Function at 0x442bc0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4751ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push esi
mov esi, ecx
push edi
push 0x200
lea ecx, [esp + 0xc]
call fcn.00415330
lea edi, [esi + 0x5e8]
push 0x48ea90
mov ecx, edi
mov dword [esp + 0x248], 0
call fcn.00428c30
test eax, eax
je 0x442ea6
push 0x48ea7c
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x5fc], eax
je 0x442ea6
push 0x48ea6c
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x600], eax
je 0x442ea6
push 0x48ea5c
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x604], eax
je 0x442ea6
push 0x48ea48
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x608], eax
je 0x442ea6
push 0x48ea3c
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x60c], eax
je 0x442ea6
push 0x48ea28
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x610], eax
je 0x442ea6
push 0x48ea1c
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x614], eax
je 0x442ea6
push 0x48ea00
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x618], eax
je 0x442ea6
push 0x48e9ec
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x61c], eax
je 0x442ea6
push 0x48e9d4
mov ecx, edi
call fcn.00428cd0
test eax, eax
mov dword [esi + 0x620], eax
je 0x442ea6
lea edi, [esi + 0x5f0]
push 0x48c690
mov ecx, edi
mov dword [esi + 0x5f8], 0
call fcn.00428c30
cmp eax, 1
jne 0x442d49
push 0x48e9b8
mov ecx, edi
call fcn.00428cd0
mov dword [esi + 0x5f8], eax
push 0x10
call dword [esi + 0x604]
push 0x49ce08
lea ecx, [esp + 0xc]
call fcn.00415950
lea eax, [esp + 0x34]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x442daa
lea ecx, [esp + 0x34]
push 0x5c
push ecx
call fcn.00462dee
add esp, 8
test eax, eax
je 0x442daa
lea edx, [esp + 0x34]
lea ecx, [esp + 8]
push edx
mov word [eax + 2], 0
call fcn.00415a00
push 0x48ad7c
lea ecx, [esp + 0xc]
call fcn.00415a00
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x34]
push 0x104
push eax
push 0x48e998
call edi
test eax, eax
je 0x442de1
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0xc]
call fcn.00415a00
push 0x48ad7c
lea ecx, [esp + 0xc]
call fcn.00415a00
lea edx, [esp + 0x34]
push 0x104
push edx
push 0x48e964
call edi
test eax, eax
je 0x442e12
lea eax, [esp + 0x34]
lea ecx, [esp + 8]
push eax
call fcn.00415a00
push 0x48ad7c
lea ecx, [esp + 0xc]
call fcn.00415a00
lea ecx, [esp + 0x34]
push 0x104
push ecx
push 0x48e94c
call edi
test eax, eax
je 0x442e43
lea edx, [esp + 0x34]
lea ecx, [esp + 8]
push edx
call fcn.00415a00
push 0x48ad7c
lea ecx, [esp + 0xc]
call fcn.00415a00
lea ecx, [esp + 8]
call fcn.00416550
dec eax
lea ecx, [esp + 8]
push eax
call fcn.00415cd0
push 1
push 0
lea ecx, [esp + 0x10]
call fcn.004165c0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esi + 0x600]
test eax, eax
je 0x442eaf
lea ecx, [esp + 8]
mov dword [esp + 0x244], 0xffffffff
call fcn.00415380
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
add esp, 0x240
ret
mov ecx, edi
call fcn.00428c80
jmp 0x442eb6
mov ecx, esi
call fcn.00442ef0
lea ecx, [esp + 8]
mov dword [esp + 0x244], 0xffffffff
call fcn.00415380
mov ecx, dword [esp + 0x23c]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x240
ret