Function at 0x422758
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x422761
mov eax, dword [ebp - 4]
add esp, 0xfffffb8c
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00422394
mov dword [ebp - 0x78], 0xc
mov dword [ebp - 0x70], 0xffffffff
xor eax, eax
mov dword [ebp - 0x74], eax
push 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [0x426934]
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x44
call fcn.004032b0
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x30], 0x101
mov word [ebp - 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push 0x400
lea eax, [ebp - 0x478]
push eax
push 0x42569c
call sub.kernel32.dll_GetEnvironmentVariableW
push 0x422998
lea eax, [ebp - 0x478]
push eax
call sub.kernel32.dll_lstrcatW
push ebx
lea eax, [ebp - 0x478]
push eax
call sub.kernel32.dll_lstrcatW
push 0x4229a4
lea eax, [ebp - 0x478]
push eax
call sub.kernel32.dll_lstrcatW
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x478]
push eax
push 0
call dword [0x42693c]
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42298f
xor ebx, ebx
push 0x3e8
call sub.kernel32.dll_Sleep
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [0x426938]
test eax, eax
je 0x4228cf
cmp dword [ebp - 0x18], 1
jae 0x422883
inc ebx
jmp 0x4228b4
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10000
lea eax, [ebp - 0x10478]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4228cf
lea edx, [ebp - 0x10478]
mov ecx, dword [ebp - 0x18]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp ebx, 0x1e
ja 0x4228cf
cmp dword [ebp - 0x14], 0x103
je 0x422856
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
add ebx, ebx
add ebx, 2
mov eax, ebx
call fcn.00421b30
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42296a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [esi + 4]
push eax
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
add eax, eax
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
push 0
push 0
mov eax, esi
call fcn.00417434
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov byte [ebp - 0x10478], 0
mov byte [ebp - 0x10477], 0
lea edx, [ebp - 0x10478]
mov ecx, 2
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x422971
mov eax, dword [ebp - 8]
call fcn.00421b4c
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret