Function at 0x426a50
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cfb71
mov eax, dword fs:[0]
push eax
mov eax, 0x1ec8
call fcn.0047bc80
mov eax, dword [0x4fe080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1ec0], edi
mov esi, dword [ebp + 0x20]
mov dword [ebp - 0x1ec4], esi
push 0x504
lea eax, [ebp - 0x1e28]
mov dword [ebp - 4], 0
push eax
xorps xmm0, xmm0
push str._ProgramFiles_GoogleChromeApplicationchrome.exe
movdqu xmmword [ebp - 0x1e68], xmm0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1e28]
push eax
call fcn.0040e2d0
push eax
lea eax, [ebp - 0x1420]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x1eb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00425d90
mov ecx, eax
call fcn.00425e00
test al, al
je 0x426b0b
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x1eb0], eax
or dword [ebp - 0x1e8c], 1
mov eax, 5
push 0x30
mov word [ebp - 0x1e88], ax
lea eax, [ebp - 0x1e58]
push 0
push eax
call fcn.0047bb20
add esp, 0xc
lea ecx, [ebp - 0x1e58]
push 1
call fcn.0042c650
lea eax, [ebp - 0x1e68]
push eax
lea eax, [ebp - 0x1eb8]
push eax
lea eax, [ebp - 0x1420]
push eax
lea ecx, [ebp - 0x1e58]
call fcn.0042c6a0
test eax, eax
jne 0x426bb4
lea ecx, [ebp - 0x1ed4]
call fcn.0047aec6
mov dword [ebp - 0x1ec8], 2
push 2
mov byte [ebp - 4], 1
mov dword [ebp - method.InternetExplorerTabException.virtual_0], vtable.CannotOpenTabException.0
call fcn.00404360
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push 0x4f515c
lea eax, [ebp - 0x1ed4]
mov byte [ebp - 4], 0
push eax
call fcn.0047b07b
push 0x7d0
push dword [ebp - 0x1e68]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
xorps xmm0, xmm0
mov dword [ebp - 0x1ebc], eax
movq qword [ebp - 0x1e70], xmm0
mov esi, 0x12c
mov ecx, dword [ebp - 0x1e70]
mov dword [ebp - 0x1e74], 0
test ecx, ecx
jne 0x426c34
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x426c00
test esi, esi
jle 0x426c83
push 0x3e8
call edi
lea eax, [ebp - 0x1e74]
push eax
push 0x427330
push dword [ebp - 0x1ebc]
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 0x1e70]
dec esi
test ecx, ecx
je 0x426c00
mov edi, dword [ebp - 0x1ec0]
push 0x98
call fcn.0047a506
mov esi, eax
add esp, 4
mov dword [ebp - 0x1ebc], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x426ce0
push 0x98
push 0
push esi
call fcn.0047bb20
add esp, 0xc
mov ecx, esi
push dword [ebp - 0x1ec4]
push dword [ebp - 0x1e60]
push dword [ebp - 0x1e70]
push edi
call fcn.0041a170
mov edi, eax
jmp 0x426ce2
test ecx, ecx
jne 0x426c2e
push ecx
call fcn.0040cad0
push eax
call fcn.00404240
push eax
call fcn.0043ff60
mov ecx, eax
call fcn.004401d0
push 0
push dword [ebp - 0x1e68]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x1e68]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1e64]
call esi
lea ecx, [ebp - 0x1ed0]
call fcn.0047aec6
push 0x4f5144
lea eax, [ebp - 0x1ed0]
push eax
call fcn.0047b07b
xor edi, edi
push dword [ebp - 0x1e68]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
call esi
push dword [ebp - 0x1e64]
call esi
mov esi, dword [ebp - 0x1ec0]
lea ecx, [ebp - 0x1ec4]
push ecx
mov dword [ebp - 0x1ec4], edi
mov esi, dword [esi + 0x30]
mov ecx, esi
mov eax, dword [esi]
mov dword [ebp - 0x1ebc], eax
push dword [eax + 4]
push eax
call fcn.00425e50
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [esi + 4]
sub ecx, eax
cmp ecx, 1
jae 0x426d40
push str.list_T__too_long
call fcn.004782a5
inc eax
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x1ebc]
mov dword [eax + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
cmp dword [ebp + 0x1c], 8
jb 0x426d63
push dword [ebp + 8]
call fcn.0047a557
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b06c
mov esp, ebp
pop ebp
ret 0x1c