Function at 0x4417c0
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8a
push 0
push 0
dec ecx
jne 0x4417c8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x441f5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x461444]
call fcn.004062c0
test eax, eax
jne 0x441bd6
push 0x16
mov eax, 0x461444
mov ecx, 1
mov edx, dword [0x441794]
call fcn.0040647c
add esp, 4
mov eax, dword [0x461444]
mov edx, 0x441f74
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 4
mov edx, dword [0x45ae6c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xc
mov edx, 0x441f88
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x10
mov edx, dword [0x45b09c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x18
mov edx, 0x441f9c
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x1c
mov edx, dword [0x45af88]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x24
mov edx, 0x441fb4
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x28
mov edx, dword [0x45ae08]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x30
mov edx, 0x441fcc
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x34
mov edx, dword [0x45b110]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x3c
mov edx, 0x441fe8
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x40
mov edx, dword [0x45af9c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x48
mov edx, 0x442004
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x4c
mov edx, dword [0x45af00]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x54
mov edx, 0x442018
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x58
mov edx, dword [0x45b1a0]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x60
mov edx, 0x442030
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x64
mov edx, dword [0x45b1cc]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x6c
mov edx, 0x442048
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x70
mov edx, dword [0x45ae28]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x78
mov edx, 0x442060
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x7c
mov edx, dword [0x45ae5c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x84
mov edx, 0x44207c
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x88
mov edx, dword [0x45ae0c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x90
mov edx, 0x44208c
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x94
mov edx, dword [0x45b044]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x9c
mov edx, 0x4420a0
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xa0
mov edx, dword [0x45ae2c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xa8
mov edx, 0x4420b4
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xac
mov edx, dword [0x45b044]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xb4
mov edx, 0x4420cc
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xb8
mov edx, dword [0x45ae88]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xc0
mov edx, 0x4420e8
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xc4
mov edx, dword [0x45b0d4]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xcc
mov edx, 0x442100
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xd0
mov edx, dword [0x45b06c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xd8
mov edx, 0x442124
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xdc
mov edx, dword [0x45afdc]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xe4
mov edx, 0x442138
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xe8
mov edx, dword [0x45af1c]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xf0
mov edx, 0x442150
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xf4
mov edx, dword [0x45b1bc]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0xfc
mov edx, 0x44216c
call fcn.00404f18
mov eax, dword [0x461444]
add eax, 0x100
mov edx, dword [0x45b108]
mov edx, dword [edx]
call fcn.00404f18
mov eax, dword [0x461444]
call fcn.004062c0
dec eax
test eax, eax
jl 0x441bd6
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
mov ebx, dword [ebp - 0x14]
lea ebx, [ebx + ebx*2]
mov eax, dword [0x461444]
mov eax, dword [eax + ebx*4]
mov dl, 1
call fcn.00424e5c
mov edx, dword [0x461444]
mov dword [edx + ebx*4 + 8], eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x441baf
mov edx, edi
mov eax, 0x442184
call fcn.0040547c
test eax, eax
jne 0x441cb8
mov eax, dword [ebp - 8]
mov edx, edi
call fcn.00404f18
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x441c0e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x441c1f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp byte [eax], 0x5c
sete al
jmp 0x441c21
xor eax, eax
test al, al
je 0x441f37
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, 0xc
mov edx, 1
call fcn.00405398
mov eax, dword [ebp - 0x434]
lea edx, [ebp - 0x430]
call fcn.00408bbc
mov eax, dword [ebp - 0x430]
mov edx, 0x442190
call fcn.004052c8
jne 0x441f37
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x42c], eax
mov ebx, dword [ebp - 0x42c]
test ebx, ebx
je 0x441c85
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x438]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
mov edx, 0xd
call fcn.00405398
mov ecx, dword [ebp - 0x438]
mov edx, dword [0x45b044]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.004051b8
jmp 0x441f37
mov dword [ebp - 0x10], 1
mov esi, 1
mov eax, edi
test eax, eax
je 0x441ccf
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00404ec4
cmp esi, dword [ebp - 0x18]
jg 0x441e11
cmp byte [edi + esi - 1], 0x25
jne 0x441e07
lea eax, [ebp - 0x43c]
push eax
mov ecx, esi
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405398
mov edx, dword [ebp - 0x43c]
mov eax, dword [ebp - 8]
call fcn.0040516c
mov eax, dword [ebp - 8]
lea ebx, [esi + 1]
jmp 0x441d1b
inc ebx
cmp ebx, dword [ebp - 0x18]
jg 0x441d27
cmp byte [edi + ebx - 1], 0x25
jne 0x441d1a
cmp byte [edi + ebx - 1], 0x25
jne 0x441e01
lea eax, [ebp - 0x440]
push eax
mov ecx, ebx
sub ecx, esi
inc ecx
mov edx, esi
mov eax, edi
call fcn.00405398
mov eax, dword [ebp - 0x440]
lea edx, [ebp - 4]
call fcn.00408bbc
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00424e5c
mov dword [ebp - 0x20], eax
mov eax, dword [0x461444]
call fcn.004062c0
dec eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x19], 0
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x441dc1
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov edx, dword [0x461444]
mov eax, dword [edx + eax*4 + 8]
cmp eax, dword [ebp - 0x20]
jne 0x441db9
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*2]
mov ecx, dword [0x461444]
mov edx, dword [ecx + edx*4 + 4]
call fcn.00404f5c
mov byte [ebp - 0x19], 1
jmp 0x441dc1
inc dword [ebp - 0x14]
dec dword [ebp - 0x24]
jne 0x441d86
cmp byte [ebp - 0x19], 0
jne 0x441df3
push 0x400
lea eax, [ebp - 0x425]
push eax
mov eax, dword [ebp - 4]
call fcn.00405330
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x441df3
lea eax, [ebp - 4]
lea edx, [ebp - 0x425]
call fcn.004050bc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040516c
mov eax, dword [ebp - 8]
lea esi, [ebx + 1]
mov dword [ebp - 0x10], esi
inc esi
cmp esi, dword [ebp - 0x18]
jle 0x441ce3
lea eax, [ebp - 0x444]
push eax
mov ecx, esi
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.00405398
mov edx, dword [ebp - 0x444]
mov eax, dword [ebp - 8]
call fcn.0040516c
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x441e52
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x441e63
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp byte [eax], 0x5c
sete al
jmp 0x441e65
xor eax, eax
test al, al
je 0x441ef3
lea eax, [ebp - 0x44c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, 0xc
mov edx, 1
call fcn.00405398
mov eax, dword [ebp - 0x44c]
lea edx, [ebp - 0x448]
call fcn.00408bbc
mov eax, dword [ebp - 0x448]
mov edx, 0x442190
call fcn.004052c8
jne 0x441ef3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x42c], eax
mov ebx, dword [ebp - 0x42c]
test ebx, ebx
je 0x441ec5
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
mov edx, 0xd
call fcn.00405398
mov ecx, dword [ebp - 0x450]
mov edx, dword [0x45b044]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.004051b8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, 0x4421a8
call fcn.0040547c
test eax, eax
jle 0x441f37
movzx eax, byte [0x4421ac]
push eax
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, 0x4421b8
mov edx, 0x4421a8
call fcn.0040ead8
mov edx, dword [ebp - 0x454]
mov eax, dword [ebp - 8]
call fcn.00404f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441f64
lea eax, [ebp - 0x454]
mov edx, 0xa
call fcn.00404ee8
lea eax, [ebp - 4]
call fcn.00404ec4
ret