Function at 0x482aa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c3b14
mov eax, dword fs:[0]
push eax
sub esp, 0x544
mov eax, dword [0x4eb6b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x4b0], ebx
mov edi, 0xf
mov dword [ebp - 0x4a0], edx
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x454], ebx
mov byte [ebp - 0x464], bl
mov dword [ebp - 4], 1
xor eax, eax
cmp eax, str._tmp_
jne 0x482b52
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x482b06
sub eax, esi
cmp eax, ebx
jne 0x482b52
mov esi, dword [ebp - 0x4a0]
mov dword [edx + 0x14], edi
mov dword [edx + 0x10], ebx
lea edi, [ebp - 0x464]
mov byte [edx], bl
call fcn.00412f30
mov dword [ebp - 0x4b0], 1
mov byte [ebp - 4], bl
cmp dword [ebp - 0x450], 0x10
jb 0x483193
mov ecx, dword [ebp - 0x464]
push ecx
jmp 0x48318b
push 0x3ff
lea edx, [ebp - 0x40f]
push ebx
push edx
mov byte [ebp - 0x410], bl
call fcn.004a2b10
xor eax, eax
add esp, 0xc
mov word [ebp - 0x49c], ax
mov edi, 7
push 0xc
mov eax, str.Kernel32.dll
lea esi, [ebp - 0x49c]
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], ebx
call fcn.00415f60
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.004803e0
mov esi, eax
mov dword [ebp - 0x4ac], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x488], 8
jb 0x482bce
mov ecx, dword [ebp - 0x49c]
push ecx
call fcn.0049b30a
add esp, 4
xor edx, edx
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x48c], ebx
mov word [ebp - 0x49c], dx
cmp esi, ebx
je 0x4830f1
xor eax, eax
mov word [ebp - 0x480], ax
push 0xc
mov eax, str.Wtsapi32.dll
lea esi, [ebp - 0x480]
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x470], ebx
call fcn.00415f60
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.004803e0
mov esi, eax
mov dword [ebp - 0x4b4], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], 8
jb 0x482c41
mov ecx, dword [ebp - 0x480]
push ecx
call fcn.0049b30a
add esp, 4
xor edx, edx
mov dword [ebp - 0x46c], edi
mov dword [ebp - 0x470], ebx
mov word [ebp - 0x480], dx
cmp esi, ebx
je 0x4830f1
xor eax, eax
mov word [ebp - 0x42c], ax
push 0xb
mov eax, str.Userenv.dll
lea esi, [ebp - 0x42c]
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x41c], ebx
call fcn.00415f60
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.004803e0
mov esi, eax
mov dword [ebp - 0x4a8], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x418], 8
jb 0x482cb4
mov ecx, dword [ebp - 0x42c]
push ecx
call fcn.0049b30a
add esp, 4
xor edx, edx
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], dx
cmp esi, ebx
je 0x4830f1
mov eax, str.advapi32.dll
lea ecx, [ebp - 0x448]
call fcn.00410c10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x448]
call fcn.004803e0
mov esi, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x434], 8
jb 0x482d0e
mov eax, dword [ebp - 0x448]
push eax
call fcn.0049b30a
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x438], ebx
mov word [ebp - 0x448], cx
cmp esi, ebx
je 0x4830f1
mov edx, dword [ebp - 0x4ac]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4d94a4
push edx
call esi
mov dword [ebp - 0x4ac], eax
cmp eax, ebx
jne 0x482e03
lea eax, [ebp - 0x550]
push eax
call fcn.00410ff0
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [ebp - 0x550]
push str.GetProcAddress__WTSGetActiveConsoleSessionId__FAILED._GetLastError:
push ecx
call fcn.00418890
add esp, 0xc
push eax
call fcn.004102c0
push str.CPathUtility::GetPathFromEvr
lea ecx, [ebp - 0x42c]
call fcn.0040fb20
mov byte [ebp - 4], 7
push str.PathUtility.cpp
lea ecx, [ebp - 0x448]
call fcn.0040fb20
mov byte [ebp - 4], 8
lea edx, [ebp - 0x480]
push edx
lea eax, [ebp - 0x550]
push eax
call fcn.004110f0
mov byte [ebp - 4], 9
push eax
push 0x1dc
push ebx
call fcn.004117f0
push eax
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0x448]
call fcn.0047acf0
mov byte [ebp - 4], 8
lea esi, [ebp - 0x480]
call fcn.00410c70
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x448]
call fcn.0040fb80
mov byte [ebp - 4], 6
jmp 0x4830d7
mov ecx, dword [ebp - 0x4b4]
push 0x4d94c4
push ecx
call esi
mov edi, eax
cmp edi, ebx
jne 0x482ed1
lea edx, [ebp - 0x550]
push edx
call fcn.00410ff0
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea eax, [ebp - 0x550]
push str.GetProcAddress__WTSQueryUserToken__FAILED._GetLastError:
push eax
call fcn.00418890
add esp, 0xc
push eax
call fcn.004102c0
push str.CPathUtility::GetPathFromEvr
lea ecx, [ebp - 0x42c]
call fcn.0040fb20
mov byte [ebp - 4], 0xb
push str.PathUtility.cpp
lea ecx, [ebp - 0x448]
call fcn.0040fb20
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x480]
push ecx
lea edx, [ebp - 0x550]
push edx
call fcn.004110f0
mov byte [ebp - 4], 0xd
push eax
push 0x1e3
push ebx
call fcn.004117f0
push eax
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0x448]
call fcn.0047acf0
mov byte [ebp - 4], 0xc
lea esi, [ebp - 0x480]
call fcn.00410c70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x448]
call fcn.0040fb80
mov byte [ebp - 4], 0xa
jmp 0x4830d7
mov eax, dword [ebp - 0x4a8]
push str.ExpandEnvironmentStringsForUserA
push eax
call esi
mov dword [ebp - 0x4a8], eax
cmp eax, ebx
jne 0x482fa3
lea ecx, [ebp - 0x550]
push ecx
call fcn.00410ff0
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea edx, [ebp - 0x550]
push str.GetProcAddress__ExpandEnvironmentStringsForUserA__FAILED._GetLastError:
push edx
call fcn.00418890
add esp, 0xc
push eax
call fcn.004102c0
push str.CPathUtility::GetPathFromEvr
lea ecx, [ebp - 0x42c]
call fcn.0040fb20
mov byte [ebp - 4], 0xf
push str.PathUtility.cpp
lea ecx, [ebp - 0x448]
call fcn.0040fb20
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x550]
push ecx
call fcn.004110f0
mov byte [ebp - 4], 0x11
push eax
push 0x1ea
push ebx
call fcn.004117f0
push eax
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0x448]
call fcn.0047acf0
mov byte [ebp - 4], 0x10
lea esi, [ebp - 0x480]
call fcn.00410c70
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x448]
call fcn.0040fb80
mov byte [ebp - 4], 0xe
jmp 0x4830d7
mov eax, str.SeTcbPrivilege
lea ecx, [ebp - 0x448]
call fcn.00410c10
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x448]
push edx
call fcn.004805a0
add esp, 4
mov byte [ebp - 4], 1
lea esi, [ebp - 0x448]
call fcn.00410c70
call dword [ebp - 0x4ac]
lea ecx, [ebp - 0x4a4]
push ecx
push eax
call edi
cmp eax, ebx
je 0x483026
mov eax, dword [ebp - 0x4a4]
push 0x400
lea edx, [ebp - 0x410]
push edx
push str._tmp_
push eax
call dword [ebp - 0x4a8]
cmp eax, ebx
je 0x4830f1
lea ecx, [ebp - 0x464]
push ecx
lea edx, [ebp - 0x410]
call fcn.0040fbb0
jmp 0x4830f1
lea edx, [ebp - 0x550]
push edx
call fcn.00410ff0
mov byte [ebp - 4], 0x13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea eax, [ebp - 0x550]
push str.WTSQueryUserToken_FAILED._GetLastError:
push eax
call fcn.00418890
add esp, 0xc
push eax
call fcn.004102c0
push str.CPathUtility::GetPathFromEvr
lea ecx, [ebp - 0x42c]
call fcn.0040fb20
mov byte [ebp - 4], 0x14
push str.PathUtility.cpp
lea ecx, [ebp - 0x448]
call fcn.0040fb20
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x480]
push ecx
lea edx, [ebp - 0x550]
push edx
call fcn.004110f0
mov byte [ebp - 4], 0x16
push eax
push 0x1ff
push ebx
call fcn.004117f0
push eax
lea edx, [ebp - 0x42c]
lea ecx, [ebp - 0x448]
call fcn.0047acf0
mov byte [ebp - 4], 0x15
lea esi, [ebp - 0x480]
call fcn.00410c70
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x448]
call fcn.0040fb80
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x42c]
call fcn.0040fb80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x550]
call fcn.004039f0
cmp dword [ebp - 0x454], ebx
jne 0x48313c
push 0x400
lea eax, [ebp - 0x410]
push eax
push str._tmp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
je 0x48313c
lea eax, [ebp - 0x410]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x483120
sub eax, edx
push eax
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x464]
call fcn.004159b0
mov edx, dword [ebp - 0x4a4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], ebx
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], ebx
lea edi, [ebp - 0x464]
mov esi, eax
mov byte [eax], bl
call fcn.00412f30
mov dword [ebp - 0x4b0], 1
mov byte [ebp - 4], bl
cmp dword [ebp - 0x450], 0x10
jb 0x483193
mov eax, dword [ebp - 0x464]
push eax
call fcn.0049b30a
add esp, 4
mov dword [ebp - 0x450], 0xf
mov dword [ebp - 0x454], ebx
mov byte [ebp - 0x464], bl
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b315
mov esp, ebp
pop ebp
ret