Function at 0x404ae7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
test byte [ebp + 0x10], 1
mov dword [ebp - 4], edi
je 0x404c12
push 0x40
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x40
push eax
call fcn.004029b4
mov esi, eax
test esi, esi
js 0x404d2b
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x404b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404b4f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404b56
mov esi, 0x80004005
push esi
push 0x108
push str.c:_agent_work36_swix_srclibsdutilpathutil.cpp
call fcn.004013b3
jmp 0x404d2b
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x404bd4
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.004029b4
mov esi, eax
test esi, esi
js 0x404d2b
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x404bbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404baf
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404bb6
mov esi, 0x80004005
push esi
push 0x113
jmp 0x404b5c
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x404bd4
mov eax, 0x8007007a
push eax
mov esi, eax
push pe_nt_image_headers32
jmp 0x404b5c
cmp eax, 0x104
jbe 0x404c0f
lea eax, [ebp - 4]
push eax
call fcn.00404ff3
lea esi, [eax + 0x7ff8ffa9]
neg esi
sbb esi, esi
and esi, eax
jl 0x404d2b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.0040321b
mov esi, eax
test esi, esi
js 0x404d2b
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
test byte [ebp + 0x10], 2
je 0x404d10
and dword [ebp + 0x10], 0
test edi, edi
jne 0x404c27
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
ja 0x404c2f
push 0x40
pop ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.004029b4
mov esi, eax
test esi, esi
js 0x404d2b
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x404c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404c6d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404c74
mov esi, 0x80004005
push esi
push 0x139
jmp 0x404b5c
cmp ebx, eax
jae 0x404cf5
mov ebx, eax
cmp eax, 0x104
jb 0x404c8f
lea ebx, [eax + 7]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.004029b4
mov esi, eax
test esi, esi
js 0x404d2b
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x404cdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404ccd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404cd4
mov esi, 0x80004005
push esi
push 0x144
jmp 0x404b5c
cmp ebx, eax
jae 0x404cf5
mov eax, 0x8007007a
push eax
mov esi, eax
push 0x149
jmp 0x404b5c
cmp eax, 0x104
jbe 0x404d0b
lea eax, [ebp - 8]
push eax
call fcn.00404ff3
mov esi, eax
test esi, esi
js 0x404d2b
mov edi, dword [ebp - 8]
jmp 0x404d17
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
test edi, edi
jne 0x404d1e
mov edi, dword [ebp + 0xc]
push 0
push edi
push dword [ebp + 8]
call fcn.00402c72
mov esi, eax
cmp dword [ebp - 8], 0
je 0x404d39
push dword [ebp - 8]
call fcn.00403136
cmp dword [ebp - 4], 0
je 0x404d47
push dword [ebp - 4]
call fcn.00403136
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc