Function at 0x4473e8
Capabilities:
Query environment variable

Disassembly:
push 0x258
mov eax, 0x4dc330
call fcn.004b5417
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x238], 1
call fcn.00428e60
mov eax, dword [ebx]
xor esi, esi
cmp dword [eax - 0xc], esi
jle 0x447663
push esi
mov ecx, ebx
call fcn.0040c870
mov ecx, ebx
cmp ax, 0x25
jne 0x447642
lea edi, [esi + 1]
push edi
push 0x25
mov dword [ebp - 0x244], edi
call fcn.004420e7
mov ecx, ebx
test eax, eax
jge 0x447478
push esi
call fcn.0040c870
mov ecx, dword [ebp - 0x21c]
movzx eax, ax
push eax
call fcn.0044686a
mov esi, edi
jmp 0x447658
mov edi, eax
sub edi, esi
lea eax, [edi - 1]
push eax
push dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
call fcn.00443d2a
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00445121
push eax
lea ecx, [ebp - 0x220]
call fcn.004420c1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.0040d610
mov ecx, dword [ebp - 0x230]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00444bf1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x230]
push eax
push dword [eax + 0x18]
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x254]
call fcn.004424c1
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0043cc0e
test al, al
je 0x447562
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00444bf1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x234]
push eax
push dword [eax + 0x18]
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x24c]
call fcn.004424c1
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x22c]
call fcn.0043cc0e
test al, al
jne 0x44758e
lea ecx, [ebp - 0x22c]
call fcn.00478005
mov ecx, dword [ebp - 0x21c]
add eax, 4
push eax
call fcn.00446855
mov eax, dword [ebp - 0x220]
mov eax, dword [eax - 0xc]
lea esi, [esi + eax + 2]
jmp 0x447631
inc edi
push edi
push esi
lea eax, [ebp - 0x240]
push eax
mov ecx, ebx
call fcn.00443d2a
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.00445121
push eax
lea ecx, [ebp - 0x224]
call fcn.004420c1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x240]
call fcn.0040d610
mov edi, 0x104
push edi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [ebp - 0x21c]
cmp eax, edi
ja 0x447603
lea eax, [ebp - 0x218]
push eax
call fcn.00444b0f
mov eax, dword [ebp - 0x220]
mov eax, dword [eax - 0xc]
lea esi, [esi + eax + 2]
jmp 0x447622
mov eax, dword [ebp - 0x224]
push dword [eax - 0xc]
and dword [ebp - 0x238], 0
push eax
call fcn.00444290
mov eax, dword [ebp - 0x224]
add esi, dword [eax - 0xc]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
call fcn.0040d610
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.0040d610
jmp 0x447658
push esi
call fcn.0040c870
mov ecx, dword [ebp - 0x21c]
movzx eax, ax
push eax
call fcn.0044686a
inc esi
mov eax, dword [ebx]
cmp esi, dword [eax - 0xc]
jl 0x447431
mov eax, dword [ebp - 0x238]
call fcn.004b549a
ret