Function at 0x10004bd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100189e1
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x100b6010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x344], edi
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x370], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x398], ebx
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x388], ebx
mov dword [ebp - 0x390], ebx
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x38c], ebx
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 0x348], ebx
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x350], ebx
push 0x224
lea eax, [ebp - 0x338]
push ebx
mov esi, 0x80
push eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x33c], esi
call fcn.1000f830
push 0x104
lea ecx, [ebp - 0x114]
push ebx
push ecx
mov dword [ebp - 0x338], 0x224
call fcn.1000f830
add esp, 0x18
cmp edi, ebx
je 0x10004fbb
cmp dword [ebp + 8], ebx
jne 0x10004cf7
mov eax, dword [0x100b7fa0]
cmp eax, ebx
je 0x10004cf7
push eax
push edi
call fcn.10008bc0
add esp, 8
test eax, eax
je 0x10004cf7
mov dword [ebp - 0x340], 1
jmp 0x10004fbb
mov eax, 0x10
call fcn.10007210
push 0x22
push eax
lea ebx, [ebp - 0x380]
call fcn.10008890
test eax, eax
je 0x10004ed3
xor eax, eax
call fcn.10007210
push 0
push eax
call fcn.10008890
test eax, eax
je 0x10004ed3
mov eax, 0x11
call fcn.10007210
push 0xb
push eax
call fcn.10008890
test eax, eax
je 0x10004ed3
mov eax, dword [ebp - 0x370]
lea edx, [ebp - 0x360]
push edx
push 1
push 0
push eax
push 0x80000002
call dword [0x100b7f80]
test eax, eax
jne 0x10004ed3
mov eax, 6
call fcn.10007210
mov ecx, dword [ebp - 0x360]
push eax
push ecx
lea edi, [ebp - 0x398]
call fcn.100090f0
add esp, 8
test eax, eax
je 0x10004ecd
mov ebx, dword [ebp - 0x388]
mov dword [ebp - 0x364], 0
jmp 0x10004db6
mov esi, dword [ebp - 0x33c]
lea edi, [esi + 4]
test edi, edi
jne 0x10004dd0
lea esi, [ebp - 0x35c]
call fcn.100089f0
mov esi, dword [ebp - 0x33c]
jmp 0x10004e28
cmp edi, dword [ebp - 0x358]
jbe 0x10004e1d
lea esi, [ebp - 0x35c]
call fcn.100089f0
mov edx, dword [ebp - 0x348]
push edx
mov edx, dword [ebp - 0x35c]
lea esi, [ebp - 0x368]
mov dword [ebp - 0x368], edi
call fcn.10008760
mov dword [ebp - 0x34c], eax
test eax, eax
je 0x10004ecd
mov esi, dword [ebp - 0x33c]
mov dword [ebp - 0x358], edi
jmp 0x10004e28
lea edx, [ebp - 0x35c]
call fcn.100089c0
mov eax, dword [ebp - 0x34c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
test eax, eax
jne 0x10004e46
lea ecx, [esi + esi]
mov dword [ebp - 0x33c], ecx
jmp 0x10004e53
cmp eax, esi
jbe 0x10004e6b
add eax, 4
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp eax, 4
jb 0x10004db0
jmp 0x10004e95
mov eax, dword [ebp - 0x34c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004e74
mov ecx, dword [ebp - 0x358]
sub eax, edx
mov dword [ebp - 0x350], eax
cmp eax, ecx
jbe 0x10004e8f
mov eax, ecx
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0
je 0x10004ecd
mov edx, dword [ebp - 0x344]
mov dword [ebp - 0x340], 1
call fcn.100089c0
mov eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x34c]
push eax
push ecx
mov ebx, edx
call fcn.10008890
jmp 0x10004fb9
mov edi, dword [ebp - 0x344]
cmp dword [ebp + 8], 0
jne 0x10004fb9
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push 8
call dword [0x100b7f04]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004fb9
lea edx, [ebp - 0x338]
push edx
push esi
call dword [0x100b7f48]
test eax, eax
je 0x10004fb2
lea eax, [ebp - 0x338]
push eax
push esi
call dword [0x100b7f4c]
test eax, eax
je 0x10004fb2
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x114]
push 0x104
push edx
call fcn.1000a38e
lea eax, [ebp - 0x114]
push eax
call fcn.1000a092
mov eax, 0x12
call fcn.10007210
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.1000a5c2
add esp, 0x18
test eax, eax
jne 0x10004f79
lea edx, [ebp - 0x338]
push edx
push esi
call dword [0x100b7f4c]
test eax, eax
jne 0x10004f23
jmp 0x10004fb2
lea eax, [ebp - 0x114]
push edi
push eax
call fcn.10008d70
add esp, 8
test eax, eax
jne 0x10004fa8
mov edx, edi
call fcn.100089c0
push 0
lea ecx, [ebp - 0x114]
push ecx
mov ebx, edi
call fcn.10008890
test eax, eax
je 0x10004fb2
mov dword [ebp - 0x340], 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
lea esi, [ebp - 0x35c]
mov byte [ebp - 4], 1
call fcn.100089f0
lea esi, [ebp - 0x398]
mov byte [ebp - 4], bl
call fcn.100089f0
lea esi, [ebp - 0x380]
mov dword [ebp - 4], 0xffffffff
call fcn.100089f0
mov eax, dword [ebp - 0x340]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10009563
mov esp, ebp
pop ebp
ret