Function at 0x4a6320
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x80c
mov eax, dword [esp + 0x824]
mov dword [eax + 4], 0
lea esi, [esp + 0xc]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
mov eax, 0x400
xor ecx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, esp
nop
cmp ecx, eax
je 0x4a6381
ja 0x4a637b
cmp dword [esp + 8], eax
jae 0x4a637b
mov ecx, edi
push 2
push eax
push esi
mov ebx, eax
call fcn.0046e2c0
mov eax, ebx
mov dword [esp + 4], eax
mov ecx, eax
push ecx
push dword [esp + 4]
push 0x515e8a
call ebp
test eax, eax
je 0x4a63c4
mov ecx, dword [esp + 4]
cmp eax, ecx
ja 0x4a6360
mov dword [esp + 4], eax
mov edx, dword [esp]
mov ecx, 0xfde9
mov edi, dword [esp + 0x824]
push edi
push eax
call fcn.004ab0c0
add esp, 8
test eax, eax
sete bl
mov eax, dword [esp]
cmp eax, esi
jne 0x4a63d4
jmp 0x4a63dd
xor ebx, ebx
mov edi, dword [esp + 0x824]
mov eax, dword [esp]
cmp eax, esi
je 0x4a63dd
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
test bl, bl
jne 0x4a6541
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
mov eax, 0x400
xor ecx, ecx
mov edi, esp
nop word cs:[eax + eax]
cmp ecx, eax
je 0x4a6431
ja 0x4a642b
cmp dword [esp + 8], eax
jae 0x4a642b
mov ecx, edi
push 2
push eax
push esi
mov ebx, eax
call fcn.0046e2c0
mov eax, ebx
mov dword [esp + 4], eax
mov ecx, eax
push ecx
push dword [esp + 4]
push str.TEMP
call ebp
test eax, eax
je 0x4a6474
mov ecx, dword [esp + 4]
cmp eax, ecx
ja 0x4a6410
mov dword [esp + 4], eax
mov edx, dword [esp]
mov ecx, 0xfde9
mov edi, dword [esp + 0x824]
push edi
push eax
call fcn.004ab0c0
add esp, 8
test eax, eax
sete bl
mov eax, dword [esp]
cmp eax, esi
jne 0x4a6484
jmp 0x4a648d
xor ebx, ebx
mov edi, dword [esp + 0x824]
mov eax, dword [esp]
cmp eax, esi
je 0x4a648d
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
test bl, bl
jne 0x4a6541
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x400
mov eax, 0x400
xor ecx, ecx
mov edi, esp
nop word cs:[eax + eax]
cmp ecx, eax
je 0x4a64e1
ja 0x4a64db
cmp dword [esp + 8], eax
jae 0x4a64db
mov ecx, edi
push 2
push eax
push esi
mov ebx, eax
call fcn.0046e2c0
mov eax, ebx
mov dword [esp + 4], eax
mov ecx, eax
push ecx
push dword [esp + 4]
push str.USERPROFILE
call ebp
test eax, eax
je 0x4a6524
mov ecx, dword [esp + 4]
cmp eax, ecx
ja 0x4a64c0
mov dword [esp + 4], eax
mov edx, dword [esp]
mov ecx, 0xfde9
mov edi, dword [esp + 0x824]
push edi
push eax
call fcn.004ab0c0
add esp, 8
test eax, eax
sete bl
mov eax, dword [esp]
cmp eax, esi
jne 0x4a6534
jmp 0x4a653d
xor ebx, ebx
mov edi, dword [esp + 0x824]
mov eax, dword [esp]
cmp eax, esi
je 0x4a653d
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
test bl, bl
je 0x4a6560
push 0
push edi
call fcn.004a3e30
add esp, 8
push edi
call fcn.004a7010
add esp, 4
add esp, 0x80c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [edi + 4]
lea edx, [eax + 7]
cmp dword [edi + 8], edx
jae 0x4a657c
lea eax, [edi + 0xc]
mov ecx, edi
push 1
push edx
push eax
call fcn.0046e2c0
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov dword [ecx + eax + 3], 0x706d6554
mov dword [ecx + eax], 0x545c3a43
add dword [edi + 4], 7
push 0
push edi
call fcn.004a3e30
add esp, 8
jmp 0x4a6555