Function at 0x4a98c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x48
mov edx, 0xfffffffc
mov eax, dword [0x543b10]
mov esi, 0xfffffffd
xor eax, ebp
mov ebx, 0x2dfe940
mov dword [ebp - 0x10], eax
mov edi, 0x2dfeb00
movzx eax, byte [0x2dfeca1]
and eax, 0xffffffe7
mov dword [0x2dfea64], edx
add eax, 8
mov dword [0x2dfe968], edx
movzx ecx, byte [0x2dfeae1]
mov byte [0x2dfeca1], al
and ecx, 0xffffffe7
movzx edx, byte [0x2dfee61]
add ecx, 8
movzx eax, byte [0x2dff021]
and edx, 0xffffffe7
and eax, 0xffffffe7
add edx, 8
mov dword [0x2dfec24], esi
add eax, 8
mov dword [0x2dfeb28], esi
mov esi, 0xfffffffe
mov byte [0x2dfeae1], cl
mov ecx, 0x2dfecc0
mov dword [0x2df3e8c], ebx
mov dword [0x6a47e88], ebx
mov ebx, 0xffffffff
mov dword [0x2df3eb4], edi
mov dword [0x6a47e8c], edi
mov edi, str.FORT_d
mov byte [0x2dfee61], dl
mov edx, 0x2dfee80
mov dword [0x2dfefa4], esi
mov dword [0x2dfeea8], esi
xor esi, esi
mov dword [0x2dfede4], ebx
mov dword [0x2dfece8], ebx
mov dword [0x2df3f04], ecx
mov dword [0x6a47e94], ecx
mov byte [0x2dff021], al
mov dword [0x2df3edc], edx
mov dword [0x6a47e90], edx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], esi
call fcn.0045a3e0
mov edx, eax
lea eax, [ebp - 0x50]
push eax
push esi
push edi
push ebx
mov ecx, dword [edx]
lea ebx, [ebp - 0x30]
push ebx
push dword [edx + 4]
or ecx, 1
push ecx
call fcn.004db990
add esp, 0x1c
push esi
push esi
push ebx
mov dword [0x2dff164], esi
mov dword [0x2dff068], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x4a99f7
jne 0x4a99f7
mov edx, 1
jmp 0x4a99fc
mov edx, 2
movzx eax, byte [0x2dff1e1]
shl edx, 3
and eax, 0xffffffe7
or eax, edx
mov edx, 0x2dff040
mov byte [0x2dff1e1], al
mov dword [0x2df3f2c], edx
mov dword [0x6a47e98], edx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 5
call fcn.0045a3e0
mov edx, eax
lea eax, [ebp - 0x44]
push eax
push 0
push edi
push 0xffffffffffffffff
push ebx
mov ecx, dword [edx]
push dword [edx + 4]
or ecx, 1
push ecx
call fcn.004db990
add esp, 0x1c
push esi
push esi
mov eax, 5
push ebx
mov dword [0x2dff324], eax
mov dword [0x2dff228], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x4a9a72
jne 0x4a9a72
mov edx, 1
jmp 0x4a9a77
mov edx, 2
movzx eax, byte [0x2dff3a1]
shl edx, 3
and eax, 0xffffffe7
or eax, edx
mov edx, 0x2dff200
mov byte [0x2dff3a1], al
mov dword [0x2df3ff4], edx
mov dword [0x6a47eac], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 6
call fcn.0045a3e0
mov edx, eax
lea eax, [ebp - 0x38]
push eax
push 0
push edi
push 0xffffffffffffffff
push ebx
mov ecx, dword [edx]
push dword [edx + 4]
or ecx, 1
push ecx
call fcn.004db990
add esp, 0x1c
push esi
push esi
mov eax, 6
push ebx
mov dword [0x2dff4e4], eax
mov dword [0x2dff3e8], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x4a9aed
jne 0x4a9aed
mov eax, 1
jmp 0x4a9af2
mov eax, 2
movzx edx, byte [0x2dff561]
shl eax, 3
and edx, 0xffffffe7
or edx, eax
mov eax, 0x2dff3c0
mov byte [0x2dff561], dl
mov dword [0x2df401c], eax
mov dword [0x6a47eb0], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x543b10]
jne 0x4a9b32
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.004cf95b
mov esi, esi
lea edi, [edi]