Function at 0x46d790
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x165
push 0
push 0
dec ecx
jne 0x46d799
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ad8
xor eax, eax
push ebp
push 0x46dfb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004046b4
lea eax, [ebp - 0xa31]
mov ecx, 0xa29
xor edx, edx
call fcn.004030b0
push 0xa29
lea eax, [ebp - 0xa31]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ae8
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
jle 0x46d818
cmp eax, 0xa29
jge 0x46d818
lea eax, [ebp - 8]
lea edx, [ebp - 0xa31]
mov ecx, 0xa29
call fcn.00404884
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa38]
push eax
xor ecx, ecx
mov edx, 0x46dfd4
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa38]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa3c]
push eax
lea edx, [ebp - 0xa40]
mov eax, ebx
call fcn.0046c1b0
mov ecx, dword [ebp - 0xa40]
mov edx, 0x46dfe4
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa3c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa44]
push eax
lea edx, [ebp - 0xa48]
mov eax, ebx
call fcn.0046d468
mov ecx, dword [ebp - 0xa48]
mov edx, 0x46dff8
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa44]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa4c]
push eax
lea edx, [ebp - 0xa50]
mov eax, ebx
call fcn.0046d468
mov ecx, dword [ebp - 0xa50]
mov edx, 0x46e008
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa4c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa54]
push eax
lea edx, [ebp - 0xa58]
mov eax, ebx
call fcn.0046c9e0
mov ecx, dword [ebp - 0xa58]
mov edx, 0x46e018
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa54]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa5c]
push eax
lea edx, [ebp - 0xa60]
mov eax, ebx
call fcn.0046c9e0
mov ecx, dword [ebp - 0xa60]
mov edx, 0x46e028
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa5c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa64]
push eax
lea edx, [ebp - 0xa68]
mov eax, ebx
call fcn.0046c970
mov ecx, dword [ebp - 0xa68]
mov edx, 0x46e03c
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa64]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa6c]
push eax
lea edx, [ebp - 0xa70]
mov eax, ebx
call fcn.0046cd94
mov ecx, dword [ebp - 0xa70]
mov edx, 0x46e050
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa6c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa74]
push eax
lea edx, [ebp - 0xa78]
mov eax, ebx
call fcn.0046cc38
mov ecx, dword [ebp - 0xa78]
mov edx, 0x46e064
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa74]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa7c]
push eax
lea edx, [ebp - 0xa80]
mov eax, ebx
call fcn.0046cef0
mov ecx, dword [ebp - 0xa80]
mov edx, 0x46e074
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa7c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa84]
push eax
lea edx, [ebp - 0xa88]
mov eax, ebx
call fcn.0046d04c
mov ecx, dword [ebp - 0xa88]
mov edx, 0x46e084
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa84]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [ebx + 0xe0]
add al, 0xf8
sub al, 3
jae 0x46db0b
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa8c]
push eax
lea edx, [ebp - 0xa98]
mov eax, ebx
call fcn.0046d1a8
mov eax, dword [ebp - 0xa98]
lea edx, [ebp - 0xa94]
call fcn.0046d72c
mov eax, dword [ebp - 0xa94]
lea edx, [ebp - 0xa90]
call fcn.0046b96c
lea eax, [ebp - 0xa90]
mov edx, 0x46e098
call fcn.004048f8
mov ecx, dword [ebp - 0xa90]
mov edx, 0x46e0ac
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa8c]
lea eax, [ebp - 8]
call fcn.004046b4
jmp 0x46db56
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xa9c]
push eax
lea edx, [ebp - 0xaa0]
mov eax, ebx
call fcn.0046c510
lea eax, [ebp - 0xaa0]
mov edx, 0x46e0c0
call fcn.004048f8
mov ecx, dword [ebp - 0xaa0]
mov edx, 0x46e0ac
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xaa4]
push eax
lea edx, [ebp - 0xaa8]
mov eax, ebx
call fcn.0046c410
lea eax, [ebp - 0xaa8]
mov edx, 0x46e0d8
call fcn.004048f8
mov ecx, dword [ebp - 0xaa8]
mov edx, 0x46e0ac
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xaa4]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xaac]
push eax
lea edx, [ebp - 0xab4]
mov eax, ebx
call fcn.0046e704
mov eax, dword [ebp - 0xab4]
lea edx, [ebp - 0xab0]
call fcn.0046b96c
lea eax, [ebp - 0xab0]
mov edx, 0x46e0e8
call fcn.004048f8
mov ecx, dword [ebp - 0xab0]
mov edx, 0x46e0f4
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xaac]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xab8]
push eax
lea edx, [ebp - 0xabc]
mov eax, ebx
call fcn.0046e704
mov ecx, dword [ebp - 0xabc]
mov edx, 0x46e110
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xab8]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xac0]
push eax
lea edx, [ebp - 0xac4]
mov eax, ebx
call fcn.0046e2fc
mov ecx, dword [ebp - 0xac4]
mov edx, 0x46e128
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xac0]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xac8]
push eax
lea edx, [ebp - 0xacc]
mov eax, ebx
call fcn.0046c970
mov ecx, dword [ebp - 0xacc]
mov edx, 0x46e140
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xad0]
push eax
lea edx, [ebp - 0xad8]
mov eax, ebx
call fcn.0046d1a8
mov eax, dword [ebp - 0xad8]
lea edx, [ebp - 0xad4]
call fcn.0046d72c
mov ecx, dword [ebp - 0xad4]
mov edx, 0x46e150
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xadc]
push eax
lea edx, [ebp - 0xae0]
mov eax, ebx
call fcn.0046c410
mov ecx, dword [ebp - 0xae0]
mov edx, 0x46e16c
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xadc]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xae4]
push eax
lea edx, [ebp - 0xae8]
mov eax, ebx
call fcn.0046c734
mov ecx, dword [ebp - 0xae8]
mov edx, 0x46e184
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xaec]
push eax
lea edx, [ebp - 0xaf0]
mov eax, ebx
call fcn.0046c734
mov ecx, dword [ebp - 0xaf0]
mov edx, 0x46e198
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xaec]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xaf4]
push eax
lea edx, [ebp - 0xaf8]
mov eax, ebx
call fcn.0046c64c
mov ecx, dword [ebp - 0xaf8]
mov edx, 0x46e1b0
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xaf4]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xafc]
push eax
lea edx, [ebp - 0xb00]
mov eax, ebx
call fcn.0046c64c
mov ecx, dword [ebp - 0xb00]
mov edx, 0x46e1c8
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xafc]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xb04]
push eax
lea edx, [ebp - 0xb08]
mov eax, ebx
call fcn.0046c410
mov ecx, dword [ebp - 0xb08]
mov edx, 0x46e1e0
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xb04]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xb0c]
push eax
lea edx, [ebp - 0xb10]
mov eax, ebx
call fcn.0046c510
mov ecx, dword [ebp - 0xb10]
mov edx, 0x46e1f4
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xb0c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xb14]
push eax
lea edx, [ebp - 0xb18]
mov eax, ebx
call fcn.0046c510
mov ecx, dword [ebp - 0xb18]
mov edx, 0x46e20c
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xb14]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xb1c]
push eax
lea edx, [ebp - 0xb20]
mov eax, ebx
call fcn.0046c870
mov ecx, dword [ebp - 0xb20]
mov edx, 0x46e220
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xb1c]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xb24]
push eax
lea edx, [ebp - 0xb28]
mov eax, ebx
call fcn.0046c870
mov ecx, dword [ebp - 0xb28]
mov edx, 0x46e234
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xb24]
lea eax, [ebp - 8]
call fcn.004046b4
mov al, byte [0x46dfc8]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea edx, [ebp - 0xb30]
mov eax, ebx
call fcn.0046e5b0
mov ecx, dword [ebp - 0xb30]
mov edx, 0x46e248
mov eax, dword [ebp - 8]
call fcn.0040e520
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 8]
call fcn.004046b4
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dfbf
lea eax, [ebp - 0xb30]
mov edx, 0x3f
call fcn.00404640
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404640
ret