Function at 0x4471a9
Capabilities:
Query environment variable

Disassembly:
lea esp, [esp + 4]
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
push eax
push ecx
push edx
mov eax, dword [ebp + 0x18]
jmp 0x43997b
push eax
mov ecx, dword [ebp + 0x14]
push ecx
jmp 0x439983
push esi
push 0x9c402458
shl di, 0x20
push edi
call dword [0x48882e]
mov edi, eax
shl si, 0x20
jmp 0x43999c
push esi
call fcn.00460ed5
ja 0x447163
jbe 0x4399af
popal
movsd dword es:[edi], dword [esi]
test dword [edi], esp
jbe 0x447163
add eax, 0x2e810f5b
movsb byte es:[edi], byte [esi]
add dword [eax], eax
dec edx
ror byte [eax + 0xc8d0fe4], cl
add byte [eax], al
add byte [ebx + eax - 9], bh
wait
dec esp
fmul dword gs:[ebx + 0x26ff0476]
mov ecx, ecx
mov di, di
shr dh, 0x40
jne 0x4463cd
je 0x4419b1
je 0x4463cd
and si, si
cmp eax, 0xffffffff
jne 0x44c7eb
je 0x442b0b
cpuid
nop
ret
xor eax, eax
jb 0x453d32
pop edi
pop esi
mov dh, dh
pop ebx
mov bl, bl
mov esp, ebp
pop ebp
ret
jle 0x44e14b
shl ebx, 0x20
jg 0x4463db
js 0x44e139
add esp, 4
test edi, edi
jb 0x462935
jne 0x467b75
je 0x44717b
push ebp
push 0
push 0
push 3
push ebx
pop ebx
push 0
push 3
push 0xc0000000
push 0x488859
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jne 0x461d6a
je 0x4471a1
inc edx
and ecx, dword [edi]
test bl, al
stosd dword es:[edi], eax
add dword [eax], eax
je 0x461d6a
and eax, 0x4c481fe
add byte [eax], al
add byte [ecx], al
clc
cmp byte [eax], 0xf
jne 0x4594f4
je 0x4471c0
nop
cpuid
ret 0xc7f7
test edi, 0x4160bc7
cmp byte [eax + 1], bl
jne 0x4594f4
je 0x4471d4
je 0x4471d6
xlatb
jmp 0x4471d5
push esi
push eax
call fcn.0044a30f
add esp, 8
stc
shl eax, 0x20
jb 0x4471ed
idiv bh
invalid
xchg bp, ax
xchg ebp, eax
jb 0x454df5
add eax, 0xba9e8805
add byte [eax], al
add byte [esi - 0x77], ah
invalid
shr al, 0x40
ret
push 0
mov eax, dword [esi]
shr edi, 0x40
jmp 0x44ab40
push eax
call fcn.0043b4a9
sub dx, 0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
add bp, 0
add esp, 4
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
push eax
xchg di, ax
xchg di, ax
jmp 0x467b42
push eax
mov dword [0x487f9a], eax
call fcn.0046a404
add esp, 4
cmp ax, 0x33c
mov si, si
jae 0x464978
jb 0x44c810
fdivr st(7)
lodsb al, byte [esi]
jmp 0x45190b
jmp 0x45190b
mov eax, dword [0x487f9a]
shr dh, 0x40
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x487f9a], 0xffffffff
push 0xb
push esi
call fcn.0043b4a9
add esp, 8
mov si, si
mov eax, 1
jne 0x45f15d
je 0x451944
cmp eax, 0x13840f3a
fadd dword [eax]
add byte [ebx + 0x448b0446], cl
add eax, 0xd5876600
je 0x45f15d
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
xchg bp, dx
xchg dx, bp
mov ebx, dword [esi + 8]
mov eax, dword [eax]
lea esi, [esi + 0xc]
add dword [ebp + ebx], eax
jmp dword [esi]
rcr dword [ebp + 0x69800f82], 0x3e
add byte [eax], al
test eax, eax
jb 0x441983
jmp 0x4594e8
push 0x48817a
push str.HL_SEARCH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [0x4881d2], eax
jne 0x459511
je 0x4594f4
test eax, 0x85c729ef
dec dword [edi]
adc byte [ebx + 0xffffe84], 0x84
salc
or byte [eax], al
add byte [ebp + 3], dh
test edi, edi
jb 0x44198f
je 0x459dd8
jne 0x459507
invalid
dec edi
mov ch, ch
jmp 0x43dd96
test edi, edi
jb 0x441997
je 0x44ab38
jne 0x459525
push ebp
call 0xd276b173
xor edx, edx
jb 0x44199e
mov bh, bh
mov eax, dword [esi + 4]
push 0x44ab1b
ret
push 0x14
mov eax, dword [esi]
push eax
call fcn.0043b4a9
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
jne 0x44a350
je 0x459df7
jb 0x459e5c
je 0x45a34e
je 0x44a350
invalid
invalid
push ss
invalid
add byte [eax], al
add byte [esp + eax + 0xf], dh
mov byte [0xd2a15fc3], al
or dword [eax], 0xc71497c3
add eax, 0x4881d6
add byte [eax], al
add byte [eax], al
push 0x58
jno 0x455f80
jo 0x45a376
xor byte [eax + ebx*4 - 0x43fb7ff1], dh
invalid
jo 0x455f80
xor eax, 0x24648d60
add al, 0x89
in eax, 0x39
leave
sub esp, 4
shr cl, 0x40
jmp 0x45a390
push esi
lea eax, [ebp - 4]
push 0x44d9aa
ret
mov dword [0x487f9a], eax
jmp 0x442af7
xor al, 5
mov ah, ah
mov ebx, ebx
mov eax, dword [esi + 4]
shl edi, 0x20
mov ebx, dword [esi + 8]
js 0x43d9b7
jns 0x46294f
push esi
call fcn.00459900
jno 0x44b6fd
jo 0x464989
add esp, dword [ebp + 0xf]
sub byte [esi + 0x6d], 0xfe
jmp dword [0xc1068b06]
jo 0x44b6fd
and eax, 0xc1068b06
out dx, eax
add ebp, ebx
jmp 0x467b43
push ecx
push edx
mov eax, dword [ebp + 0x18]