Function at 0x4854d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d28af
mov eax, dword fs:[0]
push eax
sub esp, 0x2e8
mov eax, dword [0x516008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x25d]
push eax
movzx ecx, byte [ebp - 0x25e]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00413a90
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x230]
call fcn.004133c0
mov dword [ebp - 4], 2
mov edx, str.__r_t_n
lea ecx, [ebp - 0x230]
call fcn.00488f40
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0
jne 0x48557a
mov dword [ebp - 0x264], 1
jmp 0x485584
mov dword [ebp - 0x264], 0
movzx ecx, byte [ebp - 0x264]
test ecx, ecx
je 0x4855e2
mov byte [ebp - 0x251], 0
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x230]
mov dword [ebp - 0x2c0], edx
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x251]
jmp 0x485b9c
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.0041cdc0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x485683
lea edx, [ebp - 0x218]
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x258]
add eax, 2
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x258]
mov dx, word [ecx]
mov word [ebp - 0x260], dx
add dword [ebp - 0x258], 2
cmp word [ebp - 0x260], 0
jne 0x485635
mov eax, dword [ebp - 0x258]
sub eax, dword [ebp - 0x284]
sar eax, 1
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
push ecx
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x230]
call fcn.00413310
lea ecx, [ebp - 0x230]
call fcn.0048a730
movzx eax, al
test eax, eax
je 0x4856f7
lea ecx, [ebp - 0x230]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.0041ce60
mov byte [ebp - 0x24d], 1
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 8
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x230]
mov dword [ebp - 0x28c], edx
mov dword [ebp - 4], 9
mov dword [ebp - 4], 0xa
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x24d]
jmp 0x485b9c
push 0
push 0x22
lea ecx, [ebp - 0x230]
call fcn.00445260
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x485825
mov eax, dword [ebp - 0x24c]
add eax, 1
push eax
push 0x22
lea ecx, [ebp - 0x230]
call fcn.00445260
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xffffffff
je 0x485825
mov ecx, dword [ebp - 0x268]
sub ecx, dword [ebp - 0x24c]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x24c]
add edx, 1
push edx
lea eax, [ebp - 0x2dc]
push eax
lea ecx, [ebp - 0x230]
call fcn.004308e0
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x270]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00418e50
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2dc]
call fcn.004131f0
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
call fcn.0048a730
movzx ecx, al
test ecx, ecx
je 0x485825
mov byte [ebp - 0x24e], 1
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 0x11
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x230]
mov dword [ebp - 0x294], edx
mov dword [ebp - 4], 0x12
mov dword [ebp - 4], 0x13
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x24e]
jmp 0x485b9c
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x248]
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
call fcn.00413980
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x248]
call fcn.004132b0
mov byte [ebp - 4], 0x17
mov ecx, 1
test ecx, ecx
je 0x485b1f
mov edx, dword [ebp - 0x24c]
add edx, 1
push edx
push 0x20
lea ecx, [ebp - 0x230]
call fcn.00445260
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x48591c
mov byte [ebp - 0x24f], 0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x248]
call fcn.004131f0
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 2
lea eax, [ebp - 0x248]
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 2
mov dword [ebp - 4], 0x1c
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 0x1d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 4], 0x1e
mov dword [ebp - 4], 0x1f
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x24f]
jmp 0x485b9c
mov edx, dword [ebp - 0x24c]
add edx, 1
cmp dword [ebp - 0x25c], edx
jne 0x48593e
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], eax
jmp 0x485861
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x25c]
push edx
push 0
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x230]
call fcn.004308e0
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x278]
mov dword [ebp - 0x27c], ecx
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x27c]
push edx
lea ecx, [ebp - 0x248]
call fcn.00418e50
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x2f4]
call fcn.004131f0
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 4], 0x23
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x248]
call fcn.00489fc0
movzx ecx, al
test ecx, ecx
je 0x485a63
lea edx, [ebp - 0x248]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0041ce60
mov byte [ebp - 0x250], 1
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x248]
call fcn.004131f0
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 2
lea eax, [ebp - 0x248]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x28
mov byte [ebp - 4], 2
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 0x2a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 4], 0x2b
mov dword [ebp - 4], 0x2c
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x250]
jmp 0x485b9c
push 0x4f0164
lea ecx, [ebp - 0x248]
call fcn.0041ce00
lea ecx, [ebp - 0x248]
call fcn.00489fc0
movzx edx, al
test edx, edx
je 0x485b1a
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0041ce60
mov byte [ebp - 0x253], 1
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x248]
call fcn.004131f0
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x2ac], ecx
mov byte [ebp - 4], 0x2f
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 2
mov dword [ebp - 4], 0x31
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 0x32
mov dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x230]
mov dword [ebp - 0x2b0], edx
mov dword [ebp - 4], 0x33
mov dword [ebp - 4], 0x34
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x253]
jmp 0x485b9c
jmp 0x485861
mov byte [ebp - 0x252], 0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x248]
call fcn.004131f0
mov byte [ebp - 4], 0x36
mov byte [ebp - 4], 2
lea eax, [ebp - 0x248]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 4], 0x37
mov byte [ebp - 4], 0x38
mov byte [ebp - 4], 2
mov dword [ebp - 4], 0x39
lea ecx, [ebp - 0x230]
call fcn.004131f0
mov dword [ebp - 4], 0x3a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x2c4], ecx
mov dword [ebp - 4], 0x3b
mov dword [ebp - 4], 0x3c
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x252]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b8ad3
mov esp, ebp
pop ebp
ret 8