Function at 0x4c0310
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x8c], 0
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x4d98a8], eax
push 0xfffffffffffffff6
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x4d98ac], eax
add esp, 0xfffffff4
lea eax, [ebp - 0x80]
push eax
push dword [0x4d98a8]
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
push 0x6010a0
push dword [0x4d98a8]
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
push 0x4d98b8
push dword [0x4d98ac]
call sub.KERNEL32.dll_GetConsoleMode
add esp, 0xfffffffc
push 0x4c025f
call sub.msvcrt.dll_getenv
add esp, 0x20
test eax, eax
je 0x4c03a4
add esp, 0xfffffff4
push eax
call sub.msvcrt.dll_atoi
mov dword [esi + 0x40], eax
add esp, 0x10
jmp 0x4c03ac
call fcn.004c00b0
mov dword [esi + 0x40], eax
add esp, 0xfffffff4
push 0x4c0265
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4c03d1
add esp, 0xfffffff4
push eax
call sub.msvcrt.dll_atoi
mov dword [esi + 0x44], eax
add esp, 0x10
jmp 0x4c03d9
call fcn.004c0104
mov dword [esi + 0x44], eax
cmp dword [esi + 0x40], 1
jle 0x4c03e8
movsx eax, word [ebp - 0x6c]
cmp dword [esi + 0x40], eax
jle 0x4c03fc
push dword [esi + 0x40]
movsx eax, word [ebp - 0x6c]
push eax
push 0x4c027c
jmp 0x4c0418
cmp dword [esi + 0x44], 1
jle 0x4c040b
movsx eax, word [ebp - 0x6e]
cmp dword [esi + 0x44], eax
jle 0x4c042d
push dword [esi + 0x44]
movsx eax, word [ebp - 0x6e]
push eax
push 0x4c02bc
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_fprintf
xor eax, eax
jmp 0x4c0745
add esp, 0xfffffff4
push 0x4c02e7
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4c0502
add esp, 0xfffffff4
movsx eax, word [0x6010a0]
movsx edx, word [0x6010a2]
imul eax, edx
shl eax, 2
push eax
call sub.msvcrt.dll_malloc
mov dword [0x4d98b0], eax
add esp, 0x10
test eax, eax
je 0x4c0426
movzx eax, word [0x6010a2]
shl eax, 0x10
movzx edi, word [0x6010a0]
or edi, eax
xor ebx, ebx
mov word [ebp - 0x88], 0
movzx eax, word [ebp - 0x88]
mov dword [ebp - 0x88], eax
movzx ecx, word [0x6010a2]
dec ecx
shl ecx, 0x10
lea eax, [ebp - 0x88]
mov edx, dword [eax + 4]
movzx edx, dx
mov dword [eax + 4], edx
or dword [eax + 4], ecx
movzx edx, word [0x6010a0]
dec edx
mov word [eax + 4], dx
add esp, 0xfffffff4
push eax
push ebx
push edi
push dword [0x4d98b0]
push dword [0x4d98a8]
call sub.KERNEL32.dll_ReadConsoleOutputA
add esp, 0xc
test eax, eax
jne 0x4c04fc
add esp, 0xfffffff4
push dword [0x4d98b0]
call sub.msvcrt.dll_free
mov dword [0x4d98b0], ebx
jmp 0x4c0426
mov byte [esi + 0x65], 1
jmp 0x4c0506
mov byte [esi + 0x65], 0
add esp, 0xfffffff4
push 0x4c02fa
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4c05d2
movzx eax, word [ebp - 0x76]
movzx edx, word [ebp - 0x72]
sub edx, eax
inc edx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
sub ecx, eax
mov eax, ecx
inc eax
shl eax, 0x10
movzx edi, dx
or edi, eax
add esp, 0xfffffff4
movsx eax, di
mov edx, edi
sar edx, 0x10
imul eax, edx
shl eax, 2
push eax
call sub.msvcrt.dll_malloc
mov dword [0x4d98b4], eax
add esp, 0x10
test eax, eax
je 0x4c0426
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x74]
mov word [edx + 2], ax
movzx eax, word [ebp - 0x76]
mov word [ebp - 0x88], ax
mov eax, dword [ebp - 0x70]
mov word [edx + 6], ax
movzx eax, word [ebp - 0x72]
mov word [edx + 4], ax
add esp, 0xfffffff4
push edx
push 0
push edi
push dword [0x4d98b4]
push dword [0x4d98a8]
call sub.KERNEL32.dll_ReadConsoleOutputA
add esp, 0xc
test eax, eax
jne 0x4c05cc
add esp, 0xfffffff4
push dword [0x4d98b4]
call sub.msvcrt.dll_free
mov dword [0x4d98b4], 0
jmp 0x4c0426
mov byte [esi + 0x64], 1
jmp 0x4c05d6
mov byte [esi + 0x64], 0
movzx eax, word [0x6010aa]
movzx edx, word [0x6010ae]
sub edx, eax
inc edx
movzx eax, word [0x6010ac]
movzx ecx, word [0x6010b0]
sub ecx, eax
mov eax, ecx
inc eax
shl eax, 0x10
movzx edi, dx
or edi, eax
lea ebx, [ebp - 0x88]
mov word [ebp - 0x88], 0
mov word [ebx + 2], 0
mov eax, edi
sar eax, 0x10
dec eax
mov word [ebx + 6], ax
mov eax, edi
dec eax
mov word [ebx + 4], ax
add esp, 0xfffffff8
push edi
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleScreenBufferSize
add esp, 0xfffffff4
push ebx
push 1
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleWindowInfo
add esp, 0xfffffffc
push edi
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleScreenBufferSize
add esp, 0xfffffffc
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleActiveScreenBuffer
add esp, 0xfffffffc
call fcn.004c0948
add esp, 0x20
add esp, 0xfffffff4
lea eax, [ebp - 0x8c]
push eax
call sub.KERNEL32.dll_GetNumberOfConsoleMouseButtons
mov eax, dword [ebp - 0x8c]
mov dword [esi + 0x78], eax
add esp, 0xfffffff4
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 0x1c]
push eax
call fcn.004bffe8
mov byte [esi + 0xb], 1
mov byte [esi + 1], 1
mov byte [esi + 5], 0
mov byte [esi + 4], 0
mov byte [esi + 2], 1
mov byte [esi + 0x66], 0
mov byte [esi + 0x67], 0
mov dl, byte [ebp - 0x8d]
mov byte [esi + 3], dl
mov byte [esi + 6], 1
mov dword [esi + 0x70], 0xb000
mov dword [esi + 0x74], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 8], 1
add esp, 0x20
call fcn.004c0078
mov dword [esi + 0x24], eax
call fcn.004c0140
mov dword [esi + 0x68], eax
call fcn.004c0134
mov dword [esi + 0x6c], eax
mov byte [esi + 9], 1
mov dword [esi + 0x28], 1
mov eax, dword [esi + 0x24]
mov dword [esi + 0x34], eax
call fcn.004bcfe4
mov byte [esi + 7], al
mov dword [esi + 0x14], 0x20
mov byte [esi + 0xe], 0
mov byte [esi + 0x10], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov eax, 1
lea esp, [ebp - 0xa8]
pop ebx
pop esi
pop edi
leave
ret