Function at 0x47b300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d32a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x50cc94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x511ea8], 0
jne 0x47b33b
push 0
call fcn.004791f0
add esp, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x47b618
push 0x4f4df0
push eax
call fcn.004afb01
add esp, 8
test eax, eax
je 0x47b618
mov ecx, dword [ebx]
sub eax, ecx
sar eax, 1
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x47b618
mov eax, dword [ecx - 0xc]
lea esi, [edi + 2]
test esi, esi
jl 0x47b618
cmp esi, eax
jg 0x47b618
lea eax, [ecx + esi*2]
push 0x4f4df0
push eax
call fcn.004afb01
add esp, 8
test eax, eax
je 0x47b618
sub eax, dword [ebx]
sar eax, 1
cmp eax, 0xffffffff
je 0x47b618
sub eax, edi
mov dword [ebp - 0x20], eax
add eax, 0xfffffffe
push eax
push esi
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call fcn.004295d7
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], 0
je 0x47b5f2
call fcn.004a1286
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x47b6d1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, 0x4e0608
mov byte [ebp - 4], 1
test ecx, 0xffff0000
jne 0x47b5af
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.004a91be
mov edi, eax
test edi, edi
je 0x47b4d0
mov eax, ebx
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47b4d0
push ebx
push eax
push edi
call fcn.00421708
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x47b4d0
movzx edi, word [ebx]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x47b472
push edi
lea ecx, [ebp - 0x10]
call fcn.00421527
mov esi, dword [ebp - 0x10]
movzx eax, word [ebx]
add ebx, 2
mov dword [ebp - 0x1c], ebx
cmp eax, 0xffffffff
jne 0x47b48a
push ebx
call fcn.004af97a
add esp, 4
inc eax
lea edx, [eax + eax]
mov eax, dword [ebp - 0x1c]
push edx
push eax
lea ebx, [edi + edi]
push ebx
push esi
call fcn.004af400
add esp, 0x10
cmp eax, 0x50
ja case.0x47b4af.1
movzx ecx, byte [eax + 0x47b700]
jmp dword [ecx*4 + 0x47b6f0]
test edi, edi
jl 0x47b6e5
cmp edi, dword [esi - 8]
jg 0x47b6e5
xor edx, edx
mov dword [esi - 0xc], edi
mov word [ebx + esi], dx
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x47b4fe
push 0x514
lea ecx, [ebp - 0x10]
call fcn.00421527
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0x514
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004af95b
add esp, 8
test eax, eax
jl 0x47b6e5
cmp eax, dword [esi - 8]
jg 0x47b6e5
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [ebp - 0x1c], ecx
je 0x47b5d2
cmp dword [esi - 0xc], ecx
je 0x47b5d2
mov eax, dword [ebp - 0x20]
push edi
add eax, 2
push ebx
call fcn.00423689
push esi
push ebx
mov eax, edi
call fcn.00433f84
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x47b580
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47b33b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x47b33b
push 0x4e0608
call fcn.004af97a
add esp, 4
push eax
push 0x4e0608
lea ecx, [ebp - 0x10]
call fcn.0042423a
mov esi, dword [ebp - 0x10]
jmp 0x47b4d6
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47b5f2
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47b618
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jle 0x47b684
push 0x25
push eax
call fcn.004b0428
add esp, 8
test eax, eax
je 0x47b684
sub eax, dword [ebx]
sar eax, 1
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x47b684
mov dword [ebp - 0x10], 0
mov esi, 0x50e580
mov edx, dword [esi]
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47b650
mov ecx, dword [ebx]
sub eax, edi
mov edi, dword [ebp - 0x14]
sar eax, 1
push eax
push edx
lea ecx, [ecx + edi*2]
push ecx
call fcn.004b1ee6
add esp, 0xc
test eax, eax
je 0x47b696
inc dword [ebp - 0x10]
add esi, 0x10
cmp esi, 0x50e7c0
jl 0x47b647
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl eax, 4
mov esi, eax
mov eax, dword [esi + 0x50e580]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47b6a7
sub eax, edx
push edi
sar eax, 1
push ebx
call fcn.00423689
mov edx, dword [esi + 0x50e58c]
push edx
push ebx
mov eax, edi
call fcn.00433f84
jmp 0x47b33b
push 0x80004005
call fcn.00421000
call fcn.004a17ee
call fcn.004a1826
push 0x80070057
call fcn.00421000
nop
mov dh, 0xb4
inc edi
add bl, bl
mov dh, 0x47
add al, ah
mov dh, 0x47
add al, ah
mov dh, 0x47
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3