Function at 0x427104
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x4d0
mov esi, esp
mov dword [esi + 0x4b8], ebp
lea eax, [esi + 0x4c0]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x428520
mov edi, dword fs:[0]
mov dword [eax], edi
mov dword fs:[0], eax
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], edx
call 0x427149
pop eax
lock inc dword [0x43a9b8]
jle 0x427a31
mov dword [esi + 0x70], eax
mov edi, dword fs:[0x2c]
mov eax, dword [0x43aa10]
mov eax, dword [edi + eax*4]
cmp byte [eax + 0x24], 0
jne 0x427a76
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
inc dword [eax + 0x20]
mov byte [eax + 0x24], 1
mov eax, dword [0x43a9a4]
cmp eax, 0x3ffffffd
ja 0x42728a
lea ecx, [eax + 1]
lock cmpxchg dword [0x43a9a4], ecx
jne 0x42728a
mov al, byte [0x43a9ac]
and dword [esi + 0x4c8], 0
cmp dword [0x43a9b0], 0
jne 0x42738c
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x58], eax
push eax
mov dword [esi + 0x54], ecx
call dword [ecx + 0x14]
add esp, 4
cmp byte [ebp + 0x10], 0
mov ebx, edx
mov edi, eax
mov dl, 3
mov dword [esi + 0x28], eax
jne 0x42721f
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov dl, 1
mov eax, dword [ecx + eax*4]
cmp dword [eax + 0x20], 1
ja 0x42721f
mov dl, byte [0x43a9a0]
dec dl
cmp dl, 3
jae 0x427499
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x30], edx
mov dword [esi + 0x74], eax
lea eax, [esi + 0xa8]
mov ecx, dword [ebx + 0xc]
and dword [esi + 0x4c8], 0
push edi
push eax
mov dword [esi + 4], ecx
call ecx
mov ebx, dword [esi + 0x28]
add esp, 8
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xb0]
mov edx, dword [esi + 0xa8]
mov edi, dword [esi + 0xac]
xor edi, 0xb98b1b71
xor eax, 0x63eb502c
xor edx, 0x57a64178
xor ecx, 0xd6cb5d6d
or eax, edi
or ecx, edx
or ecx, eax
jne 0x42740e
push 4
pop ecx
mov eax, ebx
jmp 0x427462
mov eax, dword [0x43a9a4]
cmp eax, 0x3fffffff
jne 0x4272ae
push 0xffffffffffffff9d
pop ecx
pause
mov eax, dword [0x43a9a4]
cmp eax, 0x3fffffff
jne 0x4272ae
test ecx, ecx
lea ecx, [ecx + 1]
jne 0x427299
mov edi, dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
lea ebx, [esi + 0xb8]
mov ecx, eax
and ecx, 0x3fffffff
cmp ecx, 0x3ffffffe
setb dl
cmp eax, 0x40000000
setb dh
test dh, dl
je 0x4272e9
lea ecx, [eax + 1]
lock cmpxchg dword [0x43a9a4], ecx
jne 0x4272ba
jmp 0x4271b3
cmp ecx, 0x3ffffffe
je 0x427359
bt eax, 0x1e
jb 0x42730b
mov ecx, eax
or ecx, 0x40000000
lock cmpxchg dword [0x43a9a4], ecx
jne 0x4272ba
jmp 0x42730d
mov ecx, eax
mov dword [esi + 0xb8], ecx
push 0xffffffffffffffff
push 4
push ebx
push 0x43a9a4
call edi
cmp eax, 1
je 0x42732a
call dword [sym.imp.kernel32.dll_GetLastError]
mov eax, dword [0x43a9a4]
cmp eax, 0x3fffffff
jne 0x4272ba
push 0xffffffffffffff9d
pop ecx
pause
lea edx, [ecx + 1]
mov eax, dword [0x43a9a4]
cmp eax, 0x3fffffff
jne 0x4272ba
test ecx, ecx
mov ecx, edx
jne 0x427339
jmp 0x4272ba
lea ecx, [esi + 0xb8]
or dword [esi + 0x4c8], 0xffffffff
mov edx, 0x407c2c
mov dword [ecx], 0x407c04
mov dword [ecx + 4], 1
and dword [ecx + 0x10], 0
mov dword [ecx + 8], 4
and dword [ecx + 0xc], 0
call fcn.004371e0
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x50]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x58], eax
push eax
mov dword [esi + 0x54], ecx
call dword [ecx + 0x14]
add esp, 4
lea ecx, [esi + 0xb8]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov al, byte [ebp + 0xc]
mov byte [ecx + 0xc], al
mov al, byte [ebp + 0x10]
mov byte [ecx + 0xd], al
mov eax, dword [0x43a9b4]
push ecx
push dword [0x43a9b0]
call dword [eax + 0x14]
add esp, 8
or dword [esi + 0x4c8], 0xffffffff
call fcn.00427d10
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
cmp byte [ebp + 0xc], 0
mov eax, dword [ecx + eax*4]
mov byte [eax + 0x24], 0
je 0x427af4
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x58]
mov edx, dword [eax + 0x10]
call fcn.00425650
lea eax, [esi + 0x98]
push ebx
push eax
call dword [esi + 4]
mov ebx, dword [esi + 0x28]
add esp, 8
mov eax, dword [esi + 0xa4]
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x98]
mov edi, dword [esi + 0x9c]
xor edi, 0x21bfe5d8
xor eax, 0x168455a3
xor edx, 0xb0d8bf23
xor ecx, 0xebf6f1b3
or eax, edi
or ecx, edx
or ecx, eax
jne 0x4276b8
mov eax, ebx
add eax, 4
push 8
pop ecx
mov eax, dword [eax]
mov ecx, dword [ebx + ecx]
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], ecx
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
movzx eax, byte [eax + 0x34]
test eax, eax
je 0x42754d
cmp eax, 1
je 0x427582
jmp 0x4275c4
lea ecx, [esi + 0xb8]
mov edx, 0x406901
push 0xe
mov dword [esi + 0x68], ebx
call fcn.004247a0
pop eax
mov ecx, dword [esi + 0xb8]
mov eax, ecx
neg eax
jno 0x4276e3
cmp byte [esi + 0xbc], 3
jne 0x427511
mov eax, dword [esi + 0xc0]
mov ecx, dword [eax]
mov dword [esi + 4], eax
mov eax, dword [eax + 4]
mov dword [esi + 8], eax
mov eax, dword [eax]
mov dword [esi + 0x30], ecx
test eax, eax
je 0x4274f2
mov dword [esi + 0x4c8], 4
push dword [esi + 0x30]
call eax
pop eax
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x427506
mov edx, dword [eax + 8]
mov ecx, dword [esi + 0x30]
call fcn.00414c90
push 4
pop edx
mov ecx, dword [esi + 4]
call fcn.00414c90
mov dl, 2
mov bl, 3
xor eax, eax
lock cmpxchg byte [0x43a9a0], bl
mov edi, dword [esi + 0x28]
mov ebx, dword [esi + 0x68]
je 0x42721f
cmp al, 4
mov dl, 3
jae 0x42721f
and dword [esi + 0x4c8], 0
shl al, 3
mov edx, 0x2010003
mov ecx, eax
shr edx, cl
jmp 0x42721f
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov edx, 0x420710
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x30]
call fcn.00420730
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov byte [eax + 0x34], 1
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x4275b5
call fcn.004378b0
mov eax, dword [0x43aa10]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0x30]
lock inc dword [eax]
jg 0x4275bc
ud2
test eax, eax
jne 0x4276c5
and dword [esi + 0x2c], 0
push 9
pop ecx
mov edx, 0x4071dc
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], ecx
and dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x43a9a1], cl
je 0x4275f6
mov ecx, 0x43a9a1
call fcn.00437aa0
mov eax, dword [0x43a9b8]
test eax, 0x7fffffff
je 0x427a25
call fcn.00437b40
xor al, 1
mov dword [esi + 4], eax
lea edi, [esi + 0x80]
mov al, byte [0x43a9a2]
lea eax, [esi + 0x60]
lea edx, [esi + 0xb8]
mov ebx, 0x415b90
lea ecx, [esi + 0x74]
mov dword [esi + 0x4c8], 5
mov dword [edi], 0x4071fc
mov dword [edi + 4], 4
and dword [edi + 0x10], 0
mov dword [edx], eax
mov dword [edx + 4], ebx
mov dword [edx + 8], ecx
lea ecx, [esi + 0x78]
mov dword [edx + 0xc], 0x426f20
mov dword [edi + 8], edx
mov dword [edi + 0xc], 3
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ebx
lea ecx, [esi + 0x10]
lea edx, [esi + 0x20]
push edi
call fcn.0041f4b0
pop eax
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
call fcn.0041f610
movzx eax, byte [esi + 0x30]
mov ecx, dword [esi + 0x70]
add ecx, dword [eax*4 + 0x427c3c]
jmp ecx
mov eax, 0x4072cc
push 0xc
pop ecx
jmp 0x427467
mov dword [esi + 0x2c], eax
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x427831
cmp ecx, 2
jne 0x42783b
xor ecx, ecx
jmp 0x427842
mov eax, dword [esi + 0xbc]
mov ebx, 0x200
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x30], 0
mov dword [esi + 4], eax
lea eax, [esi + 0x10]
and dword [eax], 0
mov dword [eax + 4], 2
and dword [eax + 8], 0
push 2
pop eax
mov dword [esi + 0x5c], eax
cmp ebx, 0x201
jae 0x42772d
lea eax, [esi + 0xb8]
mov edi, ebx
mov dword [esi + 8], 0x200
mov ebx, eax
jmp 0x427766
mov edi, dword [esi + 0x30]
sub ebx, edi
je 0x42775a
mov dword [esi + 0x4c8], 3
lea ecx, [esi + 0x10]
mov edx, edi
push 2
pop eax
push eax
push eax
push ebx
call fcn.004379e0
add esp, 0xc
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov dword [esi + 0x5c], eax
mov ebx, dword [esi + 0x5c]
mov dword [esi + 0x18], edi
mov dword [esi + 8], edi
mov dword [esi + 0x30], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push edi
mov dword [esi + 0xc], ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
jne 0x427790
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x427879
cmp ebx, edi
jne 0x4277b5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x427857
lea ebx, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs ebx, eax
jmp 0x427712
ja 0x427712
mov edx, dword [esi + 8]
mov dword [esi + 0x4c8], 3
cmp ebx, edx
jbe 0x42794f
mov ecx, ebx
push 0x407ae4
call fcn.00437220
pop eax
jmp 0x4275ba
mov ecx, 0x4068fc
push 4
pop eax
jmp 0x427842
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
dec eax
test ecx, ecx
mov edx, 0x4071dc
cmovne edx, ecx
push 9
pop ecx
cmovne ecx, eax
jmp 0x4275d0
mov dword [esi + 0x4c8], 3
push 0x28
pop edx
mov ecx, 0x406504
push 0x407af4
call fcn.00437280
pop eax
jmp 0x4275ba
call dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [esi + 0x10], 0
je 0x427894
mov ecx, dword [esi + 0x14]
mov edi, eax
push 2
pop edx
call fcn.00414c90
mov eax, edi
mov ebx, dword [esi + 0x1c]
xor ecx, ecx
mov edi, 0x80000000
cmp cl, 3
jne 0x4279a5
mov ecx, dword [eax]
mov dword [esi + 8], eax
mov eax, dword [eax + 4]
mov dword [esi + 0x30], eax
mov eax, dword [eax]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x4278cb
mov dword [esi + 0x4c8], 2
push dword [esi + 0xc]
call eax
pop eax
mov eax, dword [esi + 0x30]
cmp dword [eax + 4], 0
je 0x4278df
mov edx, dword [eax + 8]
mov ecx, dword [esi + 0xc]
call fcn.00414c90
push 4
pop edx
mov ecx, dword [esi + 8]
call fcn.00414c90
mov ebx, dword [esi + 0x1c]
mov edi, 0x80000000
jmp 0x4279a5
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0x80]
push ebx
call fcn.00422ff0
pop eax
mov eax, dword [esi + 0x84]
movsd xmm0, qword [esi + 0x88]
mov edi, dword [esi + 0x80]
cmp dword [esi + 0x10], 0
mov ebx, dword [esi + 0x1c]
mov dword [esi + 8], eax
movaps xmmword [esi + 0x30], xmm0
je 0x42798e
mov ecx, dword [esi + 0x14]
push 2
pop edx
call fcn.00414c90
mov eax, edi
neg eax
jno 0x4279a5
movdqa xmm0, xmmword [esi + 0x30]
mov ecx, dword [esi + 8]
movd eax, xmm0
jmp 0x427899
test ebx, ebx
je 0x4279b4
push 2
pop edx
mov ecx, dword [esi + 4]
call fcn.00414c90
mov eax, edi
mov dl, 2
mov bl, 3
neg eax
jo 0x427515
movdqa xmm0, xmmword [esi + 0x30]
movd eax, xmm0
cmp eax, 4
je 0x4279f0
mov ecx, dword [esi + 8]
cmp eax, 1
jne 0x427a10
cmp byte [ecx], 0x30
jne 0x427a10
test edi, edi
je 0x4279e9
xor edx, edx
inc edx
call fcn.00414c90
mov dl, 2
jmp 0x427515
mov ecx, dword [esi + 8]
cmp dword [ecx], 0x6c6c7566
jne 0x427a10
mov bl, 2
test edi, edi
je 0x427a09
xor edx, edx
inc edx
call fcn.00414c90
mov dl, 1
jmp 0x427515
mov bl, 1
test edi, edi
je 0x427a1e
xor edx, edx
inc edx
call fcn.00414c90
xor edx, edx
jmp 0x427515
mov dword [esi + 4], 0
jmp 0x427610
lea eax, [ebp + 8]
lea ecx, [esi + 0x80]
lea edx, [esi + 0x60]
mov dword [ecx], eax
lea eax, [esi + 0x4c]
mov dword [ecx + 4], 0x426f20
and dword [edx], 0
mov byte [edx + 4], 0
mov dword [ecx + 8], eax
lea eax, [esi + 0xb8]
mov dword [ecx + 0xc], 0x415bb0
mov dword [eax], 0x4072f4
mov dword [eax + 4], 3
and dword [eax + 0x10], 0
mov dword [eax + 8], ecx
jmp 0x427ad0
push ecx
call dword [edx + 0x18]
add esp, 4
xor ecx, ecx
lea ebx, [ebp + 8]
lea edi, [esi + 0x80]
inc ecx
test eax, eax
mov dword [edi], ebx
mov dword [edi + 4], 0x426f20
cmovne ecx, eax
cmove edx, eax
lea eax, [esi + 0x60]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [edi + 8], eax
lea edx, [esi + 0x78]
lea eax, [esi + 0xb8]
mov dword [edi + 0xc], 0x415b90
and dword [edx], 0
mov dword [eax], 0x407340
mov dword [eax + 4], 3
and dword [eax + 0x10], 0
mov byte [edx + 4], 0
mov dword [eax + 8], edi
lea edi, [esi + 0x10]
mov dword [eax + 0xc], 2
mov ecx, edi
push eax
call fcn.0041f4b0
pop eax
mov ecx, dword [edi]
mov edx, dword [edi + 4]
call fcn.0041f610
push 7
pop ecx
int 0x29
ud2
lea edx, [esi + 0x10]
lea eax, [esi + 0xb8]
lea edi, [esi + 0x80]
and dword [edx], 0
mov dword [eax], 0x407388
mov dword [eax + 4], 1
and dword [eax + 0x10], 0
mov dword [eax + 8], 4
and dword [eax + 0xc], 0
mov byte [edx + 4], 0
mov ecx, edi
push eax
call fcn.0041f4b0
pop eax
mov ecx, dword [edi]
mov edx, dword [edi + 4]
call fcn.0041f610
push 7
pop ecx
int 0x29
ud2