Function at 0x471d60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0b88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4eec64]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x4f3870], 0
jne 0x471d9b
push 0
call fcn.0046fcd0
add esp, 4
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jl 0x472078
push 0x4d9fd4
push eax
call fcn.004a4ca1
add esp, 8
test eax, eax
je 0x472078
mov ecx, dword [ebx]
sub eax, ecx
sar eax, 1
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x472078
mov eax, dword [ecx - 0xc]
lea esi, [edi + 2]
test esi, esi
jl 0x472078
cmp esi, eax
jg 0x472078
lea eax, [ecx + esi*2]
push 0x4d9fd4
push eax
call fcn.004a4ca1
add esp, 8
test eax, eax
je 0x472078
sub eax, dword [ebx]
sar eax, 1
cmp eax, 0xffffffff
je 0x472078
sub eax, edi
mov dword [ebp - 0x20], eax
add eax, 0xfffffffe
push eax
push esi
lea ecx, [ebp - 0x18]
push ecx
mov ecx, ebx
call fcn.00427bb5
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], 0
je 0x472052
call fcn.004964ca
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x472131
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, 0x4cc12c
mov byte [ebp - 4], 1
test ecx, 0xffff0000
jne 0x47200f
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.0049e3ee
mov edi, eax
test edi, edi
je 0x471f30
mov eax, ebx
shr eax, 4
inc eax
movzx ecx, ax
push 6
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x471f30
push ebx
push eax
push edi
call fcn.004216e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x471f30
movzx edi, word [ebx]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x471ed2
push edi
lea ecx, [ebp - 0x10]
call fcn.004214ff
mov esi, dword [ebp - 0x10]
movzx eax, word [ebx]
add ebx, 2
mov dword [ebp - 0x1c], ebx
cmp eax, 0xffffffff
jne 0x471eea
push ebx
call fcn.004a4b1a
add esp, 4
inc eax
lea edx, [eax + eax]
mov eax, dword [ebp - 0x1c]
push edx
push eax
lea ebx, [edi + edi]
push ebx
push esi
call fcn.004a460f
add esp, 0x10
cmp eax, 0x50
ja case.0x471f0f.1
movzx ecx, byte [eax + 0x472160]
jmp dword [ecx*4 + 0x472150]
test edi, edi
jl 0x472145
cmp edi, dword [esi - 8]
jg 0x472145
xor edx, edx
mov dword [esi - 0xc], edi
mov word [ebx + esi], dx
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
mov byte [ebp - 4], 2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x514
or eax, ecx
jge 0x471f5e
push 0x514
lea ecx, [ebp - 0x10]
call fcn.004214ff
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0x514
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004a4afb
add esp, 8
test eax, eax
jl 0x472145
cmp eax, dword [esi - 8]
jg 0x472145
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [ebp - 0x1c], ecx
je 0x472032
cmp dword [esi - 0xc], ecx
je 0x472032
mov eax, dword [ebp - 0x20]
push edi
add eax, 2
push ebx
call fcn.004234c5
push esi
push ebx
mov eax, edi
call fcn.004303c3
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x471fe0
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471d9b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x471d9b
push 0x4cc12c
call fcn.004a4b1a
add esp, 4
push eax
push 0x4cc12c
lea ecx, [ebp - 0x10]
call fcn.00423f4a
mov esi, dword [ebp - 0x10]
jmp 0x471f36
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472052
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472078
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jle 0x4720e4
push 0x25
push eax
call fcn.004a536a
add esp, 8
test eax, eax
je 0x4720e4
sub eax, dword [ebx]
sar eax, 1
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x4720e4
mov dword [ebp - 0x10], 0
mov esi, 0x4f02e0
mov edx, dword [esi]
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4720b0
mov ecx, dword [ebx]
sub eax, edi
mov edi, dword [ebp - 0x14]
sar eax, 1
push eax
push edx
lea ecx, [ecx + edi*2]
push ecx
call fcn.004a56d5
add esp, 0xc
test eax, eax
je 0x4720f6
inc dword [ebp - 0x10]
add esi, 0x10
cmp esi, 0x4f0500
jl 0x4720a7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl eax, 4
mov esi, eax
mov eax, dword [esi + 0x4f02e0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472107
sub eax, edx
push edi
sar eax, 1
push ebx
call fcn.004234c5
mov edx, dword [esi + 0x4f02ec]
push edx
push ebx
mov eax, edi
call fcn.004303c3
jmp 0x471d9b
push 0x80004005
call fcn.00421000
call fcn.00496a32
call fcn.00496a6a
push 0x80070057
call fcn.00421000
nop
push ss
pop ds
inc edi
add byte [ebx], bh
and dword [edi], eax
inc eax
and dword [edi], eax
inc eax
and dword [edi], eax
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add ah, cl
int3