Function at 0x4903be
Capabilities:
Query environment variable

Disassembly:
push 0x4c
mov eax, 0x5d1e02
call fcn.00506dc7
mov edi, ecx
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
call fcn.0041279d
push eax
lea ecx, [ebp - 0x14]
call fcn.00411d94
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call fcn.0041279d
push eax
lea ecx, [ebp - 0x10]
call fcn.00411d94
push 0x5f1b30
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.0042e677
test eax, eax
je 0x490a4f
push 0x3e8
call fcn.00506f2d
mov esi, eax
mov dword [esp], 0x1f4
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x490a4f
push esi
lea eax, [ebp + 0xc]
push 0x5f1ce0
push eax
call fcn.00412690
push esi
call fcn.00506f36
add esp, 0x10
lea ecx, [ebp + 0xc]
call fcn.00435d4e
mov ecx, eax
call fcn.00435c76
push 0
push 0x60cdb4
lea ecx, [ebp + 0xc]
call fcn.0042ea61
mov esi, 0x5f1b04
test eax, eax
jle 0x490481
push esi
push 0x60cdb4
lea ecx, [ebp + 0xc]
call fcn.00434b1c
push ebx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
call fcn.00434d0c
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0042e677
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
neg ebx
mov byte [ebp - 4], 2
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00412ac4
add bl, 1
je 0x4904e4
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0043189c
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00412ac4
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.004c8ff4
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x40]
call fcn.0042ca82
push ecx
mov esi, esp
mov byte [ebp - 4], 6
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
add eax, 0x10
lea ecx, [ebp - 0x40]
mov dword [esi], eax
call fcn.004ed232
test eax, eax
je 0x490580
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00412393
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x40]
call fcn.0042e60b
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
jmp 0x490b0a
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.00411f3a
lea ecx, [ebp + 0xc]
call fcn.0043193c
xor ebx, ebx
lea ecx, [ebp + 0xc]
push ebx
push str.rundll32
call fcn.0042ea61
cmp eax, 0xffffffff
je 0x4906b5
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0047876e
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, 0x5f1b30
lea ecx, [ebp - 0x10]
push esi
call fcn.0042e677
test eax, eax
jne 0x490643
mov ecx, dword [ebp + 8]
push esi
call fcn.00413f09
lea ecx, [ebp - 0x40]
call fcn.0042e60b
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, dword [ebp + 8]
jmp 0x490b2d
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 8
jb 0x49066c
mov eax, dword [edi]
jmp 0x49066e
mov eax, edi
push ecx
mov ecx, esp
push eax
call fcn.00413f09
mov byte [ebp - 4], 6
call fcn.0049bce3
pop ecx
pop ecx
test eax, eax
je 0x49068e
mov eax, dword [ebp - 0x10]
jmp 0x490556
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
push dword [ebp + 8]
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.0047e85c
jmp 0x490607
push ebx
push str.msiexec
lea ecx, [ebp + 0xc]
call fcn.0042ea61
test eax, eax
jne 0x490753
call fcn.00430f47
test eax, eax
je 0x490753
lea ecx, [ebp - 0x58]
call fcn.0042ca82
push ecx
mov esi, esp
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], esi
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 9
push eax
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
push esp
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.004e5694
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x58]
call fcn.00434114
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
push eax
call fcn.00412393
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x58]
call fcn.0042e60b
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
jmp 0x490568
push ebx
push str.c:windowsdxsdkuninst.exe
lea ecx, [ebp + 0xc]
call fcn.0042ea61
cmp eax, 0xffffffff
jne 0x490553
push 1
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x5f1b04
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.0042e677
mov ecx, dword [ebp - 0x1c]
test eax, eax
mov byte [ebp - 4], 6
setne bl
add ecx, 0xfffffff0
call fcn.00412ac4
test bl, bl
je 0x49093c
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 0xd
jb 0x4907cd
mov eax, dword [edi]
jmp 0x4907cf
mov eax, edi
push ecx
mov ecx, esp
push eax
call fcn.00413f09
mov byte [ebp - 4], 6
call fcn.0049bce3
pop ecx
pop ecx
test eax, eax
je 0x49093c
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 0xe
jb 0x490814
mov eax, dword [edi]
jmp 0x490816
mov eax, edi
push ecx
mov ecx, esp
push eax
call fcn.00413f09
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
call fcn.00489677
add esp, 0xc
mov byte [ebp - 4], 0xf
call fcn.0041279d
push eax
lea ecx, [ebp - 0x1c]
call fcn.00411d94
push ecx
mov esi, esp
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x10
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 0x11
jb 0x49086e
mov eax, dword [edi]
jmp 0x490870
mov eax, edi
push ecx
mov ecx, esp
push eax
call fcn.00413f09
mov byte [ebp - 4], 0x10
call fcn.0049bce3
pop ecx
pop ecx
test eax, eax
je 0x4908ff
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 3
jle 0x4908ff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00411f3a
mov esi, dword [ebp - 0x1c]
add esi, 0xfffffff0
push esi
call fcn.00412393
mov edi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, esi
mov dword [edi], eax
call fcn.00412ac4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x40]
call fcn.0042e60b
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
jmp 0x490b2d
push ecx
mov esi, esp
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
pop ecx
push dword [ebp + 8]
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.0047e85c
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
jmp 0x490607
push 0x5c
push dword [ebp - 0x10]
call fcn.0056bc73
pop ecx
pop ecx
test eax, eax
jne 0x490951
or eax, 0xffffffff
jmp 0x490956
sub eax, dword [ebp - 0x10]
sar eax, 1
inc eax
lea ecx, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0043198c
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x12
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push 0x60ce98
lea ecx, [ebp - 0x14]
call fcn.0042ea61
push ecx
mov esi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], esi
mov edi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
push ecx
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov ecx, esp
mov byte [ebp - 4], 0x13
push str._A_Za_z__:___
call fcn.00413f09
mov byte [ebp - 4], 6
call fcn.0049bce3
xor ebx, ebx
pop ecx
inc ebx
pop ecx
test eax, eax
je 0x4909f5
push ebx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d0c
push 0x5f1b04
mov ecx, eax
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x20], 2
call fcn.0042e677
test eax, eax
je 0x4909fc
cmp edi, 0xffffffff
je 0x4909fc
xor bl, bl
test byte [ebp - 0x20], 2
mov dword [ebp - 4], 6
je 0x490a14
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
test bl, bl
je 0x490a38
push 0
push 0x60e828
lea ecx, [ebp - 0x10]
call fcn.0042ea61
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0043189c
jmp 0x490607
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0042e60b
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push 0x60e82c
lea ecx, [ebp - 0x10]
call fcn.0042ea61
cmp eax, 0xffffffff
je 0x490a8c
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043189c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x15
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00412ac4
push 0
push 0x60e834
lea ecx, [ebp - 0x10]
call fcn.0042ea61
cmp eax, 0xffffffff
je 0x490ac9
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043189c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x16
call fcn.00411f3a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov eax, 0x60cdbc
lea ecx, [ebp - 0x10]
push eax
push eax
call fcn.00435cda
mov ecx, eax
call fcn.00435bf5
mov eax, 0x60e83c
lea ecx, [ebp - 0x10]
push eax
push eax
call fcn.00435cda
mov ecx, eax
call fcn.00435bf5
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00412393
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, esi
call fcn.00506d90
ret 8