Function at 0x4149e8
Capabilities:
Query environment variable

Disassembly:
jmp 0x4b13d0
sub esp, 0xa58
mov eax, dword [0xa0b130]
xor eax, esp
mov dword [esp + 0xa54], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0xa68]
lea ecx, [esp + 0xa6c]
push 0
sub esp, 8
mov dword [esp + 0x24], edi
mov eax, esp
mov dword [eax], 0x925a30
mov dword [eax + 4], 2
call fcn.00409340
cmp eax, 0xffffffff
je 0x4b1467
mov eax, dword [esp + 0xa6c]
mov dword [esp + 0x64], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0xf
test eax, eax
je 0x4b144b
push dword [esp + 0xa70]
lea ecx, [esp + 0x68]
push eax
call fcn.00408698
movups xmm0, xmmword [esp + 0x64]
and byte [edi + 0x18], 0xfe
movups xmmword [edi], xmm0
movq xmm0, qword [esp + 0x74]
movq qword [edi + 0x10], xmm0
jmp 0x4b1f1a
mov eax, dword [esp + 0xa78]
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [esp + 0x14], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 7
test eax, eax
je 0x4b1736
imul eax, eax, 0x104
lea ecx, [esp + 0x4c]
push eax
call fcn.0040e0d4
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0xa78], eax
jbe 0x4b1724
nop
test eax, eax
je 0x4b1625
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x60]
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], edi
cmp esi, edi
jae 0x4b14fb
lea eax, [esi + 1]
cmp edi, 8
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x4c]
cmovae eax, dword [esp + 0x4c]
mov dword [eax + esi*2], 0x3b
jmp 0x4b1625
mov eax, SysReAllocString
sub eax, esi
cmp eax, 1
jb 0x4b1f39
lea eax, [esi + 1]
mov esi, eax
mov dword [esp + 0x20], eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4b1536
mov eax, 0xfffffffe
mov esi, SysReAllocString
push eax
call fcn.00404818
add esp, 4
mov edi, eax
jmp 0x4b159b
mov ecx, edi
mov eax, SysReAllocString
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x4b155c
mov eax, 0xfffffffe
mov esi, SysReAllocString
push eax
call fcn.00404818
add esp, 4
mov edi, eax
jmp 0x4b159b
lea eax, [ecx + edi]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x4b1f34
add eax, eax
cmp eax, 0x1000
jb 0x4b1588
push eax
call fcn.00404818
add esp, 4
mov edi, eax
jmp 0x4b159b
test eax, eax
je 0x4b1599
push eax
call fcn.00405e93
add esp, 4
mov edi, eax
jmp 0x4b159b
xor edi, edi
cmp dword [esp + 0x14], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x60], esi
lea esi, [eax + eax]
mov dword [esp + 0x20], esi
jb 0x4b160b
push dword [esp + 0x20]
mov esi, dword [esp + 0x50]
push esi
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov dword [edi + eax], 0x3b
mov eax, dword [esp + 0x14]
lea ecx, [eax*2 + 2]
cmp ecx, 0x1000
jb 0x4b15ff
mov edx, dword [esi - 4]
add ecx, 0x23
sub esi, edx
lea eax, [esi - 4]
cmp eax, 0x1f
ja 0x4b1851
mov esi, edx
push ecx
push esi
call fcn.004036ca
add esp, 8
jmp 0x4b1621
push esi
lea eax, [esp + 0x50]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + esi], 0x3b
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0xa74]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
lea edx, [esp + 0x10c]
mov dword [esp + 0x100], edx
lea edx, [esp + 0x100]
push edx
push eax
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x110], 0
push eax
mov dword [esp + 0x118], 0x104
call fcn.00412350
mov ecx, dword [esp + 0x1c]
add esp, 0x10
test ecx, ecx
jne 0x4b17ee
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x28], esi
lea edx, [ecx + eax*2]
mov eax, dword [esp + 0x60]
sub edx, ecx
sub eax, esi
sar edx, 1
cmp edx, eax
ja 0x4b16dd
cmp dword [esp + 0x60], 8
lea edi, [esi + edx]
mov eax, dword [esp + 0x28]
lea esi, [esp + 0x4c]
cmovae esi, dword [esp + 0x4c]
mov dword [esp + 0x5c], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [esp + 0x104]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x4b16f2
push edx
push ecx
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x54]
push dword [esp + 0x38]
push edx
call fcn.0040919c
mov eax, dword [esp + 0x100]
lea ecx, [esp + 0x10c]
cmp eax, ecx
je 0x4b170a
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0xa78]
jb 0x4b14c0
mov edi, dword [esp + 0x18]
cmp dword [esp + 0x60], 8
lea esi, [esp + 0x4c]
cmovae esi, dword [esp + 0x4c]
mov dword [esp + 0x14], esi
lea eax, [esp + 0x644]
mov dword [esp + 0x63c], 0
mov dword [esp + 0x638], eax
lea eax, [esp + 0x638]
push eax
push dword [esp + 0xa74]
lea eax, [esp + 0x14]
mov dword [esp + 0x648], 0x104
push dword [esp + 0xa74]
push eax
call fcn.00412350
mov ecx, dword [esp + 0x1c]
add esp, 0x10
test ecx, ecx
je 0x4b1857
mov eax, dword [esp + 0x10]
or byte [edi + 0x18], 1
mov dword [edi], ecx
lea ecx, [esp + 0x644]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x638]
cmp eax, ecx
je 0x4b17ae
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
or byte [edi + 0x18], 1
mov dword [edi], ecx
lea ecx, [esp + 0x10c]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x100]
cmp eax, ecx
je 0x4b1817
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea eax, [esp + 0x88]
mov dword [esp + 0x84], 0xc
push str.PATHEXT
mov dword [esp + 0x80], eax
mov dword [esp + 0x8c], 0x9236bc
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], str..exe
mov dword [esp + 0x98], 4
mov dword [esp + 0x84], 2
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, eax
add esp, 4
test edx, edx
je 0x4b18f4
sub esp, 8
lea eax, [esp + 0x84]
mov ecx, esp
lea esi, [edx + 1]
push eax
mov dword [ecx], 0x927c60
sub esp, 8
mov dword [ecx + 4], 1
mov ecx, esp
mov dword [ecx], edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4b18e0
sub edx, esi
mov dword [ecx + 4], edx
call fcn.0040ca68
add esp, 0x14
mov edx, dword [esp + 0x7c]
lea eax, [esp + 0x320]
mov dword [esp + 0x314], eax
mov esi, 0x104
mov eax, dword [esp + 0x80]
mov dword [esp + 0x318], 0
mov dword [esp + 0x31c], 0x104
mov dword [esp + 0x18], edx
lea eax, [edx + eax*8]
mov dword [esp + 0x30], eax
cmp edx, eax
je 0x4b1bc5
nop dword [eax + eax]
mov eax, dword [edx + 4]
mov ecx, dword [edx]
lea edx, [esp + 0x10c]
mov dword [esp + 0x100], edx
lea edx, [esp + 0x100]
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x114], 0
mov dword [esp + 0x118], 0x104
call fcn.00412350
mov ecx, dword [esp + 0x30]
add esp, 0x10
test ecx, ecx
jne 0x4b1d85
mov eax, dword [esp + 0x31c]
cmp eax, esi
jae 0x4b19b6
push 2
push esi
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x320]
call fcn.00405e1b
lea eax, [esp + 0x858]
mov dword [esp + 0x850], 0
mov dword [esp + 0x84c], eax
lea ecx, [esp + 0x34]
lea eax, [esp + 0xa6c]
mov dword [esp + 0x854], 0x104
mov dword [esp + 0x64], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x84c]
push eax
lea eax, [esp + 0xec]
mov word [esp + 0x4c], 0x105
push eax
mov word [esp + 0x74], 0x105
mov word [esp + 0x44], 0x505
call fcn.0040a321
sub esp, 8
mov ecx, eax
mov edx, esp
cmp dword [eax + 0x14], 0x10
jb 0x4b1a2e
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
lea eax, [esp + 0x18]
push eax
call fcn.00412350
mov edx, dword [esp + 0x10c]
add esp, 0x10
cmp edx, 0x10
jb 0x4b1a7f
mov ecx, dword [esp + 0xe8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1a75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b1851
push edx
push ecx
call fcn.004036ca
add esp, 8
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x4b1cc3
push ecx
push dword [esp + 0x318]
lea eax, [esp + 0x854]
push dword [esp + 0x324]
push ecx
push eax
call fcn.00410627
add esp, 4
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SearchPathW]
mov esi, eax
lea ecx, [esp + 0x858]
mov eax, dword [esp + 0x84c]
cmp eax, ecx
je 0x4b1ad0
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x31c]
cmp eax, esi
jb 0x4b199f
mov eax, dword [esp + 0x100]
lea ecx, [esp + 0x10c]
test esi, esi
jne 0x4b1bbb
cmp eax, ecx
je 0x4b1aff
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x18]
add edx, 8
mov dword [esp + 0x18], edx
cmp edx, dword [esp + 0x30]
jne 0x4b1940
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00409de0
add esp, 8
mov ecx, dword [eax]
mov eax, dword [eax + 4]
or byte [edi + 0x18], 1
mov dword [edi], ecx
lea ecx, [esp + 0x320]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x314]
cmp eax, ecx
je 0x4b1b4e
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x88]
cmp eax, ecx
je 0x4b1b63
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x638]
lea ecx, [esp + 0x644]
cmp eax, ecx
je 0x4b1b7b
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp eax, ecx
je 0x4b1bc5
push eax
call ebx
add esp, 4
lea eax, [esp + 0x534]
mov dword [esp + 0x318], esi
mov dword [esp + 0x528], eax
lea eax, [esp + 0x528]
push eax
push esi
push dword [esp + 0x31c]
lea eax, [esp + 0x18]
mov dword [esp + 0x538], 0
push eax
mov dword [esp + 0x540], 0x104
call fcn.004020e5
mov ecx, dword [esp + 0x1c]
add esp, 0x10
test ecx, ecx
je 0x4b1e2f
mov eax, dword [esp + 0x10]
or byte [edi + 0x18], 1
mov dword [edi], ecx
lea ecx, [esp + 0x534]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x528]
cmp eax, ecx
je 0x4b1c3e
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x314]
lea ecx, [esp + 0x320]
cmp eax, ecx
je 0x4b1c56
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x88]
cmp eax, ecx
je 0x4b1c6b
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x638]
lea ecx, [esp + 0x644]
cmp eax, ecx
je 0x4b1c83
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [esp + 0x10]
or byte [edi + 0x18], 1
mov dword [edi], ecx
lea ecx, [esp + 0x858]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x84c]
cmp eax, ecx
je 0x4b1ce8
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x100]
lea ecx, [esp + 0x10c]
cmp eax, ecx
je 0x4b1d00
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x314]
lea ecx, [esp + 0x320]
cmp eax, ecx
je 0x4b1d18
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x88]
cmp eax, ecx
je 0x4b1d2d
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x638]
lea ecx, [esp + 0x644]
cmp eax, ecx
je 0x4b1d45
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [esp + 0x24]
or byte [edi + 0x18], 1
mov dword [edi], ecx
lea ecx, [esp + 0x10c]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x100]
cmp eax, ecx
je 0x4b1daa
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x314]
lea ecx, [esp + 0x320]
cmp eax, ecx
je 0x4b1dc2
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x88]
cmp eax, ecx
je 0x4b1dd7
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x638]
lea ecx, [esp + 0x644]
cmp eax, ecx
je 0x4b1def
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [esp + 0x528]
mov eax, dword [esp + 0x52c]
add eax, ecx
mov dword [esp + 0x64], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0xf
cmp ecx, eax
je 0x4b1e6f
sub eax, ecx
push eax
push ecx
lea ecx, [esp + 0x6c]
call fcn.00408698
mov ecx, dword [esp + 0x528]
movups xmm0, xmmword [esp + 0x64]
and byte [edi + 0x18], 0xfe
lea eax, [esp + 0x534]
movups xmmword [edi], xmm0
movq xmm0, qword [esp + 0x74]
movq qword [edi + 0x10], xmm0
cmp ecx, eax
je 0x4b1e97
push ecx
call ebx
add esp, 4
mov eax, dword [esp + 0x314]
lea ecx, [esp + 0x320]
cmp eax, ecx
je 0x4b1eaf
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x88]
cmp eax, ecx
je 0x4b1ec4
push eax
call ebx
add esp, 4
mov eax, dword [esp + 0x638]
lea ecx, [esp + 0x644]
cmp eax, ecx
je 0x4b1edc
push eax
call ebx
add esp, 4
mov edx, dword [esp + 0x60]
cmp edx, 8
jb 0x4b1f1a
mov ecx, dword [esp + 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4b1f10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4b1f10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004036ca
add esp, 8
mov ecx, dword [esp + 0xa60]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004087b5
add esp, 0xa58
ret
call fcn.004104b5
call fcn.0040a7a9
int3