Function at 0x4278c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x57]
sub esp, 0x7c
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e79a8]
test al, al
jne 0x42791d
mov dword [esp], 0x4e79a8
call fcn.004d5a00
test eax, eax
je 0x42791d
mov dword [esp], ebx
mov ecx, 0x4eb860
call fcn.0043167c
push eax
mov dword [esp], 0x4d6798
call fcn.004013f0
mov dword [esp], 0x4e79a8
call fcn.004d5ad0
mov ecx, 0x4eb860
call fcn.0043164c
mov dword [esp], 0x4eb860
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7960]
test al, al
jne 0x427984
mov dword [esp], 0x4e7960
call fcn.004d5a00
test eax, eax
je 0x427984
mov dword [esp], ebx
mov ecx, 0x4eb7ac
call fcn.0043167c
push eax
mov dword [esp], 0x4d679c
call fcn.004013f0
mov dword [esp], 0x4e7960
call fcn.004d5ad0
mov ecx, 0x4eb7ac
call fcn.0043164c
mov dword [esp], 0x4eb7ac
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7970]
test al, al
jne 0x4279eb
mov dword [esp], 0x4e7970
call fcn.004d5a00
test eax, eax
je 0x4279eb
mov dword [esp], ebx
mov ecx, 0x4eb7c4
call fcn.0043167c
push eax
mov dword [esp], 0x4d67a0
call fcn.004013f0
mov dword [esp], 0x4e7970
call fcn.004d5ad0
mov ecx, 0x4eb7c4
call fcn.0043164c
mov dword [esp], 0x4eb7c4
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7978]
test al, al
jne 0x427a52
mov dword [esp], 0x4e7978
call fcn.004d5a00
test eax, eax
je 0x427a52
mov dword [esp], ebx
mov ecx, 0x4eb7d0
call fcn.0043167c
push eax
mov dword [esp], 0x4d67a4
call fcn.004013f0
mov dword [esp], 0x4e7978
call fcn.004d5ad0
mov ecx, 0x4eb7d0
call fcn.0043164c
mov dword [esp], 0x4eb7d0
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7980]
test al, al
jne 0x427ab9
mov dword [esp], 0x4e7980
call fcn.004d5a00
test eax, eax
je 0x427ab9
mov dword [esp], ebx
mov ecx, 0x4eb7dc
call fcn.0043167c
push eax
mov dword [esp], 0x4d67a8
call fcn.004013f0
mov dword [esp], 0x4e7980
call fcn.004d5ad0
mov ecx, 0x4eb7dc
call fcn.0043164c
mov dword [esp], 0x4eb7dc
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7988]
test al, al
jne 0x427b20
mov dword [esp], 0x4e7988
call fcn.004d5a00
test eax, eax
je 0x427b20
mov dword [esp], ebx
mov ecx, 0x4eb7e8
call fcn.0043167c
push edi
mov dword [esp], 0x4d67ac
call fcn.004013f0
mov dword [esp], 0x4e7988
call fcn.004d5ad0
mov ecx, 0x4eb7e8
call fcn.0043164c
mov dword [esp], 0x4eb7e8
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7990]
test al, al
jne 0x427b87
mov dword [esp], 0x4e7990
call fcn.004d5a00
test eax, eax
je 0x427b87
mov dword [esp], ebx
mov ecx, 0x4eb7f4
call fcn.0043167c
push esi
mov dword [esp], 0x4d67b0
call fcn.004013f0
mov dword [esp], 0x4e7990
call fcn.004d5ad0
mov ecx, 0x4eb7f4
call fcn.0043164c
mov dword [esp], 0x4eb7f4
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7998]
test al, al
jne 0x427bee
mov dword [esp], 0x4e7998
call fcn.004d5a00
test eax, eax
je 0x427bee
mov dword [esp], ebx
mov ecx, 0x4eb800
call fcn.0043167c
push ecx
mov dword [esp], 0x4d67b4
call fcn.004013f0
mov dword [esp], 0x4e7998
call fcn.004d5ad0
mov ecx, 0x4eb800
mov esi, 0x4e7100
mov edi, ebx
call fcn.0043164c
mov dword [esp], 0x4eb800
call fcn.00424ea0
mov ecx, 0x3f
mov dword [ebp - 0x5b], 0x5de0ee76
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e79a0]
test al, al
jne 0x427c58
mov dword [esp], 0x4e79a0
call fcn.004d5a00
test eax, eax
je 0x427c58
mov dword [esp], ebx
mov ecx, 0x4eb820
call fcn.00431614
push edx
mov dword [esp], 0x4d67b8
call fcn.004013f0
mov dword [esp], 0x4e79a0
call fcn.004d5ad0
mov ecx, 0x4eb820
call fcn.004315e4
mov dword [esp], 0x4eb820
call sub.msvcrt.dll_getenv
test eax, eax
je 0x427cde
lea eax, [ebp - 0x5b]
call eax
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7968]
test al, al
jne 0x427cc8
mov dword [esp], 0x4e7968
call fcn.004d5a00
test eax, eax
je 0x427cc8
mov dword [esp], ebx
mov ecx, 0x4eb7b8
call fcn.0043167c
push eax
mov dword [esp], 0x4d67c4
call fcn.004013f0
mov dword [esp], 0x4e7968
call fcn.004d5ad0
mov ecx, 0x4eb7b8
call fcn.0043164c
mov dword [esp], 0x4eb7b8
call fcn.00424ea0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0x3000
mov dword [esp], 0xffffffff
neg eax
mov dword [esp + 0x14], edx
lea edx, [ebp + 0xc]
sbb eax, eax
mov dword [esp + 0xc], edx
and eax, 0xc
mov dword [esp + 8], eax
lea eax, [ebp + 8]
mov dword [esp + 4], eax
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov edx, eax
sub esp, 0x18
xor eax, eax
test edx, edx
js 0x427d24
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret