Function at 0x4c2938
Capabilities:
Delete file
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x41c], edx
mov esi, ecx
mov dword [ebp - 0x420], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp + 0x38]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x450], ecx
mov ecx, dword [ebp + 0x3c]
mov dword [ebp - 0x444], ecx
xor ecx, ecx
mov dword [ebp - 0x448], eax
mov ebx, ecx
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], ecx
inc ecx
cmp dword [ebp + 0x18], 3
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x34]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x42c], ebx
je 0x4c2a0e
cmp dword [ebp + 0x18], ebx
je 0x4c2a0e
lea ecx, [ebp - 0x424]
push ecx
push edx
mov edx, eax
mov ecx, edi
call fcn.004c057b
test eax, eax
je 0x4c29f5
push eax
push 0x119f00ca
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [ebp - 0x424]
test edi, edi
jne 0x4c2a5e
mov eax, dword [ebp - 0x428]
xor ecx, ecx
mov edx, dword [ebp - 0x438]
inc ecx
push edx
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
mov edi, eax
test edi, edi
jne 0x4c2a56
call fcn.004c73cc
mov edx, dword [ebp - 0x41c]
mov esi, eax
push ecx
mov ecx, dword [ebp - 0x420]
xor eax, eax
push eax
push 0x20000010
push esi
push 0x100
push eax
call fcn.004c4d85
push esi
push 0x11b200ca
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4c2ea3
xor eax, eax
mov dword [ebp - 0x428], eax
lea edx, [ebp - 0x424]
mov ecx, edi
call fcn.004d9681
test eax, eax
je 0x4c2ac2
push eax
push 0x11b800ca
call dword [sym.imp.certcli.dll_Ordinal_357]
push edi
push dword [ebp - 0x438]
mov edx, dword [ebp - 0x41c]
push dword [ebp - 0x428]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0x440]
push dword [ebp - 0x418]
push dword [ebp - 0x448]
push ecx
mov ecx, esi
call fcn.004c26bf
mov esi, eax
test esi, esi
je 0x4c2b35
push esi
push 0x11e100ca
jmp 0x4c2e61
mov eax, dword [ebp + 0x20]
shl eax, 0x10
or eax, dword [ebp + 0x1c]
cmp eax, dword [ebp - 0x424]
je 0x4c2a7b
lea eax, [ebp - 0x430]
xor edx, edx
push eax
push dword [ebp + 0x20]
mov ecx, esi
push dword [ebp + 0x1c]
push dword [ebp - 0x418]
call fcn.004bc725
test eax, eax
je 0x4c2aff
push eax
push 0x11c400ca
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edx, dword [ebp - 0x41c]
mov esi, 0x8007000d
push ecx
push dword [ebp - 0x430]
mov ecx, dword [ebp - 0x420]
xor eax, eax
push 0x20000010
push esi
push 0xfd
push eax
call fcn.004c4d85
push esi
push 0x11cf00ca
jmp 0x4c2e61
mov ecx, dword [ebp - 0x418]
push edi
push dword [ebp + 0x1c]
call fcn.004eb0bc
mov esi, eax
test esi, esi
je 0x4c2b55
push esi
push 0x11e600ca
jmp 0x4c2e61
cmp dword [ebp + 0x24], ebx
je 0x4c2c50
or dword [ebp - 0x470], 0xffffffff
lea edx, [ebp - 0x470]
xor eax, eax
xor esi, esi
mov dword [ebp - 0x46c], eax
inc esi
mov dword [ebp - 0x468], eax
xor ecx, ecx
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x448]
push eax
mov dword [ebp - 0x43c], esi
call fcn.004dee7c
test eax, eax
je 0x4c2bbd
push 0x80070002
push eax
push 0x13970191
call dword [sym.imp.certcli.dll_Ordinal_358]
cmp dword [ebp - 0x470], 0xffffffff
je 0x4c2c14
lea eax, [ebp - 0x43c]
mov edx, 0x4278b8
push eax
push ecx
push 0x42794c
lea ecx, [ebp - 0x470]
call fcn.004df0cd
test eax, eax
je 0x4c2bfa
push eax
push 0x13a60191
push 0x42794c
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4c2c00
mov esi, dword [ebp - 0x43c]
cmp dword [ebp - 0x470], 0xffffffff
je 0x4c2c14
lea ecx, [ebp - 0x470]
call fcn.004df04e
push dword [ebp - 0x444]
mov edx, dword [ebp - 0x418]
mov ecx, dword [ebp - 0x44c]
push edi
push dword [ebp + 0x28]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x440]
call fcn.004c1c08
mov esi, eax
test esi, esi
je 0x4c2c50
push esi
push 0x11fb00ca
jmp 0x4c2e61
mov esi, dword [ebp - 0x450]
test esi, esi
je 0x4c2cac
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4c2c7c
call fcn.004c73cc
push 0x80070002
push eax
push 0x120900ca
push esi
call dword [sym.imp.certcli.dll_Ordinal_360]
mov edx, dword [edi + 4]
push ecx
push dword [ebp - 0x41c]
mov ecx, esi
push dword [ebp - 0x420]
push dword [edi + 8]
call fcn.004bf803
test eax, eax
jne 0x4c2cac
call fcn.004c73cc
push eax
push 0x121400ca
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
mov esi, 0x104
lea eax, [ebp - 0x414]
push esi
push eax
push 0x427e9c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4c2e33
cmp eax, esi
jae 0x4c2e33
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x454]
jne 0x4c2cdd
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x1d]
cmp eax, esi
jbe 0x4c2d07
mov esi, 0x80070003
push esi
push 0x122c00ca
jmp 0x4c2e61
lea ecx, [ebp - 0x20c]
lea edx, [ebp - 0x414]
mov eax, ecx
sub edx, eax
lea eax, [esi + 0x7ffffefa]
test eax, eax
je 0x4c2d3c
movzx eax, word [edx + ecx]
test ax, ax
je 0x4c2d35
mov word [ecx], ax
add ecx, 2
sub esi, 1
jne 0x4c2d17
test esi, esi
jne 0x4c2d3c
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea ecx, [ebp - 0x20c]
push 0x427eb4
call fcn.00463e4a
mov edx, dword [ebp - 0x418]
lea ecx, [ebp - 0x20c]
xor eax, eax
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x42c]
push dword [ebp - 0x420]
push eax
push dword [ebp + 0x1c]
push 0x40ee10
call fcn.004c0232
mov esi, eax
test esi, esi
je 0x4c2d9d
push esi
push 0x123b00ca
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ebx, dword [ebp - 0x42c]
jmp 0x4c2e67
mov ebx, dword [ebp - 0x42c]
push 0x102
push dword [edi + 8]
push dword [edi + 4]
push ebx
call dword [sym.imp.certcli.dll_Ordinal_225]
mov esi, eax
test esi, esi
je 0x4c2de4
mov edx, dword [ebp - 0x41c]
xor eax, eax
push ecx
mov ecx, dword [ebp - 0x420]
push ebx
push 0x20000010
push esi
push 0x11d
push eax
call fcn.004c4d85
push esi
push 0x124b00ca
jmp 0x4c2e61
cmp dword [ebp + 0x28], 0
jne 0x4c2e67
mov edx, dword [ebp + 0x20]
lea eax, [ebp - 0x434]
push eax
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.004ccce0
mov esi, eax
test esi, esi
je 0x4c2e0e
push esi
push 0x125700ca
jmp 0x4c2e61
push dword [ebp - 0x444]
mov edx, dword [ebp + 0x24]
push dword [ebp + 0x24]
mov ecx, dword [ebp - 0x418]
call fcn.004c3611
mov esi, eax
test esi, esi
je 0x4c2e67
push esi
push 0x125e00ca
jmp 0x4c2e61
mov edx, dword [ebp - 0x41c]
mov ecx, 0x80070002
push ecx
xor eax, eax
mov esi, ecx
push eax
push 0x20000010
push ecx
mov ecx, dword [ebp - 0x420]
push 0x107
push eax
call fcn.004c4d85
push esi
push 0x122500ca
call dword [sym.imp.certcli.dll_Ordinal_357]
test edi, edi
je 0x4c2e72
push edi
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [ebp - 0x430]
test eax, eax
je 0x4c2e83
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x434], 0
je 0x4c2e98
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x4c2ea3
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0x38