Function at 0x4310a0
Capabilities:
Query environment variable

Disassembly:
push 0x4c0
mov eax, 0x44a278
call fcn.0043bc61
mov edi, ecx
mov dword [ebp - 0x4b8], edi
xor ebx, ebx
mov dword [ebp - 0x4c0], edi
mov dword [ebp - 0x4bc], ebx
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
call fcn.004312b5
push dword [ebp + 0xc]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x4bc], 1
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathCanonicalizeW]
test eax, eax
je 0x431146
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4b4]
call fcn.004319bd
mov byte [ebp - 4], 2
mov ecx, dword [edi]
push 0xffffffffffffffff
push ebx
push dword [eax + 4]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - fcn.0042be10], 0x401028
test eax, eax
je 0x431146
lea ecx, [ebp - 0x4a4]
cmp eax, ecx
jne 0x456d8a
push 0x104
lea eax, [ebp - 0x420]
push eax
push dword [edi + 4]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43117a
mov eax, dword [edi]
lea ecx, [ebp - 0x420]
push 0xffffffffffffffff
push ebx
push ecx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
sub esp, 0x94
mov ecx, esp
push edi
call fcn.004312b5
lea ecx, [ebp - 0x4b4]
call fcn.0043103a
mov byte [ebp - 4], 3
mov ecx, dword [edi]
push 0xffffffffffffffff
push ebx
push dword [eax + 4]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - fcn.0042be10], 0x401028
test eax, eax
je 0x4311d4
lea ecx, [ebp - 0x4a4]
cmp eax, ecx
jne 0x456d97
mov eax, dword [edi + 0xc]
cmp eax, 0xb
jb 0x43128b
push 0xb
lea eax, [ebp - 0x4cc]
mov ecx, edi
push eax
call fcn.0042fa5b
push 0x4074ec
mov ecx, eax
call fcn.00429a8e
test eax, eax
mov eax, dword [edi + 0xc]
jne 0x43128b
add eax, 0xfffffff5
mov ecx, edi
push eax
call fcn.00424f02
sub esp, 0x94
mov ecx, esp
push edi
call fcn.004312b5
lea ecx, [ebp - 0x4b4]
call fcn.0043103a
mov byte [ebp - 4], 4
mov ecx, dword [edi]
push 0xffffffffffffffff
push ebx
push dword [eax + 4]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - fcn.0042be10], 0x401028
test eax, eax
je 0x431268
lea ecx, [ebp - 0x4a4]
cmp eax, ecx
jne 0x456dd4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], 0x401028
test eax, eax
je 0x431281
lea ecx, [ebp + 0x18]
cmp eax, ecx
jne 0x456de1
mov eax, edi
call fcn.0043bc10
ret 0x94
cmp eax, 6
jb 0x431268
push 6
lea eax, [ebp - 0x4cc]
mov ecx, edi
push eax
call fcn.0042fa5b
push 0x406e00
mov ecx, eax
call fcn.00429a8e
test eax, eax
jne 0x431268
jmp 0x456da4
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x431146
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x4311d4
mov eax, dword [edi + 0xc]
mov ecx, edi
add eax, 0xfffffffa
push eax
call fcn.00424f02
sub esp, 0x94
mov ecx, esp
push edi
call fcn.004312b5
lea ecx, [ebp - 0x4b4]
call fcn.0043103a
mov byte [ebp - 4], 5
jmp 0x43122f
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x431268
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x431281