Function at 0x4022a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x408]
mov esi, ecx
push 0
push eax
call fcn.0040bf00
push 0x400
lea eax, [ebp - 0xc08]
push 0
push eax
call fcn.0040bf00
push 0x200
lea eax, [ebp - 0x608]
push 0
push eax
call fcn.0040bf00
push 0x200
lea eax, [ebp - 0x808]
push 0
push eax
call fcn.0040bf00
add esp, 0x30
test esi, esi
je 0x4025df
cmp dword [esi + 4], 4
jne 0x4025df
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4025df
push 7
mov edx, str.copydir
call fcn.00408b60
add esp, 4
test eax, eax
je 0x4025df
cmp dword [eax + 4], 5
jne 0x4025df
mov eax, dword [eax + 8]
mov dword [ebp - 0xc10], eax
test eax, eax
je 0x4025df
mov edi, dword [eax + 8]
xor ebx, ebx
mov dword [ebp - 0xc20], edi
mov dword [ebp - 0xc18], ebx
test edi, edi
je 0x4025df
nop
cmp ebx, dword [eax + 8]
jae 0x4025d0
mov eax, dword [eax + 4]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x4025ca
cmp dword [eax + 4], 4
jne 0x4025ca
mov esi, dword [eax + 8]
mov dword [ebp - 0xc1c], esi
test esi, esi
je 0x4025ca
push 3
mov edx, 0x42dd54
mov ecx, esi
call fcn.00408b60
add esp, 4
test eax, eax
je 0x4025ca
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x4025ca
mov eax, dword [ecx]
test eax, eax
je 0x4025ca
push eax
mov edx, 0x200
lea ecx, [ebp - 0x408]
call fcn.004085d0
xor eax, eax
add esp, 4
mov word [ebp - 0xa], ax
cmp ax, word [ebp - 0x408]
je 0x4025ca
push 0x200
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea ecx, [ebp - 0x408]
mov word [ebp - 0x80a], ax
mov edx, 0x200
lea eax, [ebp - 0xc08]
push eax
call fcn.004075c0
lea eax, [ebp - 0x408]
mov edx, 0x1ff
push eax
lea ecx, [ebp - 0x608]
call fcn.00408670
push 4
mov edx, str.dest
mov byte [ebp - 0x409], 0
mov ecx, esi
call fcn.00408b60
add esp, 0xc
test eax, eax
je 0x4025c1
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x4025c1
mov eax, dword [ecx]
test eax, eax
je 0x4025c1
push eax
mov edx, 0x200
lea ecx, [ebp - 0x408]
call fcn.004085d0
xor eax, eax
add esp, 4
mov word [ebp - 0xa], ax
cmp ax, word [ebp - 0x408]
je 0x4025ca
push 0x200
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea ecx, [ebp - 0x408]
mov word [ebp - 0x80a], ax
mov edx, 0x200
lea eax, [ebp - 0xc08]
push eax
call fcn.004075c0
xor ebx, ebx
mov dword [ebp - 0xc0c], 0
add esp, 4
lea eax, [ebp - 0x408]
lea esi, [ebp - 0x808]
mov dword [ebp - 0xc14], eax
cmp word [ebp - 0x408], bx
je 0x40256a
cmp ebx, 0x1fe
jae 0x40256d
movzx edx, word [eax]
push ecx
lea ecx, [ebp - 0xc0c]
call fcn.00407b10
mov edi, eax
add esp, 4
test edi, edi
jle 0x40256d
add ebx, edi
cmp ebx, 0x1fe
ja 0x40256d
push edi
lea eax, [ebp - 0xc0c]
push eax
push esi
call fcn.0040c980
mov eax, dword [ebp - 0xc14]
add esp, 0xc
add eax, 2
add esi, edi
mov dword [ebp - 0xc14], eax
cmp word [eax], 0
jne 0x402518
mov byte [esi], 0
mov ecx, dword [ebp - 0xc1c]
mov edx, str.replace
push 7
mov byte [ebp - 0x609], 0
call fcn.00408b60
add esp, 4
test eax, eax
je 0x402598
cmp dword [eax + 4], 6
jne 0x402598
mov eax, dword [eax + 8]
jmp 0x40259a
xor eax, eax
neg eax
lea edx, [ebp - 0x608]
lea ecx, [ebp - 0x808]
sbb eax, eax
push eax
call fcn.00407160
mov ebx, dword [ebp - 0xc18]
add esp, 4
mov edi, dword [ebp - 0xc20]
jmp 0x4025ca
xor eax, eax
mov word [ebp - 0x408], ax
mov eax, dword [ebp - 0xc10]
inc ebx
mov dword [ebp - 0xc18], ebx
cmp ebx, edi
jb 0x402370
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a851
mov esp, ebp
pop ebp
ret