Function at 0x427ae6
Capabilities:
Query environment variable

Disassembly:
push 0x80
push 0x447a30
call fcn.0042fc30
xor ebx, ebx
mov dword [ebp - 0x48], ebx
and dword [ebp - 0x4c], ebx
and dword [ebp - 4], ebx
xor eax, eax
inc eax
mov dword [0x44b09c], eax
mov dword [0x44d1a0], eax
call fcn.0042b1c7
push 9
lea eax, [ebp - 0x30]
push eax
push 0x4016d0
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call esi
mov ecx, eax
call fcn.0042b0d5
lea eax, [ebp - 0x50]
push eax
mov edi, 0x40163c
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.0042b0a5
add esp, 0xc
push 9
lea eax, [ebp - 0x30]
push eax
push 0x4016a4
call esi
mov ecx, eax
call fcn.0042b0d5
lea eax, [ebp - 0x54]
push eax
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.0042b0a5
add esp, 0xc
push 0x10
pop ecx
call fcn.00426940
test eax, eax
je 0x43c1d2
push 0xffffffffffffffff
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, eax
call fcn.0042fb54
mov edi, eax
push 0xa
lea eax, [ebp - 0x44]
push eax
push 0x401684
call esi
mov ecx, eax
call fcn.0042b0d5
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
pop ecx
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx]
mov dword [ecx + 8], eax
mov dword [ebp - 0x58], 0x298
mov eax, dword [edi]
push 4
lea ecx, [ebp - 0x58]
push ecx
mov ecx, edi
call dword [eax]
mov eax, dword [edi]
push 4
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp - 0x5c]
sub eax, 0x29e
je 0x43c1ed
sub eax, 1
jne 0x43c1d9
and dword [0x44d1a8], eax
jmp 0x427c42
mov dword [ebp - 0x88], 0x298
mov eax, dword [edi]
push 4
lea ecx, [ebp - 0x88]
push ecx
mov ecx, edi
call dword [eax]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0xc]
push fcn.00425f10
push ecx
mov edx, dword [0x449df4]
mov ecx, 0x449540
call fcn.0042751b
pop ecx
pop ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x90], ebx
mov esi, dword [sym.imp.KERNEL32.dll_RaiseException]
test ebx, ebx
jne 0x427d83
mov eax, dword [edi]
push 4
lea ecx, [ebp - 0x60]
push ecx
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp - 0x60]
sub eax, 0x29a
je 0x427bf5
sub eax, 1
jne 0x43c1fc
push 0x18
pop ecx
call fcn.00426940
test eax, eax
je 0x43c20a
push edi
mov ecx, eax
call fcn.004284ca
mov ebx, eax
push ebx
mov ecx, 0x44d21c
call fcn.00428996
mov dword [ebp - 0x64], 0x298
mov eax, dword [edi]
push 4
lea ecx, [ebp - 0x64]
push ecx
mov ecx, edi
call dword [eax]
mov eax, dword [ebx]
xor ecx, ecx
sub eax, ecx
je 0x43c234
sub eax, 1
jne 0x43c211
mov edx, dword [ebx + 8]
mov esi, dword [edx + 0x14]
mov ecx, dword [0x449df4]
call fcn.004282ee
mov ecx, dword [0x449df4]
call fcn.00422370
and dword [0x449030], 0
mov eax, dword [ebx + 8]
push dword [eax + 8]
mov ebx, 0x401404
push ebx
call fcn.00427ecd
add esp, 8
imul eax, esi, 0xc
push fcn.00425f10
push ecx
mov edx, dword [0x449df4]
mov ecx, dword [eax + 0x41f398]
call fcn.0042751b
pop ecx
pop ecx
mov dword [0x44b0ac], eax
mov dword [ebp - 0x68], 0x299
mov eax, dword [edi]
push 4
pop esi
push esi
lea ecx, [ebp - 0x68]
push ecx
mov ecx, edi
call dword [eax]
mov eax, dword [0x44b0ac]
mov dword [ebp - 0x6c], eax
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, edi
call dword [eax]
mov eax, dword [0x44b098]
test eax, eax
je 0x43c21d
push eax
push ebx
call fcn.00427ecd
add esp, 8
mov dword [ebp - 0x70], 0x29c
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x70]
push ecx
mov ecx, edi
call dword [eax]
push dword [0x44b098]
mov ecx, edi
call fcn.00427e62
xor ecx, ecx
inc ecx
call fcn.004276f0
mov ebx, dword [ebp - 0x48]
jmp 0x427c42
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
xor edi, edi
jmp 0x427b88
xor eax, eax
push eax
push eax
push eax
push 1
mov esi, dword [sym.imp.KERNEL32.dll_RaiseException]
call esi
jmp 0x427c48
mov dword [0x44d1a8], 1
jmp 0x427c42
xor eax, eax
push eax
push eax
push eax
push 1
call esi
jmp 0x427c42
xor ebx, ebx
jmp 0x427c8a
push ecx
push ecx
push ecx
push 1
call esi
jmp 0x427d7b
mov dword [ebp - 0x74], 0x29d
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x74]
push ecx
mov ecx, edi
call dword [eax]
jmp 0x427d73
mov eax, dword [ebx + 8]
imul eax, dword [eax + 0x14], 0xc
mov edx, dword [eax + 0x41f398]
mov eax, dword [ebx + 0xc]
imul esi, dword [edx + eax*4], 0x24
add esi, 0x449060
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x43c26b
cmp esi, eax
je 0x43c26b
mov ecx, eax
call fcn.00444395
mov eax, esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x8c], eax
mov ecx, dword [0x449df4]
mov dword [ecx + 8], esi
mov edx, dword [ebx + 8]
call fcn.004282ee
mov ecx, dword [0x449df4]
call fcn.00422370
and dword [0x449030], 0
mov ecx, dword [0x449df4]
call fcn.0042756b
mov ecx, dword [0x449df4]
mov eax, dword [ecx + 8]
or dword [eax + 0xc], 8
push dword [ebx + 0xc]
mov eax, dword [ebx + 8]
push dword [eax + 8]
push 0x401404
call fcn.00427ecd
push ecx
call fcn.00425f10
add esp, 0x10
mov dword [0x44b0ac], eax
mov dword [ebp - 0x78], 0x299
mov eax, dword [edi]
push 4
pop esi
push esi
lea ecx, [ebp - 0x78]
push ecx
mov ecx, edi
call dword [eax]
mov eax, dword [0x44b0ac]
mov dword [ebp - 0x7c], eax
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x7c]
push ecx
mov ecx, edi
call dword [eax]
cmp dword [0x44b0ac], 0
je 0x43c300
xor ecx, ecx
inc ecx
call fcn.004276f0
mov eax, dword [0x44b098]
test eax, eax
je 0x43c338
push eax
push 0x401404
call fcn.00427ecd
add esp, 8
mov dword [ebp - 0x80], 0x29c
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x80]
push ecx
mov ecx, edi
call dword [eax]
push dword [0x44b098]
mov ecx, edi
call fcn.00427e62
jmp 0x43c350
mov dword [ebp - 0x84], 0x29d
mov eax, dword [edi]
push esi
lea ecx, [ebp - 0x84]
push ecx
mov ecx, edi
call dword [eax]
mov ecx, ebx
call fcn.00445598
test eax, eax
je 0x427d7b
jmp 0x427d73