Function at 0x4612e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517b7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x303b0
call fcn.0050f9a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
cmp dword [0x15797b0], esi
jne 0x461324
call fcn.00460da0
cmp dword [0x15797b0], esi
je 0x461865
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x303c0], esi
push 0x30014
push esi
lea eax, [ebp - 0x303bc]
push eax
call sub.MSVCR100.dll_memset
mov word [ebp - 0x3a8], si
push 0x1d6
push esi
lea ecx, [ebp - 0x3a6]
push ecx
call sub.MSVCR100.dll_memset
mov dword [ebp - 0xb8], esi
push 0x8c
push esi
lea edx, [ebp - 0xb4]
push edx
call sub.MSVCR100.dll_memset
add esp, 0x24
mov dword [ebp - 4], esi
push 0x30018
push esi
lea eax, [ebp - 0x303c0]
push eax
call sub.MSVCR100.dll_memset
push 0x1d8
push esi
lea ecx, [ebp - 0x3a8]
push ecx
call sub.MSVCR100.dll_memset
push 0x90
push esi
lea edx, [ebp - 0xb8]
push edx
call sub.MSVCR100.dll_memset
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, eax
push 0x18
push 8
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call ebx
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x461865
lea eax, [ebp - 0x18]
push eax
push 0x18
push esi
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [0x15797b0]
mov dword [ebp - 0x24], eax
test eax, eax
js 0x461672
cmp dword [ebp - 0x18], 0x18
jbe 0x461437
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x18]
push edx
push 8
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x461865
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push esi
push 0
mov edx, dword [ebp + 8]
push edx
call dword [0x15797b0]
mov dword [ebp - 0x24], eax
test eax, eax
js 0x461672
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x303c0], eax
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x303bc], ecx
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x303ac], edx
mov eax, dword [esi]
mov dword [ebp - 0x303a8], eax
mov ecx, dword [esi + 4]
mov dword [ebp - 0x303b4], ecx
mov edx, dword [esi + 8]
mov dword [ebp - 0x303b0], edx
cmp dword [esi + 4], 0
je 0x461652
lea eax, [ebp - 0x14]
push eax
push 0x1d8
lea ecx, [ebp - 0x3a8]
push ecx
mov edx, dword [esi + 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x461652
mov ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x303b8], ecx
mov dl, byte [ebp - 0x3a6]
mov byte [ebp - 0x303a4], dl
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x90
lea ecx, [ebp - 0xb8]
push ecx
mov edx, dword [ebp - 0x398]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x461652
mov ax, word [ebp - 0x78]
test ax, ax
je 0x461566
movzx ecx, ax
lea edx, [ecx + ecx + 4]
push edx
push 8
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x461560
lea eax, [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x78]
push ecx
push ebx
mov edx, dword [ebp - 0x74]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x461546
mov ecx, 0xfffe
mov ax, word [ebp - 0x78]
cmp ax, cx
jb 0x461537
lea eax, [ecx - 2]
jmp 0x46153a
movzx eax, ax
push ebx
lea ecx, [ebp - 0x203a4]
call fcn.00460d10
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x461560
mov dword [ebp - 0x1c], 0
jmp 0x461672
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ax, word [ebp - 0x80]
test ax, ax
je 0x4615df
mov dword [ebp - 0x14], 0
movzx edx, ax
lea eax, [edx + edx + 4]
push eax
push 8
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x4615d9
lea ecx, [ebp - 0x14]
push ecx
movzx edx, word [ebp - 0x80]
push edx
push ebx
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4615c7
mov edx, 0xfffe
mov ax, word [ebp - 0x80]
cmp ax, dx
jb 0x4615b8
lea eax, [edx - 2]
jmp 0x4615bb
movzx eax, ax
push ebx
lea ecx, [ebp - 0x303a2]
call fcn.00460d10
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x461554
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ax, word [ebp - 0x40]
test ax, ax
je 0x461652
mov dword [ebp - 0x14], 0
movzx eax, ax
lea ecx, [eax + eax + 4]
push ecx
push 8
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x461652
lea edx, [ebp - 0x14]
push edx
movzx eax, word [ebp - 0x40]
push eax
push ebx
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x461640
mov ecx, 0xfffe
mov ax, word [ebp - 0x40]
cmp ax, cx
jb 0x461631
lea eax, [ecx - 2]
jmp 0x461634
movzx eax, ax
push ebx
lea ecx, [ebp - 0x103a6]
call fcn.00460d10
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x461554
cmp dword [ebp - 0x303c0], 4
jne 0x461672
push 0xfffc
lea edx, [ebp - 0x303a2]
push edx
push str._SystemRoot_System32_ntoskrnl.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x30018
lea eax, [ebp - 0x303c0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret