Function at 0x1000493e
Capabilities:
Query environment variable

Disassembly:
push 0x28c
push 0x10004c80
call fcn.100016e3
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x27c], esi
xor eax, eax
mov word [ebp - 0x6c], ax
push 0x4e
push esi
lea eax, [ebp - 0x6a]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov word [ebp - 0x278], ax
push 0x208
push esi
lea eax, [ebp - 0x276]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x284], esi
xor eax, eax
mov word [ebp - 0x29c], ax
lea edi, [ebp - 0x29a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x28c], 0xa
inc esi
mov dword [ebp - 0x288], esi
xor edi, edi
mov dword [ebp - 0x280], edi
cmp ebx, edi
jne 0x100049c9
mov eax, 0x80070057
jmp 0x10004bb9
mov dword [ebp - 4], edi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.100038b7
mov dword [ebp - 0x27c], eax
cmp eax, edi
jne 0x10004b88
cmp dword [ebp - 0x288], edi
jne 0x10004a11
mov dword [ebp - 0x27c], esi
jmp 0x10004b88
cmp dword [ebp - 0x280], edi
je 0x10004a3c
push 4
pop ecx
mov edi, 0x10004bc4
mov esi, dword [ebp - 0x280]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x10004a3c
mov dword [ebp - 0x27c], 1
jmp 0x10004b88
push 0x28
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x280]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, 0x104
push esi
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10004a9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10004a7f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1000707c
call sub.msvcrt.dll__local_unwind4
add esp, 0xc
mov eax, esi
jmp 0x10004bb9
cmp eax, esi
jbe 0x10004abc
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1000707c
call sub.msvcrt.dll__local_unwind4
add esp, 0xc
mov eax, 0x8007006f
jmp 0x10004bb9
push dword [ebp - 0x28c]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10011fb4
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov word [ebx + 0x208], ax
movzx eax, word [ebp - 0x290]
push eax
movzx eax, word [ebp - 0x292]
push eax
movzx eax, word [ebp - 0x294]
push eax
movzx eax, word [ebp - 0x296]
push eax
movzx eax, word [ebp - 0x29a]
push eax
movzx eax, word [ebp - 0x29c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x278]
push eax
push 0x10004c30
push esi
push ebx
call fcn.10003cad
add esp, 0x2c
mov dword [ebp - 0x27c], eax
test eax, eax
jl 0x10004b88
push 0
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x10004bf0
push 0x10004bd4
call fcn.10011fb4
add esp, 0x10
mov dword [ebp - 0x27c], eax
test eax, eax
jl 0x10004b88
push 0
push ebx
call dword [sym.imp.msvcrt.dll__waccess]
pop ecx
pop ecx
test eax, eax
je 0x10004b88
mov dword [ebp - 0x27c], 0x80004005
and dword [ebp - 4], 0
call fcn.10004b98
jmp 0x10004bac
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x27c]
call fcn.1000172b
ret 4