Function at 0x471590
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9678
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4e5c64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4ea74c], 0
jne 0x4715cb
push 0
call fcn.0046f500
add esp, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x4718a8
push 0x4d2cd4
push eax
call fcn.0049dc91
add esp, 8
test eax, eax
je 0x4718a8
mov ecx, dword [ebx]
sub eax, ecx
sar eax, 1
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x4718a8
mov eax, dword [ecx - 0xc]
lea esi, [edi + 2]
test esi, esi
jl 0x4718a8
cmp esi, eax
jg 0x4718a8
lea eax, [ecx + esi*2]
push 0x4d2cd4
push eax
call fcn.0049dc91
add esp, 8
test eax, eax
je 0x4718a8
sub eax, dword [ebx]
sar eax, 1
cmp eax, 0xffffffff
je 0x4718a8
sub eax, edi
mov dword [ebp - 0x20], eax
add eax, 0xfffffffe
push eax
push esi
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call fcn.00427d8c
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], 0
je 0x471882
call fcn.0048f565
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x471961
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, 0x4c4fbc
mov byte [ebp - 4], 1
test ecx, 0xffff0000
jne 0x47183f
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.00497482
mov edi, eax
test edi, edi
je 0x471760
mov eax, ebx
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x471760
push ebx
push eax
push edi
call fcn.00421708
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x471760
movzx edi, word [ebx]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x471702
push edi
lea ecx, [ebp - 0x10]
call fcn.00421527
mov esi, dword [ebp - 0x10]
movzx eax, word [ebx]
add ebx, 2
mov dword [ebp - 0x1c], ebx
cmp eax, 0xffffffff
jne 0x47171a
push ebx
call fcn.0049db0a
add esp, 4
inc eax
lea edx, [eax + eax]
mov eax, dword [ebp - 0x1c]
push edx
push eax
lea ebx, [edi + edi]
push ebx
push esi
call fcn.0049d600
add esp, 0x10
cmp eax, 0x50
ja case.0x47173f.1
movzx ecx, byte [eax + 0x471990]
jmp dword [ecx*4 + 0x471980]
test edi, edi
jl 0x471975
cmp edi, dword [esi - 8]
jg 0x471975
xor edx, edx
mov dword [esi - 0xc], edi
mov word [ebx + esi], dx
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x47178e
push 0x514
lea ecx, [ebp - 0x10]
call fcn.00421527
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0x514
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0049daeb
add esp, 8
test eax, eax
jl 0x471975
cmp eax, dword [esi - 8]
jg 0x471975
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [ebp - 0x1c], ecx
je 0x471862
cmp dword [esi - 0xc], ecx
je 0x471862
mov eax, dword [ebp - 0x20]
push edi
add eax, 2
push ebx
call fcn.004234d9
push esi
push ebx
mov eax, edi
call fcn.004303d1
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x471810
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4715cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4715cb
push 0x4c4fbc
call fcn.0049db0a
add esp, 4
push eax
push 0x4c4fbc
lea ecx, [ebp - 0x10]
call fcn.00423f19
mov esi, dword [ebp - 0x10]
jmp 0x471766
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471882
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4718a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jle 0x471914
push 0x25
push eax
call fcn.0049e35a
add esp, 8
test eax, eax
je 0x471914
sub eax, dword [ebx]
sar eax, 1
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x471914
mov dword [ebp - 0x10], 0
mov esi, 0x4e7238
mov edx, dword [esi]
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4718e0
mov ecx, dword [ebx]
sub eax, edi
mov edi, dword [ebp - 0x14]
sar eax, 1
push eax
push edx
lea ecx, [ecx + edi*2]
push ecx
call fcn.0049e6c5
add esp, 0xc
test eax, eax
je 0x471926
inc dword [ebp - 0x10]
add esi, 0x10
cmp esi, 0x4e7458
jl 0x4718d7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl eax, 4
mov esi, eax
mov eax, dword [esi + 0x4e7238]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x471937
sub eax, edx
push edi
sar eax, 1
push ebx
call fcn.004234d9
mov edx, dword [esi + 0x4e7244]
push edx
push ebx
mov eax, edi
call fcn.004303d1
jmp 0x4715cb
push 0x80004005
call fcn.00421000
call fcn.0048facd
call fcn.0048fb05
push 0x80070057
call fcn.00421000
nop
inc esi
pop ss
inc edi
add byte [ebx + 0x19], ch
inc edi
add byte [eax + 0x19], dh
inc edi
add byte [eax + 0x19], dh
inc edi
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3