Function at 0x428410
Capabilities:
Query environment variable
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b83b9
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x4e54c0]
xor eax, esp
mov dword [esp + 0x36c], eax
push esi
push edi
mov eax, dword [0x4e54c0]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x4ebbb8], 0
jne 0x428594
test edi, edi
je 0x428594
cmp word [edi], 0
jne 0x428470
xor ecx, ecx
jmp 0x428482
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428473
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, 0x4e6b14
call fcn.00403740
mov ecx, edi
mov dword [0x4ebfc4], 0x428080
mov dword [0x4ebfc8], 0x428350
call fcn.00430eb0
push 0x20
push 0x4d2e60
push edi
call fcn.00492299
mov esi, eax
add esp, 0xc
mov dword [0x4ebbb8], esi
test esi, esi
je 0x428594
push 0x7f
lea eax, [esp + 0x2f9]
mov dword [0x4ebbbc], 0x64
push 0
push eax
mov dword [0x4ebbb4], 0
mov byte [esp + 0x300], 0
call fcn.00491b10
add esp, 0xc
lea eax, [esp + 0x2f4]
push esi
push 0x80
push 1
push eax
call fcn.004947c2
add esp, 0x10
test eax, eax
je 0x4285e0
push 0
push eax
lea eax, [esp + 0x2fc]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4285b9
push 2
push 0
push dword [0x4ebbb8]
call fcn.00499109
add esp, 0xc
push dword [0x4ebbb8]
call fcn.00494e7c
add esp, 4
mov esi, eax
push dword [0x4ebbb8]
call fcn.00494f54
add esp, 4
mov dword [0x4ebbb8], 0
cmp esi, 0xa00000
jl 0x42857b
mov ecx, edi
call fcn.00430cb0
push 0x20
push 0x4d2e60
push edi
call fcn.00492299
add esp, 0xc
mov dword [0x4ebbb8], eax
test eax, eax
jne 0x4285e0
xor eax, eax
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x36c]
xor ecx, esp
call fcn.004906bc
mov esp, ebp
pop ebp
ret
push dword [0x4ebbb8]
call fcn.00494f54
add esp, 4
push 0x20
push 0x4d2ebc
push edi
call fcn.00492299
add esp, 0xc
mov dword [0x4ebbb8], eax
test eax, eax
je 0x428594
xor eax, eax
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], 0
mov word [esp + 0x74], ax
mov dword [esp + 0x388], eax
call fcn.00439b00
mov esi, eax
test esi, esi
je 0x42863c
mov edx, dword [esi]
lea eax, [esp + 0x8c]
push eax
mov ecx, esi
call dword [edx + 0x30]
push eax
lea ecx, [esp + 0x78]
call fcn.0040b000
lea ecx, [esp + 0x8c]
call fcn.004032f0
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp dword [esp + 0x88], 8
lea esi, [esp + 0x74]
push str._________________________________
cmovae esi, dword [esp + 0x78]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx eax, word [esp + 0xb2]
push esi
push eax
movzx eax, word [esp + 0xb6]
push eax
movzx eax, word [esp + 0xb8]
push eax
push str._r_n_d__d__d_Version:_s_Process__p___s_r_n
push dword [0x4ebbb8]
call fcn.0049918c
push str.Begin_List_Enviroment_Variables._r_n
push dword [0x4ebbb8]
call fcn.0049918c
add esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
test edi, edi
je 0x4286eb
cmp word [edi], 0
mov esi, edi
je 0x4286e4
lea ebx, [ebx]
push esi
push str._s_r_n
push dword [0x4ebbb8]
call fcn.0049918c
add esp, 0xc
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4286d4
cmp word [esi], ax
jne 0x4286c0
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push str.End_List_Enviroment_Variables._r_n
push dword [0x4ebbb8]
call fcn.0049918c
push str.Process_list:_r_n
push dword [0x4ebbb8]
call fcn.0049918c
add esp, 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00428ef0
mov dword [esp + 0x14], eax
push ecx
lea ecx, [esp + 0xb8]
call fcn.0043a270
lea eax, [esp + 0xc]
mov byte [esp + 0x388], 2
push eax
lea ecx, [esp + 0xb8]
call fcn.0043a340
mov byte [esp + 0x388], 3
mov eax, dword [esp + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x4287b4
nop
lea eax, [esi + 0x2c]
push eax
lea ecx, [esp + 0x40]
call fcn.00403840
mov byte [esp + 0x388], 4
movzx eax, byte [0x4ec190]
push eax
lea eax, [esp + 0x40]
push eax
push ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
call fcn.00428f20
mov byte [esp + 0x388], 3
cmp dword [esp + 0x50], 8
jb 0x4287ac
push dword [esp + 0x3c]
call fcn.0048fa72
add esp, 4
mov esi, dword [esi]
cmp esi, dword [esp + 0xc]
jne 0x428760
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov byte [esp + 0x388], 5
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
cmp esi, eax
je 0x42884d
lea ecx, [ecx]
push 0xffffffffffffffff
lea eax, [esi + 0x10]
push 0
push eax
lea ecx, [esp + 0x30]
call fcn.0040b670
push 1
push 0x4d2820
lea ecx, [esp + 0x2c]
call fcn.0040b040
cmp byte [esi + 0xd], 0
jne 0x428847
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x42882c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x428847
lea ebx, [ebx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x428820
jmp 0x428847
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x428845
cmp esi, dword [eax + 8]
jne 0x428845
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x428835
mov esi, eax
cmp esi, dword [esp + 0x14]
jne 0x4287e0
push 2
push 0x4d2e58
lea ecx, [esp + 0x2c]
call fcn.0040b040
cmp dword [esp + 0x38], 8
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push eax
push dword [0x4ebbb8]
call fcn.0049918c
add esp, 8
cmp dword [esp + 0x38], 8
jb 0x42888d
push dword [esp + 0x24]
call fcn.0048fa72
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov word [esp + 0x24], ax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], 0
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [esp + 0xc]
mov dword [eax + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], 0
cmp ecx, eax
je 0x4288d8
mov esi, dword [ecx]
push ecx
call fcn.0048fa72
mov eax, dword [esp + 0x10]
add esp, 4
mov ecx, esi
cmp esi, eax
jne 0x4288c3
push eax
call fcn.0048fa72
add esp, 4
mov dword [esp + 0xb4], vtable.base::ProcessIterator.0
push dword [esp + 0xb8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x388], 0
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x14]
push eax
push dword [eax]
lea eax, [esp + 0x24]
push eax
call fcn.00428b20
push dword [esp + 0x14]
call fcn.0048fa72
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00415a10
lea ecx, [esp + 0x3c]
push ecx
push ecx
mov ecx, eax
call fcn.00415b40
push dword [esp + 0x54]
lea eax, [esp + 0x90]
push dword [esp + 0x54]
push dword [esp + 0x54]
push str.crash__02d_02d_02d.dmp
push eax
call fcn.00412da0
add esp, 0x14
xor eax, eax
mov byte [esp + 0x388], 6
push 0xffffffffffffffff
push eax
push 0x4e6b14
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
call fcn.004033d0
push 1
push ecx
lea eax, [esp + 0x24]
mov byte [esp + 0x390], 7
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call fcn.004021e0
cmp eax, 0xffffffff
je 0x4289bb
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x2c]
call fcn.00403320
lea eax, [esp + 0x3c]
mov byte [esp + 0x388], 8
push eax
lea ecx, [esp + 0x28]
call fcn.0040a240
lea ecx, [esp + 0x8c]
mov byte [esp + 0x388], 9
push ecx
lea ecx, [esp + 0x60]
push ecx
mov ecx, eax
call fcn.0040a820
cmp dword [esp + 0x50], 8
jb 0x428a00
push dword [esp + 0x3c]
call fcn.0048fa72
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
mov byte [esp + 0x388], 0xc
cmp dword [esp + 0x38], 8
jb 0x428a32
push dword [esp + 0x24]
call fcn.0048fa72
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
cmp dword [esp + 0x70], 8
lea edx, [esp + 0x5c]
mov dword [esp + 0x34], 0
cmovae edx, dword [esp + 0x5c]
mov word [esp + 0x24], ax
cmp word [edx], ax
jne 0x428a60
xor ecx, ecx
jmp 0x428a74
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428a65
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x4e6b8c
call fcn.00403740
push 0x4313f0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
cmp dword [esp + 0x70], 8
jb 0x428a9e
push dword [esp + 0x5c]
call fcn.0048fa72
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
cmp dword [esp + 0xa0], 8
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
jb 0x428ace
push dword [esp + 0x8c]
call fcn.0048fa72
add esp, 4
cmp dword [esp + 0x88], 8
jb 0x428ae4
push dword [esp + 0x74]
call fcn.0048fa72
add esp, 4
mov eax, 1
jmp 0x428596