Function at 0x412c50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42669e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x433074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x412ebe
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [esi - 8]
mov ebx, 1
mov ecx, ebx
mov dword [ebp - 4], 2
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x412ccd
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00405ea0
mov esi, dword [ebp - 0x10]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test esi, esi
jne 0x412ce3
xor eax, eax
jmp 0x412cf7
push dword [esi - 8]
push esi
call fcn.00418486
add esp, 8
test eax, eax
js 0x412eb4
cmp eax, dword [esi - 8]
jg 0x412eb4
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov edx, dword [esi - 0xc]
test edx, edx
js 0x412eb4
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x412d2e
push edx
lea ecx, [ebp - 0x10]
call fcn.00405ea0
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esi - 8]
push esi
call fcn.00418486
add esp, 8
test eax, eax
js 0x412eb4
cmp eax, dword [esi - 8]
jg 0x412eb4
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov byte [ebp - 4], 3
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x412ec8
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
push 0
push 0
push dword [ebp + 0xc]
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
js 0x412eb4
mov ecx, dword [edi - 8]
mov edx, 1
sub edx, dword [edi - 4]
sub ecx, ebx
or ecx, edx
jge 0x412db1
push ebx
lea ecx, [ebp - 0x14]
call fcn.00405ea0
mov edi, dword [ebp - 0x14]
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test edi, edi
jne 0x412dc4
xor eax, eax
jmp 0x412dd8
push dword [edi - 8]
push edi
call fcn.00418486
add esp, 8
test eax, eax
js 0x412eb4
cmp eax, dword [edi - 8]
jg 0x412eb4
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
mov byte [ebp - 4], 5
call fcn.00404d30
mov ecx, eax
test ecx, ecx
je 0x412ed2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 4
lea ecx, [eax + 0x10]
mov dword [ebx], ecx
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, 0x104
or edx, eax
mov dword [ebp - 0x18], 1
jge 0x412e37
push 0x104
mov ecx, ebx
call fcn.00405ea0
mov ecx, dword [ebx]
push edi
push esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebx]
test eax, eax
jne 0x412e4a
xor ecx, ecx
jmp 0x412e5c
push dword [eax - 8]
push eax
call fcn.00418486
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x412eb4
mov eax, dword [ebx]
cmp ecx, dword [eax - 8]
jg 0x412eb4
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebx]
mov word [eax + ecx*2], dx
or ecx, 0xffffffff
mov eax, ecx
lea edx, [edi - 0x10]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412e8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or ecx, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x412ea0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00402060
push 0x80004005
call fcn.00402060
push 0x80004005
call fcn.00402060
push 0x80004005
call fcn.00402060
int3