Function at 0x401b73
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42399e
mov eax, dword fs:[0]
push eax
mov eax, 0x2000c
call fcn.0041faf0
mov eax, dword [0x42d4b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x20018], esi
mov dword [ebp - 0x20018], esi
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov eax, dword [0x42f838]
cmp eax, dword [edi + 4]
jle 0x401c05
push 0x42f838
call fcn.00413320
cmp dword [0x42f838], 0xffffffff
pop ecx
jne 0x401c05
call fcn.0040461c
push eax
mov ecx, 0x42f83c
call fcn.00403cdd
push 0x4243e8
call fcn.004136a0
mov dword [esp], 0x42f838
call fcn.00413260
pop ecx
mov eax, dword [0x42f840]
cmp eax, dword [edi + 4]
jle 0x401c49
mov edi, 0x42f840
push edi
call fcn.00413320
cmp dword [0x42f840], 0xffffffff
pop ecx
jne 0x401c49
call fcn.0040461c
push eax
mov ecx, 0x42f844
call fcn.00403cdd
push 0x4243de
call fcn.004136a0
push edi
call fcn.00413260
pop ecx
pop ecx
cmp dword [0x42d9b0], 0
je 0x401d01
call fcn.0040190b
test eax, eax
je 0x401d01
and dword [0x42d9b0], 0
lea ecx, [ebp - 0x20018]
mov edx, str._programfiles_
call fcn.00401b73
and dword [ebp - 4], 0
mov edi, 0x42f83c
push eax
mov ecx, edi
call fcn.00403ade
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20018]
call fcn.00403cc2
mov edx, str._commonprogramfiles_
lea ecx, [ebp - 0x20018]
call fcn.00401b73
push eax
mov ecx, 0x42f844
mov dword [ebp - 4], 1
call fcn.00403ade
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20018]
call fcn.00403cc2
mov ecx, edi
call fcn.00403904
push 0x42822c
mov edi, str.__x86_
mov ecx, 0x42f83c
push edi
call fcn.0040392c
mov ecx, 0x42f844
call fcn.00403904
push 0x42822c
push edi
mov ecx, 0x42f844
call fcn.0040392c
push ebx
lea ecx, [ebp - 0x20014]
call fcn.00403b44
mov dword [ebp - 4], 2
call fcn.00401ae8
test eax, eax
je 0x401d60
lea ecx, [ebp - 0x20014]
call fcn.00403904
mov eax, dword [0x42f83c]
cmp dword [eax - 0xc], 0
je 0x401d44
push eax
push str._programfiles_
lea ecx, [ebp - 0x20014]
call fcn.0040392c
mov eax, dword [0x42f844]
cmp dword [eax - 0xc], 0
je 0x401d60
push eax
push str._commonprogramfiles_
lea ecx, [ebp - 0x20014]
call fcn.0040392c
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [ebp - 0x10010], ax
lea eax, [ebp - 0x10010]
push 0x8000
push eax
push dword [ebp - 0x20014]
call ebx
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
lea eax, [ebp - 0x10010]
push 0x25
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x401e33
add eax, 2
push 0x25
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x401e33
lea eax, [ebp - 0x10010]
push eax
lea ecx, [ebp - 0x20014]
call fcn.00403aa3
call fcn.00401ae8
test eax, eax
je 0x401e0e
lea ecx, [ebp - 0x20014]
call fcn.00403904
mov eax, dword [0x42f83c]
cmp dword [eax - 0xc], 0
je 0x401df2
push eax
push str._programfiles_
lea ecx, [ebp - 0x20014]
call fcn.0040392c
mov eax, dword [0x42f844]
cmp dword [eax - 0xc], 0
je 0x401e0e
push eax
push str._commonprogramfiles_
lea ecx, [ebp - 0x20014]
call fcn.0040392c
xor eax, eax
mov word [ebp - 0x20010], ax
lea eax, [ebp - 0x20010]
push 0x8000
push eax
push dword [ebp - 0x20014]
call ebx
lea eax, [ebp - 0x20010]
jmp 0x401e39
lea eax, [ebp - 0x10010]
push eax
mov ecx, esi
call fcn.00403b44
lea ecx, [ebp - 0x20014]
call fcn.00403cc2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f870
leave
ret