Function at 0x47fc78
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x47fc80
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47ffa4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, esi
call fcn.004041b4
mov eax, esi
call fcn.0040443c
cmp eax, 3
jle 0x47ff86
mov edx, esi
mov eax, 0x47ffbc
call fcn.00404780
mov edi, eax
test edi, edi
jle 0x47fcd7
push ebx
mov ecx, edi
dec ecx
mov edx, 1
mov eax, esi
call fcn.0040469c
mov edx, esi
mov eax, 0x47ffc8
call fcn.00404780
mov edi, eax
test edi, edi
jle 0x47fcf9
push ebx
mov ecx, edi
dec ecx
mov edx, 1
mov eax, esi
call fcn.0040469c
mov edx, esi
mov eax, 0x47ffd4
call fcn.00404780
mov edi, eax
test edi, edi
jle 0x47fd1b
push ebx
mov ecx, edi
dec ecx
mov edx, 1
mov eax, esi
call fcn.0040469c
mov al, byte [esi]
add al, 0xbd
sub al, 0x18
jb 0x47fd29
add al, 0xf8
sub al, 0x18
jae 0x47fd68
cmp byte [esi + 1], 0x3a
jne 0x47fd68
cmp byte [esi + 2], 0x5c
jne 0x47fd68
mov eax, esi
call fcn.0040443c
cmp byte [esi + eax - 1], 0x20
je 0x47fd51
mov eax, esi
call fcn.0040443c
cmp byte [esi + eax - 1], 0x2c
jne 0x47fd68
push ebx
mov eax, esi
call fcn.0040443c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, esi
call fcn.0040469c
mov edx, dword [ebx]
mov eax, 0x47ffe0
call fcn.00404780
test eax, eax
je 0x47fda0
mov al, byte [0x47ffe4]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebx]
xor ecx, ecx
mov edx, 0x47ffe0
call fcn.0040d7c4
mov edx, dword [ebp - 0x108]
mov eax, ebx
call fcn.004041b4
push 0x104
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx]
call fcn.0040463c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
je 0x47fdca
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.004093c0
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebx]
mov ecx, 0xc
mov edx, 1
call fcn.0040469c
mov eax, dword [ebp - 0x10c]
mov edx, 0x47fff0
call fcn.004084e8
test eax, eax
jne 0x47fe23
mov eax, ebx
mov ecx, 0xc
mov edx, 1
call fcn.004046dc
lea edx, [ebp - 0x110]
mov al, 1
call fcn.0047f464
mov edx, dword [ebp - 0x110]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00404488
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebx]
mov ecx, 0xc
mov edx, 1
call fcn.0040469c
mov eax, dword [ebp - 0x114]
mov edx, 0x480008
call fcn.004084e8
test eax, eax
jne 0x47fe7c
mov eax, ebx
mov ecx, 0xc
mov edx, 1
call fcn.004046dc
lea edx, [ebp - 0x118]
mov al, 1
call fcn.0047f464
mov edx, dword [ebp - 0x118]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00404488
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebx]
mov ecx, 8
mov edx, 1
call fcn.0040469c
mov eax, dword [ebp - 0x11c]
mov edx, 0x480020
call fcn.004084e8
test eax, eax
jne 0x47fec4
lea edx, [ebp - 0x120]
mov al, 1
call fcn.0047f464
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00404488
lea eax, [ebp - 0x124]
push eax
mov eax, dword [ebx]
mov ecx, 9
mov edx, 1
call fcn.0040469c
mov eax, dword [ebp - 0x124]
mov edx, 0x480034
call fcn.004084e8
test eax, eax
jne 0x47ff1d
mov eax, ebx
mov ecx, 9
mov edx, 1
call fcn.004046dc
lea edx, [ebp - 0x128]
mov al, 1
call fcn.0047f464
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00404488
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebx]
mov ecx, 4
mov edx, 1
call fcn.0040469c
mov eax, dword [ebp - 0x12c]
mov edx, 0x480048
call fcn.004084e8
test eax, eax
jne 0x47ff5a
mov eax, ebx
mov ecx, 4
mov edx, 1
call fcn.004046dc
mov edx, dword [ebx]
mov eax, 0x480058
call fcn.00404780
test eax, eax
jg 0x47ff86
lea edx, [ebp - 0x130]
mov al, 1
call fcn.0047f4d8
mov edx, dword [ebp - 0x130]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00404488
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ffab
lea eax, [ebp - 0x130]
mov edx, 0xb
call fcn.00404184
ret