Function at 0x46ff80
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x1c]
and ebx, 0xf0
push ebp
push esi
cmp ebx, 0x40
push edi
jne 0x470032
mov ebx, dword [esp + 0x20]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x2c]
not ecx
dec ecx
mov ebp, ecx
or ecx, 0xffffffff
inc ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
inc edi
push 0x8a
push 0
push 0
xor edx, edx
lea ecx, [edi + ebp]
call fcn.00452a70
mov esi, eax
test esi, esi
je case.0x470170.4
mov cl, byte [ebx]
test cl, cl
mov byte [esi], cl
je 0x46ffed
mov edx, ebx
sub edx, esi
mov cl, byte [edx + eax + 1]
inc eax
test cl, cl
mov byte [eax], cl
jne 0x46ffe2
mov byte [eax], 0x3d
inc eax
push edi
push eax
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
cmp ebx, edi
jle 0x470017
push 1
xor edx, edx
mov ecx, esi
call fcn.004533c0
mov edi, ebx
mov ebx, dword [esp + 0x20]
jmp 0x46ffb9
push esi
call fcn.004411b0
add esp, 4
xor edx, edx
mov ecx, esi
push 1
call fcn.004533c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edi, dword [esp + 0x1c]
push edi
call fcn.004174a0
mov esi, eax
add esp, 4
test esi, esi
je case.0x470170.4
mov ecx, dword [esi + 4]
test ecx, 0x10000
je 0x4700da
mov ecx, dword [esi + 0xc]
push ecx
call fcn.004174a0
add esp, 4
test eax, eax
je case.0x470170.4
mov dl, byte [eax + 4]
mov ecx, dword [esi + 0x10]
test dl, 1
jne case.0x470170.4
mov edx, dword [eax + 8]
mov al, byte [edx + ecx + 0x49d138]
lea edi, [edx + ecx + 0x49d138]
mov ecx, dword [esi + 4]
and ecx, 0xf
cmp cl, 2
jne 0x4700b8
mov ecx, dword [esi + 0x14]
mov dl, 1
shl dl, cl
mov cl, dl
not cl
and al, cl
mov ecx, dword [esp + 0x2c]
cmp dword [ecx], 0
je 0x4700d1
or al, dl
mov byte [edi], al
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov esi, dword [esi + 0x14]
mov dl, 3
mov ecx, esi
shl dl, cl
not dl
and dl, al
mov eax, dword [esp + 0x2c]
mov al, byte [eax]
and al, 3
shl al, cl
or al, dl
mov byte [edi], al
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
test ecx, 0x40000000
je 0x47012e
cmp edi, 0x52
jne 0x47012e
mov ecx, dword [esp + 0x2c]
mov esi, 0x49d241
mov ebx, dword [ecx]
test bl, 1
jne 0x4700fc
mov esi, 0x49d261
mov ecx, ebx
mov dl, 1
shr ecx, 6
and ecx, 7
mov eax, ebx
shl dl, cl
shr eax, 1
and eax, 0x1f
mov cl, dl
not cl
and byte [esi + eax], cl
mov cl, byte [esi + eax]
test bh, 2
je case.0x470170.4
or cl, dl
pop edi
mov byte [esi + eax], cl
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jne 0x470139
xor eax, eax
test ecx, 0x2000000
je 0x47014a
cmp eax, dword [esi + 0x18]
ja case.0x470170.4
cmp edi, 0x55
je 0x470154
cmp edi, 0x56
jne 0x47015f
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x47015f
or dword [ecx], 1
cmp ebx, 0x30
ja case.0x470170.4
xor edx, edx
mov dl, byte [ebx + 0x470224]
jmp dword [edx*4 + 0x470210]
mov ecx, dword [esi + 4]
and ecx, 0xf
cmp cl, 1
jne case.0x470170.4
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 8]
pop edi
pop esi
mov ecx, dword [ecx]
pop ebp
mov dword [edx + eax*4 + 0x49d138], ecx
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 4]
and edx, 0xf0f
cmp edx, 4
jne case.0x470170.4
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x2c]
pop edi
pop esi
mov dword [ecx + eax*4 + 0x49d138], edx
pop ebp
xor eax, eax
pop ebx
ret
mov ecx, dword [esi + 4]
and ecx, 0xf0f
cmp ecx, 0x204
jne case.0x470170.4
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 8]
pop edi
pop esi
mov cl, byte [ecx]
pop ebp
mov byte [edx + eax + 0x49d138], cl
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 4]
and edx, 0xf
cmp dl, 2
jne case.0x470170.4
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
test edx, edx
setne dl
mov byte [ecx + eax + 0x49d138], dl
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret