Function at 0x4d4780
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4fffb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xd4]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], esi
call fcn.00447b00
mov ebx, dword [esp + 0x26c]
push 0
push 0
push 0
mov ecx, ebx
mov dword [esp + 0x270], 0
call fcn.004e9830
push ecx
mov eax, esp
mov ecx, ebx
mov dword [esp + 0x14], esp
mov dword [eax], str.safebox_config
call fcn.004ebd30
test al, al
je 0x4d4958
mov ecx, ebx
call fcn.004eb230
push ecx
mov eax, esp
mov ecx, ebx
mov dword [esp + 0x14], esp
mov dword [eax], str.safebox_sw
call fcn.004ebd30
test al, al
je 0x4d4951
mov ecx, ebx
call fcn.004eb230
push ecx
mov eax, esp
mov ecx, ebx
mov dword [esp + 0x14], esp
mov dword [eax], str.excluded_app
call fcn.004ebd30
test al, al
je 0x4d494a
mov ecx, ebx
call fcn.004eb230
lea ecx, [ecx]
push ecx
mov eax, esp
mov ecx, ebx
mov dword [esp + 0x14], esp
mov dword [eax], 0x529a10
call fcn.004ebd30
test al, al
je 0x4d4943
push ecx
mov eax, esp
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], esp
push ecx
mov ecx, ebx
mov dword [eax], str.file
call fcn.00402ab0
push 0x208
lea edx, [esp + 0x58]
push 0
push edx
mov byte [esp + 0x270], 1
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x103
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esi + 0xf0]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push str.MODULEDIR
lea ecx, [esp + 0x5c]
push 0x103
push ecx
mov edx, ecx
push edx
call fcn.00443e10
add esp, 0x14
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov edi, dword [esi + 0xa8]
mov ecx, dword [edi + 4]
add esi, 0xa4
push eax
push ecx
push edi
mov ecx, esi
mov byte [esp + 0x270], 2
call fcn.00401220
push 1
mov ecx, esi
mov ebp, eax
call fcn.004012c0
mov dword [edi + 4], ebp
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x38]
mov dword [eax], ebp
mov byte [esp + 0x264], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x264], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov esi, dword [esp + 0x18]
jmp 0x4d4840
mov ecx, ebx
call fcn.004eb250
mov ecx, ebx
call fcn.004eb250
mov ecx, ebx
call fcn.004eb250
lea ecx, [esp + 0x14]
mov dword [esp + 0x264], 0xffffffff
call fcn.00447b20
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x258
ret 4