Function at 0x472230
Capabilities:
Get common file path
Get comspec environment variable
Get hostname
Get keyboard layout
Get program files directory
Get session user name
Get startup folder
Query environment variable

Disassembly:
sub esp, 0x53c
push ebx
push ebp
mov ebp, dword [esp + 0x54c]
push esi
mov esi, dword [esp + 0x54c]
push edi
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x72]
push ecx
mov word [esp + 0x74], ax
call fcn.00414580
add esp, 0xc
xor edx, edx
push 0x208
push edx
lea eax, [esp + 0x342]
push eax
mov word [esp + 0x344], dx
call fcn.00414580
mov ecx, dword [esp + 0x564]
add esp, 0xc
xor edi, edi
mov dword [esp + 0x10], ecx
lea ebx, [edi + 1]
mov edx, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x492930]
push edx
push eax
call fcn.00414774
add esp, 8
test eax, eax
je 0x4722b2
add edi, ebx
cmp edi, 0x60
jl 0x472292
cmp edi, 0x60
jne 0x47232d
mov edi, 0x48c5e0
lea esi, [esp + 0x28]
call fcn.00405a50
lea ecx, [esp + 0x558]
push ecx
mov eax, esi
mov dword [esp + 0x14], 0
call fcn.00401da0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
xor ecx, ecx
call fcn.00401810
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x472317
mov ecx, esi
call fcn.004059c0
lea ecx, [esp + 0x558]
call fcn.004059c0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x53c
ret 0x18
push eax
mov ebx, ebp
call fcn.00404c00
lea ecx, [esp + 0x28]
call fcn.004059c0
jmp case.default.0x472336
cmp edi, 0x5f
ja case.default.0x472336
jmp dword [edi*4 + 0x473044]
mov edi, 0x48c63c
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edi, 0x485eb4
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edi, 0x48815c
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edi, 0x48c640
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
lea eax, [edx + esi + 4]
call fcn.004053d0
mov edi, dword [eax + 0x14]
mov esi, ebp
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx + esi + 4]
call fcn.004053d0
mov edi, dword [eax + 0x1c]
mov esi, ebp
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [esp + 0x26]
push eax
push 0x48c644
lea ecx, [esp + 0x70]
push ecx
call fcn.004148ca
add esp, 0xc
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x48c650
lea edx, [esp + 0x2d0]
push edx
lea eax, [esp + 0x2bc]
push eax
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x2cc]
call fcn.004059c0
jmp case.default.0x472336
push 0x48c658
lea ecx, [esp + 0x280]
push ecx
lea edx, [esp + 0x314]
push edx
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x27c]
call fcn.004059c0
jmp case.default.0x472336
push 0x48c660
lea eax, [esp + 0x2f0]
push eax
lea ecx, [esp + 0x31c]
push ecx
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x2ec]
call fcn.004059c0
jmp case.default.0x472336
push 0x488154
lea edx, [esp + 0x290]
push edx
lea eax, [esp + 0x324]
push eax
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x28c]
call fcn.004059c0
jmp case.default.0x472336
push 0x48c668
lea ecx, [esp + 0x2a8]
push ecx
lea edx, [esp + 0x30c]
push edx
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x2a4]
call fcn.004059c0
jmp case.default.0x472336
push 0x48c670
lea eax, [esp + 0x2c0]
push eax
lea ecx, [esp + 0x2a4]
push ecx
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x2bc]
call fcn.004059c0
jmp case.default.0x472336
lea edx, [esp + 0x2fc]
push edx
call fcn.00444e01
push eax
call fcn.00450dd2
push eax
push 0x488154
lea eax, [esp + 0x70]
push eax
jmp 0x4723dc
push 0x48c678
lea ecx, [esp + 0x2e0]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00444e01
push eax
call fcn.00450d56
mov edi, eax
mov esi, ebp
call fcn.0040f120
lea ecx, [esp + 0x2dc]
call fcn.004059c0
jmp case.default.0x472336
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x2e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x1f
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x16
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 6
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x68]
push ecx
push 0
push 0
push 2
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x68]
push edx
push 0
push 0
push 0xb
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov ecx, dword [0x4a6d9c]
cmp byte [ecx + 0x2a], 0
push 0x104
lea edx, [esp + 0x6c]
push edx
je 0x472868
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
call fcn.004360bc
call eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004360db
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 6
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 3
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 9
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 5
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 0xa
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 2
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 7
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 8
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 4
jmp 0x473023
mov esi, ebp
cmp byte [0x494c92], bl
jne 0x473017
call fcn.00404b80
mov dword [ebp], ebx
jmp 0x473023
mov esi, ebp
cmp byte [0x4a5ec9], bl
jne 0x473017
call fcn.00404b80
mov dword [ebp], ebx
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 0x40
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 0x41
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 0x42
jmp 0x473023
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 0x43
jmp 0x473023
mov edi, dword [esi + 0xc0]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edi, dword [esi + 0xb0]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edi, dword [esi + 0xd0]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov eax, dword [esi + 0xec]
push eax
call fcn.0043a0b7
mov esi, ebp
mov edi, eax
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
lea ecx, [esp + 0x68]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edx, dword [0x4a6d9c]
movzx eax, word [edx + 0x2c]
test eax, eax
je 0x472a6e
cmp eax, 6
je 0x472a4b
mov ebx, ebp
cmp eax, 9
jne 0x472b3e
mov edi, 0x48c694
call fcn.0040f160
jmp case.default.0x472336
mov edi, str.IA64
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
call fcn.004120a0
mov edi, 0x48c694
test al, al
jne 0x4723e8
mov edi, 0x48c680
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov edi, str.WIN32_NT
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov eax, dword [0x4a6d9c]
cmp byte [eax + 0x28], bl
jne 0x472aab
mov edi, str.WIN_2008R2
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
cmp byte [eax + 0x26], bl
jne 0x472ac1
mov edi, str.WIN_7
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
cmp byte [eax + 0x24], bl
jne 0x472ad7
mov edi, str.WIN_2008
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
cmp byte [eax + 0x22], bl
jne 0x472aed
mov edi, str.WIN_VISTA
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
cmp byte [eax + 0x20], bl
jne 0x472b03
mov edi, str.WIN_2003
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
cmp byte [eax + 0x1e], bl
jne 0x472b28
cmp byte [eax + 0x2e], 0
mov edi, str.WIN_XPe
jne 0x4723e8
mov edi, str.WIN_XP
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
cmp byte [eax + 0x1c], bl
mov ebx, ebp
jne 0x472b3e
mov edi, str.WIN_2000
call fcn.0040f160
jmp case.default.0x472336
mov edi, str.UNKNOWN
call fcn.0040f160
jmp case.default.0x472336
mov eax, dword [0x4a6d9c]
mov edi, dword [eax + 8]
mov esi, ebp
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
mov edi, dword [0x4a6d9c]
add edi, 0xc
mov esi, ebp
call fcn.0040f120
jmp case.default.0x472336
push 0x104
push str.InstallLanguage
push str.SYSTEMCurrentControlSetControlNlsLanguage
push reloc.OLEAUT32.dll_SysReAllocString
lea esi, [esp + 0x78]
call fcn.0040fa70
add esp, 0x10
mov edi, esi
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
push str.SchemeLangID
push str.Control_PanelAppearance
push reloc.WSOCK32.dll_accept
lea esi, [esp + 0x78]
call fcn.0040fa70
movzx eax, word [esp + 0x78]
push 4
push esi
push eax
mov dword [esp + 0x30], eax
call fcn.00437fd2
add esp, 0x1c
mov edi, esi
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x324]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
lea edi, [esp + 0x324]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x338]
push str.3__3__2__0
push eax
call fcn.00412a21
lea ecx, [esp + 0x340]
push ecx
xor esi, esi
xor edi, edi
call fcn.00412665
add esp, 0xc
test eax, eax
jle 0x472c75
movzx eax, word [esp + edi*2 + 0x338]
cmp ax, 0x20
je 0x472c5f
cmp ax, 0x2c
jne 0x472c55
mov edx, 0x2e
mov word [esp + esi*2 + 0x338], dx
jmp 0x472c5d
mov word [esp + esi*2 + 0x338], ax
add esi, ebx
lea eax, [esp + 0x338]
push eax
add edi, ebx
call fcn.00412665
add esp, 4
cmp edi, eax
jl 0x472c32
xor ecx, ecx
lea edi, [esp + 0x338]
mov ebx, ebp
mov word [esp + esi*2 + 0x338], cx
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea edx, [esp + 0x6c]
push edx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00438667
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x48]
push ecx
push 2
call fcn.00438667
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x48]
push edx
push 3
call fcn.00438667
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x48]
push eax
push 4
call fcn.00438667
add esp, 8
lea edi, [esp + 0x48]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x40]
mov esi, ebp
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x44]
mov esi, ebp
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0xc
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.00404b80
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push ecx
push edi
mov dword [ebp + 8], ebx
mov dword [ebp], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x472336
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetDC]
push 0x74
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, ebp
mov dword [esp + 0x18], eax
call fcn.00404b80
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push eax
push edi
mov dword [ebp + 8], ebx
mov dword [ebp], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp case.default.0x472336
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea edx, [esp + 0x68]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea esi, [esp + 0x68]
call fcn.0040ff20
mov edi, esi
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
mov eax, dword [0x4a56fc]
cmp eax, 3
je case.0x472336.43
cmp eax, 4
jne case.0x472336.30
mov esi, ebp
call fcn.00404b80
mov dword [ebp], ebx
jmp 0x473023
push 0x104
lea edx, [esp + 0x6c]
push edx
push str.USERPROFILE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea eax, [esp + 0x6c]
push eax
push str.HOMEDRIVE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.HOMEPATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea edx, [esp + 0x6c]
push edx
push str.HOMESHARE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea eax, [esp + 0x6c]
push eax
push str.LOGONSERVER
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea ecx, [esp + 0x6c]
push ecx
push str.USERDOMAIN
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push 0x104
lea edx, [esp + 0x6c]
push edx
push str.USERDNSDOMAIN
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
lea edi, [esp + 0x68]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
push esi
call fcn.004451d5
mov esi, ebp
mov edi, eax
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
push esi
call fcn.00451163
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x18]
push eax
push ebp
call fcn.00451e50
jmp case.default.0x472336
mov edi, dword [esi + 0x140]
mov esi, ebp
call fcn.00404b80
mov dword [ebp], edi
jmp 0x473023
mov edi, dword [esi + 0x144]
mov ebx, ebp
call fcn.0040f160
jmp case.default.0x472336
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
test eax, eax
jge 0x472ffa
fadd qword [0x48d2f0]
mov esi, ebp
fstp qword [esp + 0x18]
call fcn.00404b80
fld qword [esp + 0x18]
fstp qword [ebp]
mov dword [ebp + 8], 3
jmp case.default.0x472336
mov esi, ebp
call fcn.00404b80
mov dword [ebp], 0
mov dword [ebp + 8], ebx
lea ecx, [esp + 0x558]
call fcn.004059c0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x53c
ret 0x18