Function at 0x401862
Capabilities:
Query environment variable
Resolve path using msvcrt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407408
push 0x406620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
call fcn.004062e8
push 0x407404
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
call esi
mov dword [ebp - 0x34], eax
mov dword [esp], str._CL_
call esi
mov dword [ebp - 0x30], eax
push 1
push dword [ebp - 0x34]
call fcn.004057bb
mov dword [ebp - 0x3c], eax
push eax
call fcn.004025ad
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x30]
call fcn.004057bb
mov dword [ebp - 0x20], eax
push eax
call fcn.004025ad
mov dword [ebp - 0x40], eax
call fcn.00402852
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push dword [0x40b020]
push eax
call fcn.00402790
add esp, 0x24
cmp dword [ebp + 8], 1
jne 0x401903
cmp dword [ebp - 0x38], 0
jne 0x401903
call fcn.00403031
mov edi, 0x40b6dc
push edi
mov esi, 0x4073f4
push esi
push dword [ebp - 0x40]
push dword [ebp - 0x20]
call fcn.004025c5
add esp, 0x10
test eax, eax
jne 0x401948
push edi
push esi
mov eax, dword [ebp + 8]
dec eax
push eax
lea eax, [ebx + 4]
push eax
call fcn.004025c5
add esp, 0x10
test eax, eax
jne 0x401948
push edi
push esi
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.004025c5
add esp, 0x10
cmp dword [0x40b6dc], 0
jne 0x401959
push 0
call fcn.00403276
pop ecx
mov edi, 0x40b6a8
push edi
mov esi, 0x4073ec
push esi
push dword [ebp - 0x40]
push dword [ebp - 0x20]
call fcn.004025c5
add esp, 0x10
test eax, eax
jne 0x40199e
push edi
push esi
mov eax, dword [ebp + 8]
dec eax
push eax
lea eax, [ebx + 4]
push eax
call fcn.004025c5
add esp, 0x10
test eax, eax
jne 0x40199e
push edi
push esi
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.004025c5
add esp, 0x10
mov esi, 0x40b060
push esi
call fcn.004025ad
push eax
push esi
call fcn.0040222d
add esp, 0xc
mov eax, dword [0x40b020]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
xor edi, edi
cmp eax, edi
je 0x4019cb
or byte [eax], 1
mov eax, dword [eax + 4]
jmp 0x4019ba
mov dword [ebp - 0x44], edi
mov eax, dword [0x40b020]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
cmp eax, edi
je 0x4019f8
or byte [eax], 1
mov cl, byte [eax]
mov edx, dword [ebp - 0x44]
cmp dword [edx*4 + 0x40b0b8], edi
je 0x4019f3
or cl, 0x20
mov byte [eax], cl
inc dword [ebp - 0x44]
jmp 0x4019d3
mov dword [0x40b014], edi
cmp dword [ebp - 0x38], edi
jle 0x401a10
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.0040222d
pop ecx
pop ecx
mov eax, dword [ebp + 8]
cmp eax, 1
jle 0x401a25
dec eax
push eax
add ebx, 4
push ebx
call fcn.0040222d
pop ecx
pop ecx
cmp dword [ebp - 0x40], edi
jle 0x401a37
push dword [ebp - 0x40]
push dword [ebp - 0x20]
call fcn.0040222d
pop ecx
pop ecx
cmp dword [0x40b6b4], edi
je 0x401a4d
push 0x4073e8
push 2
call fcn.00405b55
pop ecx
pop ecx
call fcn.00402df1
push dword [0x40b020]
call fcn.00402d06
pop ecx
cmp dword [0x40b63c], edi
je 0x401a6c
mov dword [0x40b6ec], edi
cmp dword [0x40b6e4], edi
je 0x401ab0
cmp dword [0x40b62c], edi
je 0x401ab0
mov esi, dword [0x40b6a8]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], edi
mov dword [0x40b6a8], 1
push edi
lea eax, [ebp - 0x48]
push eax
push 0x40b038
call fcn.00401cb7
add esp, 0xc
mov dword [0x40b6a8], esi
mov dword [0x40b62c], edi
cmp dword [0x40b6d0], edi
je 0x401abd
call fcn.00403852
call fcn.00402462
push dword [0x40b020]
call fcn.004027b0
pop ecx
cmp dword [0x40b6d8], edi
je 0x401adb
call fcn.00405da1
mov esi, dword [0x40b6ac]
mov dword [ebp - 0x2c], esi
mov edi, 0xfa2
xor ebx, ebx
cmp esi, ebx
je 0x401b51
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x401b3e
push eax
call sub.MSVCRT.dll_strlen
mov ebx, eax
push dword [esi + 0xc]
call sub.MSVCRT.dll_strlen
lea eax, [ebx + eax + 2]
push eax
call fcn.00405f91
add esp, 0xc
mov ebx, eax
mov dword [ebp - 0x50], ebx
push dword [esi + 0x10]
push dword [esi + 0xc]
push ebx
call fcn.00405503
pop ecx
pop ecx
push eax
call fcn.00405503
push ebx
push edi
call fcn.00405ec2
push ebx
call fcn.00405fae
add esp, 0x14
jmp 0x401b49
push dword [esi + 0xc]
push edi
call fcn.00405ec2
pop ecx
pop ecx
mov esi, dword [esi + 4]
mov dword [ebp - 0x2c], esi
jmp 0x401ae9
mov eax, dword [0x40b020]
cmp dword [eax + 0xc], ebx
jne 0x401b66
push 0x7d3
call fcn.00405e70
pop ecx
mov eax, dword [0x40b628]
cmp eax, ebx
jne 0x401b78
mov dword [ebp - 0x1c], 8
jmp 0x401b9d
movzx eax, byte [eax]
sub eax, 0x43
je 0x401b9a
sub eax, 0xc
je 0x401b88
dec eax
je 0x401b91
mov dword [ebp - 0x1c], 3
jmp 0x401b9d
mov dword [ebp - 0x1c], 1
jmp 0x401b9d
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x40b020]
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x28], esi
cmp esi, ebx
je 0x401c32
cmp dword [ebp - 0x1c], 8
je 0x401bca
cmp word [esi + 0x10], bx
jne 0x401bca
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0xc], eax
mov word [esi + 0x10], 1
jmp 0x401bf3
cmp dword [esi + 0xc], 8
jne 0x401bf3
cmp dword [0x40b648], ebx
je 0x401bdd
mov dword [esi + 0xc], ebx
jmp 0x401bf3
mov dword [esi + 0xc], 3
push dword [esi + 4]
push 0xfb8
call fcn.00405ec2
pop ecx
pop ecx
mov eax, dword [esi + 0xc]
lea eax, [eax + eax*2]
mov ecx, dword [eax*4 + 0x408470]
mov dword [ebp - 0x24], ecx
mov eax, dword [ecx]
cmp eax, 5
je 0x401c1c
lea eax, [eax + eax*8]
test byte [eax*4 + 0x40b120], 1
jne 0x401c2b
add ecx, 4
jmp 0x401c00
push dword [esi + 4]
push 0xfbb
call fcn.00405ec2
pop ecx
pop ecx
mov esi, dword [esi]
jmp 0x401ba5
call fcn.00406331
push dword [0x40b020]
call fcn.00403a2d
pop ecx
mov eax, dword [0x40b020]
mov dword [eax + 0x1c], ebx
cmp dword [0x40b644], ebx
jne 0x401c91
push 0xfb5
call fcn.00405ec2
jmp 0x401c90
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [0x40b6c8]
neg eax
sbb eax, eax
and eax, 2
push eax
call fcn.00405aca
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret