Function at 0x4cc4b0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x590e12
mov eax, dword fs:[0]
push eax
sub esp, 0x4bc
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x4b4], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x4cc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], 0
mov ecx, dword [0x7e256c]
mov dword [esp + 0x18], esi
test cl, 1
jne 0x4cc554
or ecx, 1
mov dword [0x7e256c], ecx
mov dword [esp + 0x4d4], 1
push 0x18
mov dword [0x7e2570], 0
call fcn.0056590a
add esp, 4
mov dword [0x7e2570], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x5a0110
call fcn.00565027
add esp, 4
mov byte [esp + 0x4d4], 0
mov ecx, dword [0x7e256c]
mov eax, dword [0x7e2570]
mov dword [esp + 0x38], 0x7e2570
test eax, eax
je 0x4cc572
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x7e256c]
mov dword [esp + 0x4d4], 2
test cl, 2
jne 0x4cc5c4
or ecx, 2
mov dword [0x7e256c], ecx
mov byte [esp + 0x4d4], 3
xor eax, eax
push 0x5a00b0
mov dword [0x7e2568], 7
mov dword [0x7e2564], 0
mov word [0x7e2554], ax
call fcn.00565027
add esp, 4
mov byte [esp + 0x4d4], 2
cmp dword [0x7e2564], 0
je 0x4cc62b
mov ecx, 0x7e2554
call fcn.004b3080
test al, al
jne 0x4cc5e5
mov ecx, 0x7e2554
call fcn.004b3760
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x7e2554
mov word [esi], ax
call fcn.00404960
mov dword [esp + 0x14], 1
mov byte [esp + 0x4d4], 0
mov ecx, dword [0x7e2570]
test ecx, ecx
je 0x4ccc42
push ecx
jmp 0x4ccc3c
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov byte [esp + 0x4d4], 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
call fcn.004db0b0
mov byte [esp + 0x4d4], 5
call fcn.00409c40
test al, al
je 0x4cc68a
call fcn.004db5e0
test al, al
jne 0x4cc68a
lea ecx, [esp + 0x34]
call fcn.004db3a0
xor eax, eax
push 0x40e
push eax
mov word [esp + 0xbc], ax
lea eax, [esp + 0xbe]
push eax
call fcn.0056cbb0
add esp, 0xc
call fcn.00409cc0
test al, al
lea eax, [esp + 0xb4]
push 0x208
push eax
je 0x4cc6c7
push str._ProgramData_
jmp 0x4cc6cc
push str._ALLUSERSPROFILE_Application_Data
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
setne bl
cmp word [esp + 0xb4], 0
jne 0x4cc6e6
xor ecx, ecx
jmp 0x4cc6ff
lea ecx, [esp + 0xb4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc6f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x24]
call fcn.00404a80
test bl, bl
jne 0x4cc730
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], 0
cmovae eax, dword [esp + 0x1c]
xor ecx, ecx
mov word [eax], cx
cmp dword [esp + 0x2c], 0
je 0x4cc76b
mov edx, 0x10
lea ecx, [esp + 0x1c]
call fcn.004b2110
push 0x13
push str.2345PackStatService
lea ecx, [esp + 0x24]
call fcn.00404880
push 0x5c
push 1
lea ecx, [esp + 0x24]
call fcn.004b0400
lea ecx, [esp + 0x1c]
call fcn.004b3760
lea ecx, [esp + 0x1c]
call fcn.004b3080
test al, al
je 0x4cc7c4
lea ecx, [esp + 0x1c]
call fcn.004cc320
test al, al
je 0x4cc7c4
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x24]
mov ecx, 0x7e2554
push eax
call fcn.00404960
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [esp + 0x1c]
push eax
call fcn.00404150
mov dword [esp + 0x14], 1
jmp 0x4ccbec
xor eax, eax
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
mov byte [esp + 0x4d4], 6
cmp dword [edi + 0x10], eax
jne 0x4cc849
lea ecx, [esp + 0x3c]
call fcn.004cc170
mov edi, eax
mov byte [esp + 0x4d4], 7
lea eax, [esp + 0x54]
cmp eax, edi
je 0x4cc886
cmp dword [esp + 0x68], 8
jb 0x4cc826
push dword [esp + 0x54]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
push edi
lea ecx, [esp + 0x58]
mov dword [esp + 0x68], 0
mov word [esp + 0x58], ax
call fcn.00404150
jmp 0x4cc886
cmp dword [edi + 0x14], 8
jb 0x4cc851
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.004c2590
mov byte [esp + 0x4d4], 8
lea edx, [esp + 0x54]
lea ecx, [esp + 0x3c]
call fcn.004b26b0
mov edx, 0x10
lea ecx, [esp + 0x54]
call fcn.004b2110
mov byte [esp + 0x4d4], 6
cmp dword [esp + 0x50], 8
jb 0x4cc8a1
push dword [esp + 0x3c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
push str.config
lea edx, [esp + 0x58]
mov word [esp + 0x40], ax
lea ecx, [esp + 0x70]
mov dword [esp + 0x50], eax
call fcn.0040cc70
add esp, 4
mov byte [esp + 0x4d4], 9
lea ecx, [esp + 0x6c]
push 0x5c
push 1
call fcn.004b0400
lea ecx, [esp + 0x6c]
call fcn.004b3080
test al, al
jne 0x4cc8f4
lea ecx, [esp + 0x6c]
call fcn.004bbe20
lea ecx, [esp + 0x6c]
call fcn.004b3080
test al, al
je 0x4cca33
push str.2345packStatData.cst
lea ecx, [esp + 0x40]
call fcn.00403a70
mov byte [esp + 0x4d4], 0xa
lea eax, [esp + 0x3c]
push eax
lea edx, [esp + 0x70]
lea ecx, [esp + 0x88]
call fcn.004b2290
add esp, 4
mov byte [esp + 0x4d4], 0xc
cmp dword [esp + 0x50], 8
jb 0x4cc94e
push dword [esp + 0x3c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
lea ecx, [esp + 0x6c]
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
call fcn.004cc320
test al, al
je 0x4cca1f
lea ecx, [esp + 0x84]
call fcn.004cd0a0
test al, al
je 0x4cca1f
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x74]
mov ecx, 0x7e2554
push eax
call fcn.00404960
lea eax, [esp + 0x6c]
mov ecx, esi
push eax
call fcn.00403ad0
mov dword [esp + 0x14], 1
mov byte [esp + 0x4d4], 9
lea ecx, [esp + 0x84]
call fcn.00403b40
mov byte [esp + 0x4d4], 6
lea ecx, [esp + 0x6c]
call fcn.00403b40
mov byte [esp + 0x4d4], 5
lea ecx, [esp + 0x54]
call fcn.00403b40
mov byte [esp + 0x4d4], 4
lea ecx, [esp + 0x34]
call fcn.004db4e0
mov byte [esp + 0x4d4], 2
lea ecx, [esp + 0x1c]
call fcn.00403b40
mov byte [esp + 0x4d4], 0
lea ecx, [esp + 0x38]
call fcn.00415430
jmp 0x4ccc4a
mov byte [esp + 0x4d4], 9
lea ecx, [esp + 0x84]
call fcn.00403b40
lea ecx, [esp + 0x1c]
call fcn.004b3080
test al, al
jne 0x4cca49
lea ecx, [esp + 0x1c]
call fcn.004b3760
lea ecx, [esp + 0x1c]
call fcn.004cc320
test al, al
jne 0x4cca67
lea eax, [esp + 0x1c]
push eax
call fcn.004db790
mov ecx, eax
call fcn.004dbee0
lea ecx, [esp + 0x1c]
call fcn.004b3080
test al, al
je 0x4ccb5b
push 0x5ba174
lea edx, [esp + 0x70]
lea ecx, [esp + 0xa0]
call fcn.0040cc70
add esp, 4
mov byte [esp + 0x4d4], 0xd
xorps xmm0, xmm0
movq qword [esp + 0x3c], xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov byte [esp + 0x4d4], 0xe
lea eax, [esp + 0x9c]
push eax
lea ecx, [esp + 0x40]
call fcn.0040be40
push 0x5a87c4
lea ecx, [esp + 0x88]
call fcn.00403a70
mov byte [esp + 0x4d4], 0xf
sub esp, 8
lea eax, [esp + 0x8c]
lea edx, [esp + 0x44]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004cbee0
add esp, 0x10
mov byte [esp + 0x4d4], 0xe
lea ecx, [esp + 0x84]
call fcn.00403b40
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x24]
mov ecx, 0x7e2554
push eax
call fcn.00404960
mov byte [esp + 0x4d4], 0xd
lea ecx, [esp + 0x3c]
call fcn.0040ff60
mov byte [esp + 0x4d4], 9
lea ecx, [esp + 0x9c]
call fcn.00403b40
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [esp + 0x1c]
push eax
call fcn.00404150
mov dword [esp + 0x14], 1
mov byte [esp + 0x4d4], 6
cmp dword [esp + 0x80], 8
jb 0x4ccba0
push dword [esp + 0x6c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
mov byte [esp + 0x4d4], 5
cmp dword [esp + 0x68], 8
jb 0x4ccbd5
push dword [esp + 0x54]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
mov byte [esp + 0x4d4], 4
lea ecx, [esp + 0x34]
call fcn.004db4e0
mov byte [esp + 0x4d4], 2
cmp dword [esp + 0x30], 8
jb 0x4ccc18
push dword [esp + 0x1c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x4d4], al
mov eax, dword [0x7e2570]
test eax, eax
je 0x4ccc42
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x38], 0
mov eax, esi
mov ecx, dword [esp + 0x4cc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.00564de8
add esp, 0x4c8
ret