Function at 0x42e758
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1b0]
push ebx
lea ebx, [ebp - 0x158]
sub esp, 0x27c
mov dword [esp], eax
call fcn.0048bbb0
lea ecx, [ebp - 0x114]
mov word [ebp - 0x158], 0x22
mov dword [esp], ebx
call fcn.004bfb6c
push esi
lea eax, [ebp - 0x258]
lea edx, [ebp - 0x114]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0042863c
lea ecx, [ebp - 0x114]
lea edi, [ebp - 0x1e0]
call fcn.004bbce0
mov ecx, 0xb
mov dword [ebp - 0x1e0], 0x76736452
mov dword [ebp - 0x1dc], 0x29727661
mov dword [ebp - 0x1d8], 0x666470
mov eax, ecx
mov esi, 0xb
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1eb], dl
inc ecx
cmp ecx, 0x16
jne 0x42e7dc
mov dword [esp], edi
lea esi, [ebp - 0x1c8]
mov ecx, esi
call fcn.004bfb6c
push ecx
lea edi, [ebp - 0x194]
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0042863c
mov dword [esp], edi
lea esi, [ebp - 0x158]
mov ecx, esi
call fcn.00492540
push edx
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x114]
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.00493b18
lea esi, [ebp - 0x114]
lea ecx, [ebp - 0x240]
mov dword [esp], esi
call fcn.004c41e8
push eax
mov ecx, esi
call fcn.0049259c
mov ecx, ebx
call fcn.0049259c
mov ecx, edi
call fcn.004c0130
lea ecx, [ebp - 0x1c8]
call fcn.004bbce0
mov eax, dword [ebp - 0x240]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wremove]
mov dword [ebp - 0x1c8], 0x7178533d
mov ecx, 0x12
lea ebx, [ebp - 0x1c8]
mov dword [ebp - 0x1c4], 0x35686177
mov dword [ebp - 0x1c0], 0x7f6a2735
mov dword [ebp - 0x1bc], 0x6b236079
mov word [ebp - 0x1b8], 0x7577
mov byte [ebp - 0x1b6], 0
mov eax, ecx
mov esi, 0x13
xor edx, edx
div esi
xor byte [ebp + ecx - 0x1da], dl
inc ecx
cmp ecx, 0x24
jne 0x42e8cb
mov dword [esp], ebx
lea ecx, [ebp - 0x158]
call fcn.004bfb6c
push eax
lea edi, [ebp - 0x114]
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0042863c
lea esi, [ebp - 0x194]
mov dword [esp], esi
call fcn.00429990
lea eax, [ebp - 0x228]
mov dword [esp + 8], edi
mov ebx, edi
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004cff50
mov ecx, esi
call fcn.004c0130
mov ecx, edi
call fcn.004c0130
lea ecx, [ebp - 0x158]
call fcn.004bbce0
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1e0], 0x206f2d
lea ecx, [ebp - 0x1c8]
mov dword [esp], eax
call fcn.004bfb6c
push eax
lea eax, [ebp - 0x1c8]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0042863c
lea edi, [ebp - 0x158]
lea eax, [ebp - 0x258]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.004cff20
lea eax, [ebp - 0x240]
mov dword [esp + 4], edi
mov esi, ebx
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.004cff20
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x258]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.004cff20
mov ecx, ebx
lea ebx, [ebp - 0x1f8]
call fcn.004c0130
mov ecx, edi
call fcn.004c0130
lea ecx, [ebp - 0x194]
call fcn.004c0130
lea ecx, [ebp - 0x1c8]
call fcn.004bbce0
mov dword [esp], 0x4ee202
mov ecx, ebx
call fcn.004c4214
push eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x194]
mov dword [esp], eax
call fcn.0042863c
xor eax, eax
mov dword [esp + 4], ebx
lea ecx, [ebp - 0x194]
mov dword [esp], eax
call fcn.004c1bb0
push esi
mov ecx, edi
push esi
mov esi, edi
mov dword [esp], eax
call fcn.004c41a0
push edi
lea edi, [ebp - 0x114]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004cff20
lea eax, [ebp - 0x1e0]
lea edx, [ebp - 0x210]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.004cff20
mov ecx, edi
mov ebx, edi
call fcn.004c0130
mov ecx, esi
call fcn.004c0130
lea ecx, [ebp - 0x194]
call fcn.004c0130
mov byte [ebp - 0x10c], 0x42
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov al, byte [0x4e8858]
test al, al
jne 0x42eae2
mov dword [esp], 0x4e8858
call fcn.004d5a00
test eax, eax
je 0x42eae2
mov dword [esp], edi
mov ecx, 0x4edaa0
call fcn.0043167c
push ecx
mov dword [esp], 0x4d668c
call fcn.004013f0
mov dword [esp], 0x4e8858
call fcn.004d5ad0
mov ecx, 0x4edaa0
call fcn.0043164c
mov dword [esp], 0x4edaa0
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e86d0]
test al, al
jne 0x42eb52
mov dword [esp], 0x4e86d0
call fcn.004d5a00
test eax, eax
je 0x42eb52
mov dword [esp], ebx
mov ecx, 0x4ed70c
call fcn.0043167c
push edx
mov dword [esp], 0x4d6690
call fcn.004013f0
mov dword [esp], 0x4e86d0
call fcn.004d5ad0
mov ecx, 0x4ed70c
call fcn.0043164c
mov dword [esp], 0x4ed70c
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8720]
test al, al
jne 0x42ebc2
mov dword [esp], 0x4e8720
call fcn.004d5a00
test eax, eax
je 0x42ebc2
mov dword [esp], ebx
mov ecx, 0x4ed784
call fcn.0043167c
push eax
mov dword [esp], 0x4d6694
call fcn.004013f0
mov dword [esp], 0x4e8720
call fcn.004d5ad0
mov ecx, 0x4ed784
call fcn.0043164c
mov dword [esp], 0x4ed784
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8760]
test al, al
jne 0x42ec32
mov dword [esp], 0x4e8760
call fcn.004d5a00
test eax, eax
je 0x42ec32
mov dword [esp], ebx
mov ecx, 0x4ed828
call fcn.0043167c
push eax
mov dword [esp], 0x4d6698
call fcn.004013f0
mov dword [esp], 0x4e8760
call fcn.004d5ad0
mov ecx, 0x4ed828
call fcn.0043164c
mov dword [esp], 0x4ed828
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e87a0]
test al, al
jne 0x42eca2
mov dword [esp], 0x4e87a0
call fcn.004d5a00
test eax, eax
je 0x42eca2
mov dword [esp], ebx
mov ecx, 0x4ed8c4
call fcn.0043167c
push eax
mov dword [esp], 0x4d669c
call fcn.004013f0
mov dword [esp], 0x4e87a0
call fcn.004d5ad0
mov ecx, 0x4ed8c4
call fcn.0043164c
mov dword [esp], 0x4ed8c4
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e87e0]
test al, al
jne 0x42ed12
mov dword [esp], 0x4e87e0
call fcn.004d5a00
test eax, eax
je 0x42ed12
mov dword [esp], ebx
mov ecx, 0x4ed960
call fcn.0043167c
push eax
mov dword [esp], 0x4d66a0
call fcn.004013f0
mov dword [esp], 0x4e87e0
call fcn.004d5ad0
mov ecx, 0x4ed960
call fcn.0043164c
mov dword [esp], 0x4ed960
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8838]
test al, al
jne 0x42ed82
mov dword [esp], 0x4e8838
call fcn.004d5a00
test eax, eax
je 0x42ed82
mov dword [esp], ebx
mov ecx, 0x4eda20
call fcn.0043167c
push eax
mov dword [esp], 0x4d66a8
call fcn.004013f0
mov dword [esp], 0x4e8838
call fcn.004d5ad0
mov ecx, 0x4eda20
call fcn.0043164c
mov dword [esp], 0x4eda20
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8848]
test al, al
jne 0x42edf2
mov dword [esp], 0x4e8848
call fcn.004d5a00
test eax, eax
je 0x42edf2
mov dword [esp], ebx
mov ecx, 0x4eda38
call fcn.0043167c
push edi
mov dword [esp], 0x4d66ac
call fcn.004013f0
mov dword [esp], 0x4e8848
call fcn.004d5ad0
mov ecx, 0x4eda38
call fcn.0043164c
mov dword [esp], 0x4eda38
call fcn.00424ea0
mov esi, 0x4e7140
mov ecx, 0x3b
mov edi, ebx
mov dword [ebp - 0x158], 0xf990c662
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e8850]
test al, al
jne 0x42ee5f
mov dword [esp], 0x4e8850
call fcn.004d5a00
test eax, eax
je 0x42ee5f
mov dword [esp], ebx
mov ecx, 0x4eda60
call fcn.004315ac
push esi
mov dword [esp], 0x4d66b0
call fcn.004013f0
mov dword [esp], 0x4e8850
call fcn.004d5ad0
mov ecx, 0x4eda60
lea esi, [ebp - 0x158]
call fcn.0043157c
mov dword [esp], 0x4eda60
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x42eeb5
xor eax, eax
mov ecx, 0x11
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1e0]
lea ecx, [ebp - 0x114]
mov dword [esp], eax
call fcn.004c4214
push ecx
mov eax, dword [ebp - 0x228]
lea ecx, [ebp - 0x194]
mov dword [esp], eax
call fcn.004c4214
jmp 0x42ef2c
call esi
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e86d8]
test al, al
jne 0x42ef11
mov dword [esp], 0x4e86d8
call fcn.004d5a00
test eax, eax
je 0x42ef11
mov dword [esp], ebx
mov ecx, 0x4ed718
call fcn.0043167c
push edx
mov dword [esp], 0x4d66bc
call fcn.004013f0
mov dword [esp], 0x4e86d8
call fcn.004d5ad0
mov ecx, 0x4ed718
call fcn.0043164c
mov dword [esp], 0x4ed718
call fcn.00424ea0
jmp 0x42ee7f
push eax
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x194]
call fcn.0042ac34
lea ecx, [ebp - 0x194]
lea ebx, [ebp - 0x114]
mov dword [ebp - 0x26c], eax
call fcn.004c0130
mov ecx, ebx
call fcn.004c0130
mov byte [ebp - 0x10c], 0x42
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov al, byte [0x4e86e0]
test al, al
jne 0x42efb6
mov dword [esp], 0x4e86e0
call fcn.004d5a00
test eax, eax
je 0x42efb6
mov dword [esp], ebx
mov ecx, 0x4ed724
call fcn.0043167c
push eax
mov dword [esp], 0x4d66c0
call fcn.004013f0
mov dword [esp], 0x4e86e0
call fcn.004d5ad0
mov ecx, 0x4ed724
call fcn.0043164c
mov dword [esp], 0x4ed724
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e86e8]
test al, al
jne 0x42f026
mov dword [esp], 0x4e86e8
call fcn.004d5a00
test eax, eax
je 0x42f026
mov dword [esp], ebx
mov ecx, 0x4ed730
call fcn.0043167c
push eax
mov dword [esp], 0x4d66c4
call fcn.004013f0
mov dword [esp], 0x4e86e8
call fcn.004d5ad0
mov ecx, 0x4ed730
call fcn.0043164c
mov dword [esp], 0x4ed730
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e86f0]
test al, al
jne 0x42f096
mov dword [esp], 0x4e86f0
call fcn.004d5a00
test eax, eax
je 0x42f096
mov dword [esp], ebx
mov ecx, 0x4ed73c
call fcn.0043167c
push eax
mov dword [esp], 0x4d66c8
call fcn.004013f0
mov dword [esp], 0x4e86f0
call fcn.004d5ad0
mov ecx, 0x4ed73c
call fcn.0043164c
mov dword [esp], 0x4ed73c
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e86f8]
test al, al
jne 0x42f106
mov dword [esp], 0x4e86f8
call fcn.004d5a00
test eax, eax
je 0x42f106
mov dword [esp], ebx
mov ecx, 0x4ed748
call fcn.0043167c
push eax
mov dword [esp], 0x4d66d0
call fcn.004013f0
mov dword [esp], 0x4e86f8
call fcn.004d5ad0
mov ecx, 0x4ed748
call fcn.0043164c
mov dword [esp], 0x4ed748
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8700]
test al, al
jne 0x42f176
mov dword [esp], 0x4e8700
call fcn.004d5a00
test eax, eax
je 0x42f176
mov dword [esp], ebx
mov ecx, 0x4ed754
call fcn.0043167c
push edi
mov dword [esp], 0x4d66d4
call fcn.004013f0
mov dword [esp], 0x4e8700
call fcn.004d5ad0
mov ecx, 0x4ed754
call fcn.0043164c
mov dword [esp], 0x4ed754
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8708]
test al, al
jne 0x42f1e6
mov dword [esp], 0x4e8708
call fcn.004d5a00
test eax, eax
je 0x42f1e6
mov dword [esp], ebx
mov ecx, 0x4ed760
call fcn.0043167c
push esi
mov dword [esp], 0x4d66d8
call fcn.004013f0
mov dword [esp], 0x4e8708
call fcn.004d5ad0
mov ecx, 0x4ed760
call fcn.0043164c
mov dword [esp], 0x4ed760
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8710]
test al, al
jne 0x42f256
mov dword [esp], 0x4e8710
call fcn.004d5a00
test eax, eax
je 0x42f256
mov dword [esp], ebx
mov ecx, 0x4ed76c
call fcn.0043167c
push ecx
mov dword [esp], 0x4d66dc
call fcn.004013f0
mov dword [esp], 0x4e8710
call fcn.004d5ad0
mov ecx, 0x4ed76c
call fcn.0043164c
mov dword [esp], 0x4ed76c
call fcn.00424ea0
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8718]
test al, al
jne 0x42f2c6
mov dword [esp], 0x4e8718
call fcn.004d5a00
test eax, eax
je 0x42f2c6
mov dword [esp], ebx
mov ecx, 0x4ed778
call fcn.0043167c
push edx
mov dword [esp], 0x4d66e0
call fcn.004013f0
mov dword [esp], 0x4e8718
call fcn.004d5ad0
mov ecx, 0x4ed778
call fcn.0043164c
mov dword [esp], 0x4ed778
call fcn.00424ea0
mov esi, 0x4e7140
mov ecx, 0x3b
mov edi, ebx
mov dword [ebp - 0x194], 0xda0ce66
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e8728]
test al, al
jne 0x42f333
mov dword [esp], 0x4e8728
call fcn.004d5a00
test eax, eax
je 0x42f333
mov dword [esp], ebx
mov ecx, 0x4ed7a0
call fcn.004315ac
push eax
mov dword [esp], 0x4d66e4
call fcn.004013f0
mov dword [esp], 0x4e8728
call fcn.004d5ad0
mov ecx, 0x4ed7a0
lea esi, [ebp - 0x194]
call fcn.0043157c
mov dword [esp], 0x4ed7a0
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x42f397
mov dword [esp + 4], 0xc
mov eax, dword [ebp - 0x240]
mov ecx, ebx
mov dword [esp], eax
call fcn.004abed0
push eax
push eax
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8738]
test al, al
jne 0x42f444
jmp 0x42f40e
call esi
mov dword [ebp - 0x114], 0xc1eb1542
mov dword [ebp - 0x110], 0x7c90ec48
mov byte [ebp - 0x10c], 0x42
mov al, byte [0x4e8730]
test al, al
jne 0x42f3f3
mov dword [esp], 0x4e8730
call fcn.004d5a00
test eax, eax
je 0x42f3f3
mov dword [esp], ebx
mov ecx, 0x4ed7e0
call fcn.0043167c
push eax
mov dword [esp], 0x4d66f0
call fcn.004013f0
mov dword [esp], 0x4e8730
call fcn.004d5ad0
mov ecx, 0x4ed7e0
call fcn.0043164c
mov dword [esp], 0x4ed7e0
call fcn.00424ea0
jmp 0x42f353
mov dword [esp], 0x4e8738
call fcn.004d5a00
test eax, eax
je 0x42f444
mov dword [esp], esi
mov ecx, 0x4ed7ec
call fcn.0043167c
push eax
mov dword [esp], 0x4d66f8
call fcn.004013f0
mov dword [esp], 0x4e8738
call fcn.004d5ad0
mov ecx, 0x4ed7ec
call fcn.0043164c
mov dword [esp], 0x4ed7ec
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8740]
test al, al
jne 0x42f4b4
mov dword [esp], 0x4e8740
call fcn.004d5a00
test eax, eax
je 0x42f4b4
mov dword [esp], esi
mov ecx, 0x4ed7f8
call fcn.0043167c
push eax
mov dword [esp], 0x4d66fc
call fcn.004013f0
mov dword [esp], 0x4e8740
call fcn.004d5ad0
mov ecx, 0x4ed7f8
call fcn.0043164c
mov dword [esp], 0x4ed7f8
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8748]
test al, al
jne 0x42f524
mov dword [esp], 0x4e8748
call fcn.004d5a00
test eax, eax
je 0x42f524
mov dword [esp], esi
mov ecx, 0x4ed804
call fcn.0043167c
push edi
mov dword [esp], 0x4d6700
call fcn.004013f0
mov dword [esp], 0x4e8748
call fcn.004d5ad0
mov ecx, 0x4ed804
call fcn.0043164c
mov dword [esp], 0x4ed804
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8750]
test al, al
jne 0x42f594
mov dword [esp], 0x4e8750
call fcn.004d5a00
test eax, eax
je 0x42f594
mov dword [esp], esi
mov ecx, 0x4ed810
call fcn.0043167c
push ebx
mov dword [esp], 0x4d6704
call fcn.004013f0
mov dword [esp], 0x4e8750
call fcn.004d5ad0
mov ecx, 0x4ed810
call fcn.0043164c
mov dword [esp], 0x4ed810
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8758]
test al, al
jne 0x42f604
mov dword [esp], 0x4e8758
call fcn.004d5a00
test eax, eax
je 0x42f604
mov dword [esp], esi
mov ecx, 0x4ed81c
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6708
call fcn.004013f0
mov dword [esp], 0x4e8758
call fcn.004d5ad0
mov ecx, 0x4ed81c
call fcn.0043164c
mov dword [esp], 0x4ed81c
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8768]
test al, al
jne 0x42f674
mov dword [esp], 0x4e8768
call fcn.004d5a00
test eax, eax
je 0x42f674
mov dword [esp], esi
mov ecx, 0x4ed834
call fcn.0043167c
push edx
mov dword [esp], 0x4d670c
call fcn.004013f0
mov dword [esp], 0x4e8768
call fcn.004d5ad0
mov ecx, 0x4ed834
call fcn.0043164c
mov dword [esp], 0x4ed834
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8770]
test al, al
jne 0x42f6e4
mov dword [esp], 0x4e8770
call fcn.004d5a00
test eax, eax
je 0x42f6e4
mov dword [esp], esi
mov ecx, 0x4ed840
call fcn.0043167c
push eax
mov dword [esp], 0x4d6710
call fcn.004013f0
mov dword [esp], 0x4e8770
call fcn.004d5ad0
mov ecx, 0x4ed840
call fcn.0043164c
mov dword [esp], 0x4ed840
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8778]
test al, al
jne 0x42f754
mov dword [esp], 0x4e8778
call fcn.004d5a00
test eax, eax
je 0x42f754
mov dword [esp], esi
mov ecx, 0x4ed84c
call fcn.0043167c
push eax
mov dword [esp], 0x4d6714
call fcn.004013f0
mov dword [esp], 0x4e8778
call fcn.004d5ad0
mov ecx, 0x4ed84c
call fcn.0043164c
mov dword [esp], 0x4ed84c
call fcn.00424ea0
lea edi, [ebp - 0x194]
mov esi, 0x4e7140
mov ecx, 0x3b
mov dword [ebp - 0x1c8], 0x21b0d66a
rep movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x194]
mov al, byte [0x4e8780]
test al, al
jne 0x42f7cb
mov dword [esp], 0x4e8780
call fcn.004d5a00
test eax, eax
je 0x42f7cb
mov dword [esp], ebx
mov ecx, 0x4ed860
call fcn.004315ac
push eax
mov dword [esp], 0x4d6718
call fcn.004013f0
mov dword [esp], 0x4e8780
call fcn.004d5ad0
mov ecx, 0x4ed860
call fcn.0043157c
mov dword [esp], 0x4ed860
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x42f801
test byte [ebp - 0x8c], 5
je 0x42f8a2
cmp dword [ebp - 0x26c], 0
jne 0x42f8a2
jmp 0x42f87e
lea eax, [ebp - 0x1c8]
call eax
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8788]
test al, al
jne 0x42f863
mov dword [esp], 0x4e8788
call fcn.004d5a00
test eax, eax
je 0x42f863
mov dword [esp], ebx
mov ecx, 0x4ed8a0
call fcn.0043167c
push eax
mov dword [esp], 0x4d6728
call fcn.004013f0
mov dword [esp], 0x4e8788
call fcn.004d5ad0
mov ecx, 0x4ed8a0
call fcn.0043164c
mov dword [esp], 0x4ed8a0
call fcn.00424ea0
jmp 0x42f7e5
mov eax, dword [ebp + 0xc]
mov ecx, ebx
mov dword [esp], eax
call fcn.004bfa90
push eax
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042e758
mov ecx, ebx
jmp 0x430204
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8790]
test al, al
jne 0x42f8fc
mov dword [esp], 0x4e8790
call fcn.004d5a00
test eax, eax
je 0x42f8fc
mov dword [esp], ebx
mov ecx, 0x4ed8ac
call fcn.0043167c
push edi
mov dword [esp], 0x4d672c
call fcn.004013f0
mov dword [esp], 0x4e8790
call fcn.004d5ad0
mov ecx, 0x4ed8ac
call fcn.0043164c
mov dword [esp], 0x4ed8ac
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8798]
test al, al
jne 0x42f96c
mov dword [esp], 0x4e8798
call fcn.004d5a00
test eax, eax
je 0x42f96c
mov dword [esp], ebx
mov ecx, 0x4ed8b8
call fcn.0043167c
push esi
mov dword [esp], 0x4d6730
call fcn.004013f0
mov dword [esp], 0x4e8798
call fcn.004d5ad0
mov ecx, 0x4ed8b8
call fcn.0043164c
mov dword [esp], 0x4ed8b8
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87a8]
test al, al
jne 0x42f9dc
mov dword [esp], 0x4e87a8
call fcn.004d5a00
test eax, eax
je 0x42f9dc
mov dword [esp], ebx
mov ecx, 0x4ed8d0
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6734
call fcn.004013f0
mov dword [esp], 0x4e87a8
call fcn.004d5ad0
mov ecx, 0x4ed8d0
call fcn.0043164c
mov dword [esp], 0x4ed8d0
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87b0]
test al, al
jne 0x42fa4c
mov dword [esp], 0x4e87b0
call fcn.004d5a00
test eax, eax
je 0x42fa4c
mov dword [esp], ebx
mov ecx, 0x4ed8dc
call fcn.0043167c
push edx
mov dword [esp], 0x4d6738
call fcn.004013f0
mov dword [esp], 0x4e87b0
call fcn.004d5ad0
mov ecx, 0x4ed8dc
call fcn.0043164c
mov dword [esp], 0x4ed8dc
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87b8]
test al, al
jne 0x42fabc
mov dword [esp], 0x4e87b8
call fcn.004d5a00
test eax, eax
je 0x42fabc
mov dword [esp], ebx
mov ecx, 0x4ed8e8
call fcn.0043167c
push eax
mov dword [esp], 0x4d673c
call fcn.004013f0
mov dword [esp], 0x4e87b8
call fcn.004d5ad0
mov ecx, 0x4ed8e8
call fcn.0043164c
mov dword [esp], 0x4ed8e8
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87c0]
test al, al
jne 0x42fb2c
mov dword [esp], 0x4e87c0
call fcn.004d5a00
test eax, eax
je 0x42fb2c
mov dword [esp], ebx
mov ecx, 0x4ed8f4
call fcn.0043167c
push eax
mov dword [esp], 0x4d6740
call fcn.004013f0
mov dword [esp], 0x4e87c0
call fcn.004d5ad0
mov ecx, 0x4ed8f4
call fcn.0043164c
mov dword [esp], 0x4ed8f4
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87c8]
test al, al
jne 0x42fb9c
mov dword [esp], 0x4e87c8
call fcn.004d5a00
test eax, eax
je 0x42fb9c
mov dword [esp], ebx
mov ecx, 0x4ed900
call fcn.0043167c
push eax
mov dword [esp], 0x4d6744
call fcn.004013f0
mov dword [esp], 0x4e87c8
call fcn.004d5ad0
mov ecx, 0x4ed900
call fcn.0043164c
mov dword [esp], 0x4ed900
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87d0]
test al, al
jne 0x42fc0c
mov dword [esp], 0x4e87d0
call fcn.004d5a00
test eax, eax
je 0x42fc0c
mov dword [esp], ebx
mov ecx, 0x4ed90c
call fcn.0043167c
push eax
mov dword [esp], 0x4d6754
call fcn.004013f0
mov dword [esp], 0x4e87d0
call fcn.004d5ad0
mov ecx, 0x4ed90c
call fcn.0043164c
mov dword [esp], 0x4ed90c
call fcn.00424ea0
mov esi, 0x4e7140
mov ecx, 0x3b
mov edi, ebx
mov dword [ebp - 0x1c8], 0x35c0de6e
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e87d8]
test al, al
jne 0x42fc79
mov dword [esp], 0x4e87d8
call fcn.004d5a00
test eax, eax
je 0x42fc79
mov dword [esp], ebx
mov ecx, 0x4ed920
call fcn.004315ac
push eax
mov dword [esp], 0x4d6758
call fcn.004013f0
mov dword [esp], 0x4e87d8
call fcn.004d5ad0
mov ecx, 0x4ed920
call fcn.0043157c
mov dword [esp], 0x4ed920
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x42fcb8
lea eax, [ebp - 0x240]
mov ecx, ebx
mov dword [esp], eax
call fcn.004c41e8
push edi
lea eax, [ebp - 0x1c8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00431084
jmp 0x42fd35
lea eax, [ebp - 0x1c8]
call eax
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87e8]
test al, al
jne 0x42fd1a
mov dword [esp], 0x4e87e8
call fcn.004d5a00
test eax, eax
je 0x42fd1a
mov dword [esp], ebx
mov ecx, 0x4ed96c
call fcn.0043167c
push esi
mov dword [esp], 0x4d6764
call fcn.004013f0
mov dword [esp], 0x4e87e8
call fcn.004d5ad0
mov ecx, 0x4ed96c
call fcn.0043164c
mov dword [esp], 0x4ed96c
call fcn.00424ea0
jmp 0x42fc93
mov ecx, ebx
call fcn.004c0130
mov byte [ebp - 0x18c], 0x42
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov al, byte [0x4e87f0]
test al, al
jne 0x42fd96
mov dword [esp], 0x4e87f0
call fcn.004d5a00
test eax, eax
je 0x42fd96
mov dword [esp], ebx
mov ecx, 0x4ed978
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6768
call fcn.004013f0
mov dword [esp], 0x4e87f0
call fcn.004d5ad0
mov ecx, 0x4ed978
call fcn.0043164c
mov dword [esp], 0x4ed978
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e87f8]
test al, al
jne 0x42fe06
mov dword [esp], 0x4e87f8
call fcn.004d5a00
test eax, eax
je 0x42fe06
mov dword [esp], ebx
mov ecx, 0x4ed984
call fcn.0043167c
push edx
mov dword [esp], 0x4d676c
call fcn.004013f0
mov dword [esp], 0x4e87f8
call fcn.004d5ad0
mov ecx, 0x4ed984
call fcn.0043164c
mov dword [esp], 0x4ed984
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8800]
test al, al
jne 0x42fe76
mov dword [esp], 0x4e8800
call fcn.004d5a00
test eax, eax
je 0x42fe76
mov dword [esp], ebx
mov ecx, 0x4ed990
call fcn.0043167c
push eax
mov dword [esp], 0x4d6770
call fcn.004013f0
mov dword [esp], 0x4e8800
call fcn.004d5ad0
mov ecx, 0x4ed990
call fcn.0043164c
mov dword [esp], 0x4ed990
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
lea ebx, [ebp - 0x194]
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8808]
test al, al
jne 0x42feec
mov dword [esp], 0x4e8808
call fcn.004d5a00
test eax, eax
je 0x42feec
mov dword [esp], ebx
mov ecx, 0x4ed99c
call fcn.0043167c
push eax
mov dword [esp], 0x4d6774
call fcn.004013f0
mov dword [esp], 0x4e8808
call fcn.004d5ad0
mov ecx, 0x4ed99c
call fcn.0043164c
mov dword [esp], 0x4ed99c
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8810]
test al, al
jne 0x42ff5c
mov dword [esp], 0x4e8810
call fcn.004d5a00
test eax, eax
je 0x42ff5c
mov dword [esp], ebx
mov ecx, 0x4ed9a8
call fcn.0043167c
push eax
mov dword [esp], 0x4d6778
call fcn.004013f0
mov dword [esp], 0x4e8810
call fcn.004d5ad0
mov ecx, 0x4ed9a8
call fcn.0043164c
mov dword [esp], 0x4ed9a8
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8818]
test al, al
jne 0x42ffcc
mov dword [esp], 0x4e8818
call fcn.004d5a00
test eax, eax
je 0x42ffcc
mov dword [esp], ebx
mov ecx, 0x4ed9b4
call fcn.0043167c
push eax
mov dword [esp], 0x4d677c
call fcn.004013f0
mov dword [esp], 0x4e8818
call fcn.004d5ad0
mov ecx, 0x4ed9b4
call fcn.0043164c
mov dword [esp], 0x4ed9b4
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8820]
test al, al
jne 0x43003c
mov dword [esp], 0x4e8820
call fcn.004d5a00
test eax, eax
je 0x43003c
mov dword [esp], ebx
mov ecx, 0x4ed9c0
call fcn.0043167c
push eax
mov dword [esp], 0x4d6780
call fcn.004013f0
mov dword [esp], 0x4e8820
call fcn.004d5ad0
mov ecx, 0x4ed9c0
call fcn.0043164c
mov dword [esp], 0x4ed9c0
call fcn.00424ea0
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8828]
test al, al
jne 0x4300ac
mov dword [esp], 0x4e8828
call fcn.004d5a00
test eax, eax
je 0x4300ac
mov dword [esp], ebx
mov ecx, 0x4ed9cc
call fcn.0043167c
push edi
mov dword [esp], 0x4d6784
call fcn.004013f0
mov dword [esp], 0x4e8828
call fcn.004d5ad0
mov ecx, 0x4ed9cc
call fcn.0043164c
mov dword [esp], 0x4ed9cc
call fcn.00424ea0
mov esi, 0x4e7140
mov ecx, 0x3b
mov edi, ebx
mov dword [ebp - 0x25c], 0x49d0e672
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e8830]
test al, al
jne 0x430119
mov dword [esp], 0x4e8830
call fcn.004d5a00
test eax, eax
je 0x430119
mov dword [esp], ebx
mov ecx, 0x4ed9e0
call fcn.004315ac
push esi
mov dword [esp], 0x4d6788
call fcn.004013f0
mov dword [esp], 0x4e8830
call fcn.004d5ad0
mov ecx, 0x4ed9e0
call fcn.0043157c
mov dword [esp], 0x4ed9e0
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x430157
cmp dword [ebp - 0x1c4], 1
jbe 0x4301d4
lea eax, [ebp - 0x1c8]
mov dword [esp], eax
mov ecx, dword [ebp + 8]
call fcn.004bf9e0
push edx
jmp 0x4301fe
lea eax, [ebp - 0x25c]
call eax
mov dword [ebp - 0x194], 0xc1eb1542
mov dword [ebp - 0x190], 0x7c90ec48
mov byte [ebp - 0x18c], 0x42
mov al, byte [0x4e8840]
test al, al
jne 0x4301b9
mov dword [esp], 0x4e8840
call fcn.004d5a00
test eax, eax
je 0x4301b9
mov dword [esp], ebx
mov ecx, 0x4eda2c
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6794
call fcn.004013f0
mov dword [esp], 0x4e8840
call fcn.004d5ad0
mov ecx, 0x4eda2c
call fcn.0043164c
mov dword [esp], 0x4eda2c
call fcn.00424ea0
jmp 0x430133
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x194]
mov ecx, esi
mov dword [esp], eax
call fcn.004bfa90
push eax
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042e758
mov ecx, esi
call fcn.004bbce0
lea ecx, [ebp - 0x1c8]
call fcn.004bbce0
lea ecx, [ebp - 0x114]
call fcn.004ac6e0
lea ecx, [ebp - 0x1e0]
call fcn.004c0130
lea ecx, [ebp - 0x1f8]
call fcn.004c0130
lea ecx, [ebp - 0x210]
call fcn.004c0130
lea ecx, [ebp - 0x228]
call fcn.004c0130
lea ecx, [ebp - 0x240]
call fcn.004c0130
lea ecx, [ebp - 0x258]
call fcn.004c0130
lea ecx, [ebp - 0x1b0]
call fcn.0049259c
mov eax, dword [ebp + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret