Function at 0x44bb70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451765
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x134
mov eax, dword [0x4605d8]
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x44]
call fcn.004031a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00403470
mov byte [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x44bbdb
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x44bc0b
mov dword [ebp - 0xec], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004034a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00403210
mov eax, dword [ebp - 0xec]
jmp 0x44c138
push 0
call fcn.0044d660
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44bc28
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [ebp - 4], 2
push 0
push 0x208
lea ecx, [ebp - 0x24]
call fcn.004034c0
lea ecx, [ebp - 0x24]
call fcn.00403560
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
lea ecx, [ebp - 0x44]
call fcn.00403250
jmp 0x44bc81
mov dword [ebp - 4], 1
jmp 0x44bc8f
mov byte [ebp - 4], 4
mov ecx, dword [0x4594b0]
mov dword [ebp - 0x54], ecx
mov edx, dword [0x4594b0]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x50], 0
mov eax, 1
test eax, eax
je 0x44bd26
push 0
push 0x22
lea ecx, [ebp - 0x44]
call fcn.0040f300
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x54]
cmp edx, dword [0x4594b0]
je 0x44bce5
lea ecx, [ebp - 0x44]
call fcn.004033e0
sub eax, 1
cmp dword [ebp - 0x54], eax
jne 0x44bce7
jmp 0x44bd26
mov eax, dword [ebp - 0x50]
add eax, 1
push eax
push 0x22
lea ecx, [ebp - 0x44]
call fcn.0040f300
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [0x4594b0]
jne 0x44bd08
jmp 0x44bd26
push 1
mov edx, dword [ebp - 0x54]
push edx
lea ecx, [ebp - 0x44]
call fcn.00403290
push 1
mov eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x44]
call fcn.00403290
jmp 0x44bcac
jmp 0x44bd35
mov dword [ebp - 4], 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00403560
shl eax, 1
push eax
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
call fcn.004288a0
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00403560
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
lea ecx, [ebp - 0x44]
call fcn.004033c0
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x24]
call fcn.00403560
cmp dword [ebp - 0x4c], eax
jbe 0x44bdca
push 0
mov ecx, dword [ebp - 0x4c]
add ecx, 1
push ecx
lea ecx, [ebp - 0x24]
call fcn.004034c0
lea ecx, [ebp - 0x24]
call fcn.00403560
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
lea ecx, [ebp - 0x44]
call fcn.004033c0
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x44bdf0
lea ecx, [ebp - 0x24]
call fcn.00403560
cmp dword [ebp - 0x4c], eax
jae 0x44bdf0
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
lea ecx, [ebp - 0x44]
call fcn.00403250
jmp 0x44be05
mov dword [ebp - 4], 1
jmp 0x44be13
mov byte [ebp - 4], 8
push 0
lea ecx, [ebp - 0x44]
call fcn.004033e0
add eax, 1
push eax
lea ecx, [ebp - 0x24]
call fcn.004034c0
lea ecx, [ebp - 0x24]
call fcn.00403560
shl eax, 1
push eax
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
call fcn.004288a0
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.004033c0
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
call fcn.00428944
add esp, 8
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
push 0
lea ecx, [ebp - 0x24]
call fcn.004035a0
push eax
lea ecx, [ebp - 0x44]
call fcn.00403250
jmp 0x44bea2
mov dword [ebp - 4], 1
jmp 0x44beb0
mov byte [ebp - 4], 0xa
push 1
push 3
lea ecx, [ebp - 0xe0]
call fcn.004035f0
mov dword [ebp - 0x12c], eax
mov byte [ebp - 4], 0xb
mov edx, dword [0x4594b0]
mov dword [ebp - 0xe8], edx
mov eax, dword [0x4594b0]
mov dword [ebp - 0xe4], eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.0044bab0
add esp, 4
mov dword [ebp - 0xe4], 0
mov edx, 1
test edx, edx
je 0x44c0b6
mov eax, dword [ebp - 0xe4]
push eax
push 0x20
lea ecx, [ebp - 0x44]
call fcn.0040f300
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [0x4594b0]
jne 0x44bf31
jmp 0x44c0b6
lea ecx, [ebp - 0x44]
call fcn.004033e0
mov edx, dword [ebp - 0xe8]
add edx, 1
cmp edx, eax
jne 0x44bf56
lea ecx, [ebp - 0x44]
call fcn.004033e0
mov dword [ebp - 0xe4], eax
jmp 0x44bf70
mov eax, dword [ebp - 0xe8]
add eax, 1
push eax
push 0x20
lea ecx, [ebp - 0x44]
call fcn.00403450
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [0x4594b0]
jne 0x44bf8c
lea ecx, [ebp - 0x44]
call fcn.004033e0
mov dword [ebp - 0xe4], eax
mov edx, dword [ebp - 0xe4]
sub edx, dword [ebp - 0xe8]
cmp edx, 4
jbe 0x44c0b1
push 0x4593f8
lea ecx, [ebp - 0x108]
call fcn.004031d0
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0xe0]
call fcn.00403760
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x108]
call fcn.00403210
lea ecx, [ebp - 0xe0]
test ecx, ecx
je 0x44bff4
lea edx, [ebp - 0xd8]
mov dword [ebp - 0x134], edx
jmp 0x44bffe
mov dword [ebp - 0x134], 0
push 0x4593fc
mov eax, dword [ebp - 0x134]
push eax
call fcn.00409900
add esp, 8
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0xe4]
sub ecx, dword [ebp - 0xe8]
push ecx
mov ecx, dword [ebp - 0x138]
call fcn.004028c0
mov dword [ebp - 0x13c], eax
push 0x402720
mov ecx, dword [ebp - 0x13c]
call fcn.004028a0
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0xe0]
call fcn.00403720
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x144], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x144]
call fcn.004033c0
push eax
mov ecx, dword [ebp - 0xe4]
sub ecx, dword [ebp - 0xe8]
push ecx
mov edx, dword [ebp - 0xe8]
push edx
lea ecx, [ebp - 0x44]
call fcn.00403360
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x124]
call fcn.00403210
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe4], eax
jmp 0x44befa
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00403230
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe0]
call fcn.00402760
jmp 0x44c0e6
mov dword [ebp - 4], 1
jmp 0x44c0f1
mov dword [ebp - 0x48], 0
cmp dword [ebp - 0x14], 0
je 0x44c10e
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x128], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004034a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00403210
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00428c24
mov esp, ebp
pop ebp
ret