Function at 0x490420
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c83e2
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push 0x63
push 0x50eb68
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x68], esi
call fcn.0040d5d0
mov eax, 0x50eb68
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490470
sub eax, edx
lea eax, [eax + 0x50eb67]
cmp eax, 0x50eb68
jb 0x49049f
mov cl, byte [eax]
cmp cl, 0x2f
je 0x49049c
cmp cl, 0x5c
je 0x49049c
dec eax
cmp eax, 0x50eb68
jae 0x490486
jmp 0x49049f
mov byte [eax], 0
mov ecx, dword [esi]
call fcn.0048dca0
cmp byte [0x50eb68], 0
je 0x4905e4
push str.PATH
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4904c6
sub eax, edx
mov edx, eax
mov eax, 0x50eb68
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4904e0
sub eax, edi
lea ecx, [eax + edx + 2]
push ecx
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, eax
mov edx, ebx
add esp, 4
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x490500
lea edi, [ebx - 1]
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x490510
mov dx, word [0x4e5f44]
mov eax, 0x50eb68
mov word [edi], dx
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490530
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x490540
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCR100.dll__putenv]
push ebx
call dword [sym.imp.MSVCR100.dll_free]
push str.PATH
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 0xc
xor eax, eax
jmp 0x490580
mov cl, byte [eax + 0x50eb68]
mov byte [eax + 0x50f098], cl
inc eax
test cl, cl
jne 0x490580
mov eax, 0x50f098
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4905a0
sub eax, edx
lea eax, [eax + 0x50f098]
nop
dec eax
cmp eax, 0x50f098
jb 0x4905ca
mov cl, byte [eax]
cmp cl, 0x2f
je 0x4905c4
cmp cl, 0x5c
jne 0x4905b0
mov byte [eax + 1], 0
jmp 0x4905ee
mov ax, word [0x4e672c]
mov cl, byte [0x4e672e]
mov word [0x50f098], ax
mov byte [0x50f09a], cl
jmp 0x4905ee
mov dword [0x50f098], 0x5c2e2e
call fcn.0048d5b0
xor edi, edi
xor edx, edx
cmp dword [ebp + 8], 2
mov eax, 1
mov dword [0x50eae8], edi
mov word [0x50eff4], dx
mov word [0x50f03c], ax
jne 0x49066c
mov ecx, dword [ebp - 0x68]
mov esi, dword [ecx + 4]
mov ecx, str._autologin
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49064b
cmp dx, di
je 0x490644
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49064b
add eax, 4
add ecx, 4
cmp dx, di
jne 0x490622
xor eax, eax
or ebx, 0xffffffff
jmp 0x490654
sbb eax, eax
mov ebx, 0xffffffff
sbb eax, ebx
cmp eax, edi
jne 0x49065f
call fcn.0041de10
jmp 0x49067e
push esi
push 1
call fcn.004901c0
add esp, 8
jmp 0x49067e
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
push eax
push edi
call fcn.004901c0
add esp, 8
or ebx, 0xffffffff
push 0x4fabe8
lea ecx, [ebp - 0x64]
call fcn.0040d600
mov eax, dword [0x4fac14]
mov dword [ebp - 4], edi
cmp eax, 0x3e7
je 0x4906c3
cmp eax, 0x3e6
je 0x4906c3
cmp eax, 0x3e5
je 0x4906c3
lea ecx, [ebp - 0x64]
call fcn.0040d4d0
mov edx, 0x50ecf8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4906b7
jmp 0x490729
mov al, byte [0x50f19c]
lea ecx, [ebp - 0x60]
test al, al
je 0x4906eb
mov edx, 0x50f19c
mov esi, ecx
sub edx, esi
cmp al, 0x2f
je 0x4906eb
cmp al, 0x5c
je 0x4906eb
mov byte [ecx], al
mov al, byte [edx + ecx + 1]
inc ecx
test al, al
jne 0x4906d8
mov byte [ecx], 0
push 0x5120ec
lea ecx, [ebp - 0x64]
call fcn.0040d4d0
push eax
lea ecx, [ebp - 0x60]
push ecx
push str._s____s__s
push 0x50ecf8
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
cmp byte [0x50f19c], 0
je 0x490729
push 0x50f19c
call fcn.00444110
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call esi
mov dword [0x50eb64], eax
cmp eax, edi
je 0x49075c
push edi
push edi
push 1
push edi
call esi
mov dword [0x50ed78], eax
cmp eax, edi
jne 0x490783
mov edx, dword [0x50eb64]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.0040d440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
push edi
push 1
push 1
push edi
call esi
mov dword [0x50ea54], eax
cmp eax, edi
jne 0x4907ad
mov eax, dword [0x50eb64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [0x50ed78]
push ecx
call esi
jmp 0x49075c
call fcn.0040fb10
mov eax, dword [0x5096e0]
cmp eax, edi
je 0x490862
cmp dword [eax + 0x68], edi
je 0x490862
mov edx, dword [eax + 0x68]
push edi
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4d0
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 1
cmp eax, edi
je 0x4907f4
mov ecx, eax
call fcn.0047dac0
jmp 0x4907f6
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x5120e4], eax
cmp eax, edi
je 0x490841
mov ecx, eax
call fcn.0047e420
test eax, eax
je 0x490841
mov eax, dword [0x5120e4]
mov ecx, dword [eax + 0x20]
mov dword [0x50f02c], ecx
call fcn.0048c550
mov edx, dword [0x5120e4]
mov eax, dword [edx + 0x20]
push edi
push 0x803c
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x49075c
mov ecx, dword [0x501860]
push 0x30
push 0x4fabe8
push str.ERROR:_Could_not_create_terminal_window_
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.MSVCR100.dll_exit]
mov edx, dword [0x501860]
push 0x30
push 0x4fabe8
push str.ERROR:_Could_not_initialise_display_interface_
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.MSVCR100.dll_exit]
int3