Function at 0x4184d8
Capabilities:
Query environment variable

Disassembly:
push 0x418
mov eax, 0x508569
call fcn.005060cc
mov eax, ecx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x414], eax
and dword [ebp - 4], 0
mov ecx, 0x3e8
mov eax, dword [ebp + 8]
or edi, 0xffffffff
cmp dword [eax - 0xc], ecx
jle 0x418597
push ecx
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp + 8]
call fcn.0041ad65
mov byte [ebp - 4], 1
mov edx, dword [eax]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x418576
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x41856a
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x41856a
call fcn.004098e7
mov dword [ebp - 0x418], eax
mov eax, edi
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x41855c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x418]
add eax, 0x10
mov dword [ebp + 8], eax
jmp 0x418576
push dword [edx - 0xc]
lea ecx, [ebp + 8]
push edx
call fcn.0040942f
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x414]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418597
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword fs:[0x2c]
mov ebx, dword [eax]
mov eax, dword [0xd5c638]
cmp eax, dword [ebx + 4]
jle 0x4185e9
mov esi, 0xd5c638
push esi
call fcn.004efe9f
pop ecx
cmp dword [0xd5c638], edi
jne 0x4185e9
mov edx, str.ProgramW6432
mov byte [ebp - 4], 2
mov ecx, 0xd5c63c
call fcn.00423c5a
push 0x5173ab
call fcn.004f0205
push esi
mov byte [ebp - 4], 0
call fcn.004efe55
pop ecx
pop ecx
mov eax, dword [0xd5c640]
cmp eax, dword [ebx + 4]
jle 0x418633
mov esi, 0xd5c640
push esi
call fcn.004efe9f
pop ecx
cmp dword [0xd5c640], edi
jne 0x418633
mov edx, str.ProgramFiles
mov byte [ebp - 4], 3
mov ecx, 0xd5c644
call fcn.00423c5a
push 0x51738c
call fcn.004f0205
push esi
mov byte [ebp - 4], 0
call fcn.004efe55
pop ecx
pop ecx
cmp dword [0xabada0], 0
je 0x41864a
call fcn.00426920
test eax, eax
mov eax, dword [0xd5c63c]
jne 0x41864f
mov eax, dword [0xd5c644]
push ecx
mov esi, esp
mov dword [ebp - 0x414], esp
lea ecx, [eax - 0x10]
mov dword [ebp - 0x41c], esi
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x41c], esp
push str._ProgramFiles_
call fcn.004094e6
push ecx
mov byte [ebp - 4], 5
mov esi, esp
mov dword [ebp - 0x420], esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004098e7
add eax, 0x10
lea ecx, [ebp - 0x418]
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.00423659
add esp, 0xc
mov byte [ebp - 4], 6
mov edx, dword [eax]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x41870b
cmp dword [esi + 0xc], 0
jl 0x4186ff
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4186ff
call fcn.004098e7
mov dword [ebp - 0x414], eax
lea ecx, [esi + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4186f1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x414]
add eax, 0x10
mov dword [ebp + 8], eax
jmp 0x41870b
push dword [edx - 0xc]
lea ecx, [ebp + 8]
push edx
call fcn.0040942f
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x418]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41872c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0xd5c648]
cmp eax, dword [ebx + 4]
jle 0x418776
mov esi, 0xd5c648
push esi
call fcn.004efe9f
pop ecx
cmp dword [0xd5c648], edi
jne 0x418776
mov edx, str.CommonProgramW6432
mov byte [ebp - 4], 7
mov ecx, 0xd5c64c
call fcn.00423c5a
push 0x51736d
call fcn.004f0205
push esi
mov byte [ebp - 4], 0
call fcn.004efe55
pop ecx
pop ecx
mov eax, dword [0xd5c650]
cmp eax, dword [ebx + 4]
jle 0x4187c0
mov esi, 0xd5c650
push esi
call fcn.004efe9f
pop ecx
cmp dword [0xd5c650], edi
jne 0x4187c0
mov edx, str.CommonProgramFiles
mov byte [ebp - 4], 8
mov ecx, 0xd5c654
call fcn.00423c5a
push 0x51734e
call fcn.004f0205
push esi
mov byte [ebp - 4], 0
call fcn.004efe55
pop ecx
pop ecx
cmp dword [0xabada0], 0
je 0x4187d7
call fcn.00426920
test eax, eax
mov eax, dword [0xd5c64c]
jne 0x4187dc
mov eax, dword [0xd5c654]
push ecx
mov esi, esp
mov dword [ebp - 0x420], esp
lea ecx, [eax - 0x10]
mov dword [ebp - 0x41c], esi
call fcn.004098e7
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x41c], esp
push str._CommonProgramFiles_
call fcn.004094e6
push ecx
mov byte [ebp - 4], 0xa
mov esi, esp
mov dword [ebp - 0x414], esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004098e7
add eax, 0x10
lea ecx, [ebp - 0x418]
mov dword [esi], eax
mov byte [ebp - 4], 0
call fcn.00423659
add esp, 0xc
mov byte [ebp - 4], 0xb
mov edx, dword [eax]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x418897
lea ebx, [esi + 0xc]
cmp dword [ebx], 0
jl 0x41888b
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x41888b
call fcn.004098e7
mov dword [ebp - 0x414], eax
mov eax, edi
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x41887d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x414]
add eax, 0x10
mov dword [ebp + 8], eax
jmp 0x418897
push dword [edx - 0xc]
lea ecx, [ebp + 8]
push edx
call fcn.0040942f
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x418]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4188b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x3ff
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x410]
push eax
mov ecx, esi
call fcn.004094e6
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x418912
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
call fcn.00506076
ret