Function at 0x40ac30
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2f8
lea ebx, [esp + 0xa8]
push edx
push ecx
push ebx
call fcn.0040ff80
add esp, 0xc
lea esi, [esp + 0x68]
push 0xd
push 0x507daa
push 0xa
push str.User_AgentHello_Loader__
push ebx
push esi
call fcn.00411ee0
add esp, 0x18
push esi
push ebx
call fcn.00410b60
add esp, 8
lea ecx, [esp + 0x174]
mov edx, ebx
call fcn.0040a0b0
mov edx, dword [esp + 0x1c4]
cmp edx, 2
je 0x40b443
lea eax, [esp + 0x234]
lea esi, [esp + 0x174]
mov ecx, 0x14
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x1c8]
lea edi, [esp + 0x288]
mov ecx, 0x1b
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 1
mov dword [esp + 0x284], edx
mov dword [esp + 0x4c], 0
push eax
call fcn.00413580
add esp, 4
mov esi, eax
lea eax, [esp + 0x44]
push eax
push esi
push ebx
mov dword [esp + 0x3c], edx
call dword [edx + 0x18]
add esp, 0xc
movzx eax, byte [esp + 0xa8]
cmp al, 4
mov byte [esp + 0xb], al
jne 0x40ad46
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x2c], esi
test eax, eax
mov dword [esp + 4], eax
je 0x40ad93
setns al
js 0x40b44f
movzx esi, al
push esi
mov edi, dword [ebp + 0xc]
push edi
call fcn.0040dc80
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40ad9b
push esi
push edi
call fcn.005062c0
add esp, 8
ud2
cmp byte [esp + 0xa8], 3
jne 0x40b407
mov edi, esi
mov esi, dword [esp + 0xac]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40ad7f
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.0040dc90
add esp, 0xc
push 4
push 0xc
push esi
call fcn.0040dc90
add esp, 0xc
mov esi, edi
jmp 0x40b407
mov edi, dword [ebp + 0xc]
mov ebx, 1
push edi
push dword [ebp + 8]
push ebx
call fcn.004f5b80
add esp, 0xc
call fcn.004c0910
push edx
push eax
lea eax, [esp + 0xb0]
push eax
call fcn.0040d840
add esp, 0xc
mov eax, dword [esp + 0xa8]
mov edx, dword [esp + 0xac]
mov esi, edi
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x18], edx
lea ecx, [eax + eax*2]
test eax, eax
lea ecx, [edx + ecx*8]
mov dword [esp + 0x34], ecx
je 0x40b222
mov eax, edx
mov dword [esp + 0x1c], esi
jmp 0x40ae0e
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x34]
je 0x40b2a5
lea ecx, [eax + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 0x38], ecx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40b22a
mov edx, dword [eax]
mov esi, dword [eax + 8]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], esi
lea esi, [esp + 0x68]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0xb0], 0x507db8
mov dword [esp + 0xb4], 2
mov dword [esp + 0xa8], 0
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x68], eax
lea eax, [esp + 0xa8]
mov dword [esp + 0x6c], 0x4079c0
push eax
lea eax, [esp + 0x178]
push eax
call fcn.004d1060
add esp, 8
mov eax, dword [esp + 0x174]
mov edi, dword [esp + 0x17c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x178]
push edi
mov dword [esp + 0x40], eax
push eax
push esi
mov esi, dword [esp + 0x10]
call fcn.004d1a40
add esp, 0xc
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x24], ebx
test eax, eax
je 0x40af30
cmp eax, esi
jae 0x40af50
cmp eax, 1
jne 0x40af65
movzx eax, byte [edx]
cmp esi, 7
ja 0x40afb0
xor ecx, ecx
nop dword [eax]
cmp byte [ebx + ecx], al
je 0x40af30
inc ecx
cmp esi, ecx
jne 0x40af00
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40b1b1
push 1
push eax
push edx
call fcn.0040dc90
add esp, 0xc
jmp 0x40b1b1
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40afeb
push 1
push eax
push edx
call fcn.0040dc90
add esp, 0xc
jmp 0x40afeb
mov dword [esp + 0x20], edx
jne 0x40afa4
push esi
push ebx
push edx
call fcn.004f60f4
add esp, 0xc
test eax, eax
jmp 0x40afc5
push eax
mov dword [esp + 0x24], edx
push edx
push esi
push ebx
lea esi, [esp + 0xb8]
push esi
call fcn.004d8100
add esp, 0x14
mov edx, esi
mov esi, dword [esp + 4]
lea ecx, [esp + 0x174]
call fcn.0040a2b0
cmp dword [esp + 0x174], 0
setne bl
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x40afd0
jmp 0x40afdf
xor ebx, ebx
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x40afd0
jmp 0x40afdf
mov dword [esp + 0x20], edx
movzx eax, al
push esi
push ebx
push eax
call fcn.004dbbe0
add esp, 0xc
cmp eax, 1
sete bl
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40afdf
push 1
push eax
push dword [esp + 0x28]
call fcn.0040dc90
add esp, 0xc
test bl, bl
mov ebx, dword [esp + 0x24]
je 0x40b1b1
push edi
push dword [esp + 0x40]
lea eax, [esp + 0x70]
mov edi, esi
mov esi, eax
push eax
call fcn.004d1a40
add esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
push edi
push ebx
push esi
lea esi, [esp + 0xb4]
push esi
call fcn.004d19c0
add esp, 0x10
lea ecx, [esp + 0x174]
mov edx, esi
call fcn.0040a2b0
cmp dword [esp + 0x174], 0
je 0x40b140
xor edi, edi
mov esi, 1
xor edx, edx
jmp 0x40b0a4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x28]
lea eax, [esi + edi]
push ebx
push dword [esp + 0x44]
push eax
call fcn.004f5b80
add esp, 0xc
add edi, ebx
lea ecx, [esp + 0x174]
lea edx, [esp + 0xa8]
mov dword [esp + 0x14], edi
call fcn.0040a2b0
cmp dword [esp + 0x174], 0
mov edx, dword [esp + 0x20]
je 0x40b130
mov ebx, dword [esp + 0x178]
mov ecx, dword [esp + 0x24]
mov eax, edx
mov eax, dword [esp + 0xc]
add ecx, edx
sub ebx, edx
mov edx, dword [esp + 0x17c]
sub eax, edi
cmp eax, ebx
mov dword [esp + 0x20], edx
jb 0x40b108
add esi, edi
push ebx
push ecx
push esi
call fcn.004f5b80
add esp, 0xc
add edi, ebx
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0xc]
sub eax, edi
cmp eax, dword [esp + 0x28]
jae 0x40b060
push dword [esp + 0x28]
push edi
lea eax, [esp + 0x14]
push eax
call fcn.00503700
add esp, 0xc
mov edi, dword [esp + 0x14]
jmp 0x40b060
push ebx
push edi
lea eax, [esp + 0x14]
push eax
mov esi, ecx
call fcn.00503700
mov ecx, esi
add esp, 0xc
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
jmp 0x40b0ca
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x24]
jmp 0x40b14b
xor eax, eax
mov esi, 1
xor edi, edi
xor edx, edx
mov ecx, dword [esp + 4]
sub eax, edi
add ebx, edx
sub ecx, edx
cmp eax, ecx
mov dword [esp + 4], ecx
jb 0x40b203
add esi, edi
push dword [esp + 4]
push ebx
push esi
call fcn.004f5b80
add esp, 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b188
push 1
push eax
push dword [esp + 0x2c]
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40b1ab
push 1
push eax
push dword [esp + 0x74]
call fcn.0040dc90
add esp, 0xc
mov esi, dword [esp + 4]
add esi, edi
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x18]
test eax, eax
je 0x40b1cc
push 1
push eax
push dword [esp + 0x44]
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0x58]
test eax, eax
je 0x40b1e3
push 1
push eax
push dword [esp + 0x48]
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40ae00
push 1
push eax
push dword [esp + 0x68]
call fcn.0040dc90
add esp, 0xc
jmp 0x40ae00
push dword [esp + 4]
push edi
lea eax, [esp + 0x14]
push eax
call fcn.00503700
add esp, 0xc
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
jmp 0x40b161
mov ecx, edx
mov dword [esp + 0x1c], esi
jmp 0x40b22e
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov esi, ecx
mov eax, edi
sub eax, ecx
mov ecx, 0xaaaaaaab
mul ecx
mov ecx, esi
cmp edi, esi
je 0x40b29d
mov esi, edx
add ecx, 0x10
mov edi, ebx
shr esi, 4
jmp 0x40b266
add ecx, 0x18
dec esi
je 0x40b29d
mov eax, dword [ecx - 0x10]
test eax, eax
je 0x40b281
push 1
push eax
push dword [ecx - 0xc]
mov ebx, ecx
call fcn.0040dc90
mov ecx, ebx
mov ebx, edi
add esp, 0xc
mov eax, dword [ecx - 4]
test eax, eax
je 0x40b260
push 1
push eax
push dword [ecx]
mov ebx, ecx
call fcn.0040dc90
mov ecx, ebx
mov ebx, edi
add esp, 0xc
jmp 0x40b260
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
test eax, eax
je 0x40b2bf
shl eax, 3
lea eax, [eax + eax*2]
push 4
push eax
push edi
call fcn.0040dc90
add esp, 0xc
push esi
push ebx
lea esi, [esp + 0xb0]
push esi
call fcn.004d47d0
add esp, 0xc
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 1
mov dword [esp + 0x70], 0
push 0x507cd0
lea eax, [esp + 0x6c]
push eax
lea edi, [esp + 0x17c]
push edi
call fcn.004d4c20
add esp, 0xc
push edi
push esi
call fcn.004d7980
add esp, 8
test al, al
jne 0x40b44b
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
lea eax, [esp + 0xc]
push dword [esp + 0x4c]
push edi
push dword [esp + 0x78]
push dword [esp + 0x78]
push eax
call fcn.004c5bb0
add esp, 0x14
test esi, esi
je 0x40b347
push 1
push esi
push edi
call fcn.0040dc90
add esp, 0xc
cmp byte [esp + 0xc], 4
jne 0x40b39e
mov eax, dword [esp + 0x68]
mov esi, dword [esp + 0x2c]
test eax, eax
je 0x40b369
push 1
push eax
push dword [esp + 0x74]
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b37d
push 1
push eax
push ebx
call fcn.0040dc90
add esp, 0xc
push esi
mov edi, dword [esp + 0x34]
call dword [edi]
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x40b443
mov ecx, edi
push dword [edi + 8]
push eax
push esi
jmp 0x40b43b
cmp byte [esp + 0xc], 3
jne 0x40b3d8
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x40b3cb
push dword [eax + 8]
push ecx
push dword [esi]
call fcn.0040dc90
add esp, 0xc
push 4
push 0xc
push esi
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0x68]
mov esi, dword [esp + 0x2c]
test eax, eax
je 0x40b3f3
push 1
push eax
push dword [esp + 0x74]
call fcn.0040dc90
add esp, 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b407
push 1
push eax
push ebx
call fcn.0040dc90
add esp, 0xc
push esi
mov edi, dword [esp + 0x34]
call dword [edi]
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x40b425
push dword [edi + 8]
push eax
push esi
call fcn.0040dc90
add esp, 0xc
cmp byte [esp + 0xb], 4
je 0x40b443
mov eax, dword [esp + 0x44]
test eax, eax
je 0x40b443
push 1
push eax
push dword [esp + 0x50]
call fcn.0040dc90
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
call fcn.004ccfb0
ud2