Function at 0x48a7e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4c
push 0
push 0
dec ecx
jne 0x48a7ec
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405eb0
xor eax, eax
push ebp
push 0x48ad60
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x48ad7c
call fcn.0040698c
test eax, eax
jle 0x48a84d
movzx eax, byte [ebp - 0x11]
push eax
lea eax, [ebp - 0x220]
push eax
xor ecx, ecx
mov edx, 0x48ad7c
mov eax, dword [ebp - 4]
call fcn.00414c8c
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 4]
call fcn.00405f1c
mov edx, dword [ebp - 4]
mov eax, 0x48ad8c
call fcn.0040698c
test eax, eax
jle 0x48a884
lea eax, [ebp - 0x224]
push eax
mov cx, 0x2f
mov edx, 0xff
mov eax, dword [ebp - 4]
call fcn.0048a6a8
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 4]
call fcn.00405f1c
movzx eax, byte [ebp - 0x11]
push eax
lea eax, [ebp - 0x228]
push eax
xor ecx, ecx
mov edx, 0x48ad9c
mov eax, dword [ebp - 4]
call fcn.00414c8c
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
call fcn.00405f1c
mov edi, 3
mov ebx, 0x541474
lea edx, [ebp - 0x22c]
mov eax, dword [ebp - 4]
call fcn.0040c170
mov eax, dword [ebp - 0x22c]
push eax
lea edx, [ebp - 0x230]
mov eax, dword [ebx]
call fcn.0040c170
mov eax, dword [ebp - 0x230]
pop edx
call fcn.0040698c
mov esi, eax
test esi, esi
jle 0x48a9a9
lea eax, [ebp - 0x21a]
xor ecx, ecx
mov edx, 0x208
call fcn.0040368c
push 0x208
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebx]
call fcn.00405f54
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x48a9a9
mov eax, dword [ebx]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x48a939
sub eax, 4
mov eax, dword [eax]
lea ecx, [eax + 1]
lea eax, [ebp - 4]
mov edx, 1
call fcn.00406744
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x21a]
mov ecx, 0x104
call fcn.004060c8
push dword [ebp - 0x238]
push 0x48adb4
push dword [ebp - 4]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00406480
movzx eax, byte [0x48adb8]
push eax
lea eax, [ebp - 0x23c]
push eax
mov ecx, 0x48adb4
mov edx, 0x48adc8
mov eax, dword [ebp - 4]
call fcn.00414c8c
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 4]
call fcn.00405f1c
add ebx, 4
dec edi
jne 0x48a8b7
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.0040c238
mov edx, dword [ebp - 0x240]
mov eax, 0x48addc
call fcn.0040698c
mov esi, eax
test esi, esi
jle 0x48aa05
mov ecx, 0xb
sub ecx, esi
inc ecx
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406744
lea eax, [ebp - 0x244]
call fcn.0048a740
mov edx, dword [ebp - 0x244]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.0040639c
movzx eax, byte [ebp - 0x11]
push eax
lea eax, [ebp - 0x248]
push eax
xor ecx, ecx
mov edx, 0x48ae00
mov eax, dword [ebp - 4]
call fcn.00414c8c
mov edx, dword [ebp - 0x248]
lea eax, [ebp - 4]
call fcn.00405f1c
mov edx, dword [ebp - 4]
mov eax, 0x48ae14
call fcn.0040698c
test eax, eax
jle 0x48aa65
lea eax, [ebp - 0x24c]
push eax
mov cx, 0x2c
mov edx, 0xff
mov eax, dword [ebp - 4]
call fcn.0048a6a8
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 4]
call fcn.00405f1c
lea edx, [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.0040c7e4
mov edx, dword [ebp - 0x250]
lea eax, [ebp - 4]
call fcn.00405f1c
mov edx, dword [ebp - 4]
mov eax, 0x48ae24
call fcn.0040698c
mov edi, eax
cmp edi, 1
jne 0x48aad7
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00406744
mov edx, dword [ebp - 4]
mov eax, 0x48ae24
call fcn.0040698c
mov edi, eax
test edi, edi
jle 0x48ab87
lea eax, [ebp - 4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406674
jmp 0x48ab87
mov esi, edi
mov edx, dword [ebp - 4]
mov eax, 0x48ae34
call fcn.0040698c
mov edi, eax
test esi, esi
jle 0x48ab3c
cmp esi, edi
jge 0x48ab3c
mov eax, dword [ebp - 4]
test eax, eax
je 0x48ab0d
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x48ab0d
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040563c
cmp word [eax + esi*2 - 4], 0x20
jne 0x48ab26
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.00406744
jmp 0x48ab87
lea eax, [ebp - 4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406674
jmp 0x48ab87
mov edx, dword [ebp - 4]
mov eax, 0x48ae48
call fcn.0040d7f0
mov edi, eax
test edi, edi
jle 0x48ab87
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, 0x48ae34
call fcn.0040a94c
mov esi, eax
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, 0x48ae5c
call fcn.0040a94c
cmp esi, eax
jle 0x48ab87
lea eax, [ebp - 4]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406674
mov edx, dword [ebp - 4]
mov eax, 0x48ae24
call fcn.0040698c
mov esi, eax
test esi, esi
jle 0x48abeb
mov eax, dword [ebp - 4]
test eax, eax
je 0x48abb7
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x48abb7
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.0040563c
test eax, eax
je 0x48abc0
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
sub ecx, esi
inc ecx
lea eax, [ebp - 4]
mov edx, esi
call fcn.00406744
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 4]
call fcn.0040c884
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 4]
call fcn.00405f1c
mov edx, dword [ebp - 4]
mov eax, 0x48ae6c
call fcn.0040698c
cmp eax, 2
je 0x48ac22
mov edx, dword [ebp - 4]
mov eax, 0x48ae6c
call fcn.0040698c
mov esi, eax
test esi, esi
jle 0x48ac22
mov ecx, esi
sub ecx, 2
lea eax, [ebp - 4]
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00405ec8
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00406674
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.0040c238
mov eax, dword [ebp - 0x258]
mov edx, 0x48ae80
call fcn.0040666c
jne 0x48ad25
lea eax, [ebp - 4]
mov ecx, 0xd
mov edx, 1
call fcn.00406744
mov eax, dword [ebp - 4]
call fcn.0040d598
test al, al
jne 0x48ad25
lea eax, [ebp - 8]
call fcn.0048a740
push dword [ebp - 8]
push 0x48adb4
push dword [ebp - 4]
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.00406480
mov eax, dword [ebp - 0x260]
call fcn.0040d598
test al, al
je 0x48acdb
push dword [ebp - 8]
push 0x48adb4
push dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov edx, 3
call fcn.00406480
jmp 0x48ad25
lea eax, [ebp - 0xc]
call fcn.0048b3dc
push dword [ebp - 0xc]
push 0x48adb4
push dword [ebp - 4]
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00406480
mov eax, dword [ebp - 0x264]
call fcn.0040d598
test al, al
je 0x48ad25
push dword [ebp - 0xc]
push 0x48adb4
push dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov edx, 3
call fcn.00406480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ad67
lea eax, [ebp - 0x264]
mov edx, 0xc
call fcn.00405ec0
lea eax, [ebp - 0x230]
mov edx, 5
call fcn.00405ec0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405ec0
ret