dword [ebx + 0xc0], eax
test eax, eax
je 0x46f596
mov eax, dword [ebx + 0x10]
or dword [eax + 0x64], 0x4000
and dword [ebx + 8], 0xfffeffff
mov eax, dword [ebp + 0x20]
mov dword [eax], ebx
jmp 0x46f5c3
mov edx, 0x7f2bb747
jmp 0x46f59b
mov edx, 0x7f2bb750
jmp 0x46f59b
mov edx, 0x7f2bb713
jmp 0x46f59b
mov edx, dword [ebp - 0x2c]
jmp 0x46f59b
mov edx, 0x7f2bb714
jmp 0x46f59b
mov edx, 0x7f2bb744
jmp 0x46f59b
mov edx, 0x7f2bb743
jmp 0x46f59b
mov edx, 0x7f2bb789
jmp 0x46f59b
mov edx, 0x7f2bb791
jmp 0x46f59b
mov edx, 0x7f2bb722
jmp 0x46f59b
mov edx, 0x7f2bb746
bt dword [ebp + 0x10], 0x10
jb 0x46f5b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
mov dword [esp], eax
call fcn.004653e6
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x2c], edx
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret