Function at 0x426d90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfbb6
mov eax, dword fs:[0]
push eax
mov eax, 0x1ff4
call fcn.0047bc80
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1ef4], esi
lea eax, [ebp - 0x1ef0]
xorps xmm0, xmm0
push 0x504
push eax
movdqu xmmword [ebp - 0x1f9c], xmm0
call fcn.00408330
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x1ef0]
push eax
call fcn.00408430
push eax
lea eax, [ebp - 0x14e8]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1ff0]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00425d90
mov ecx, eax
call fcn.00425e00
test al, al
je 0x426e2f
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x1fe8], eax
or dword [ebp - 0x1fc4], 1
mov eax, 5
push 0x30
mov word [ebp - 0x1fc0], ax
lea eax, [ebp - 0x1f3c]
push 0
push eax
call fcn.0047bb20
add esp, 0xc
lea ecx, [ebp - 0x1f3c]
push 1
call fcn.0042c650
lea eax, [ebp - 0x1f9c]
push eax
lea eax, [ebp - 0x1ff0]
push eax
lea eax, [ebp - 0x14e8]
push eax
lea ecx, [ebp - 0x1f3c]
call fcn.0042c6a0
test eax, eax
jne 0x426ede
lea ecx, [ebp - 0x2000]
call fcn.0047aec6
mov dword [ebp - 0x1ff4], 2
push 2
mov dword [ebp - 4], 0
mov dword [ebp - method.InternetExplorerTabException.virtual_0], vtable.CannotOpenTabException.0
call fcn.00404360
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push 0x4f515c
lea eax, [ebp - 0x2000]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.0047b07b
push 0x7d0
push dword [ebp - 0x1f9c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [ebp - 0x1f94]
xor edx, edx
mov edi, eax
mov dword [ebp - 0x1f84], 0
mov esi, 0x12c
mov dword [ebp - 0x1f88], edx
mov dword [ebp - 0x1f8c], ecx
lea ebx, [ebx]
test esi, esi
jle 0x427041
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1f8c]
push eax
push 0x4270f0
push edi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov edx, dword [ebp - 0x1f88]
dec esi
test edx, edx
je 0x426f20
mov dword [ebp - 0x1ef8], 0xf
mov dword [ebp - 0x1efc], 0
mov byte [ebp - 0x1f0c], 0
mov esi, dword [ebp - 0x1ef4]
lea eax, [ebp - 0x1f0c]
push eax
lea eax, [ebp - 0x1f8c]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004267f0
mov eax, dword [ebp - 0x1f84]
test eax, eax
jne 0x427087
push eax
call fcn.00408520
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
lea eax, [ebp - 0x1f80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x1f50], ax
lea eax, [ebp - 0x1ef4]
push eax
push dword [ebp - 0x1f88]
movdqu xmmword [ebp - 0x1fac], xmm0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x1ef4]
lea eax, [ebp - 0xd8]
push 0x4d7388
push 0x64
push eax
call fcn.0047ce7f
add esp, 0x10
lea eax, [ebp - 0x1fac]
lea ecx, [ebp - 0x1f3c]
push eax
lea eax, [ebp - 0x1f80]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.0042c6a0
test eax, eax
je 0x42707e
push dword [ebp - 0x1fac]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1fa8]
call esi
jmp 0x427062
test edx, edx
jne 0x426f51
push edx
call fcn.0040cad0
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
lea ecx, [ebp - 0x1ffc]
call fcn.0047aec6
push 0x4f5144
lea eax, [ebp - 0x1ffc]
push eax
call fcn.0047b07b
push 0
push str.Failed_to_kill_IE.exe_instance
jmp 0x427050
push eax
mov ecx, esi
call fcn.00428030
mov ecx, dword [ebp - 0x1f9c]
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x4270a4
push ecx
call esi
mov eax, dword [ebp - 0x1f98]
test eax, eax
je 0x4270b1
push eax
call esi
cmp dword [ebp - 0x1ef8], 0x10
jb 0x4270c8
push dword [ebp - 0x1f0c]
call fcn.0047a557
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret