Function at 0x47cbc0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1008]
mov eax, 0x1008
call fcn.004b2660
push 0xffffffffffffffff
push 0x63c860
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6eed24]
xor eax, ebp
mov dword [ebp + 0x1004], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1010]
mov ebx, dword [ebp + 0x1014]
test eax, eax
je 0x47ce02
movzx ecx, word [eax]
test cx, cx
je 0x47ce02
cmp ecx, 0x25
je 0x47cc44
mov ecx, dword [ebx]
test ecx, ecx
jne 0x47cc2d
mov ecx, 0x649aa0
cmp eax, ecx
je 0x47ce14
push 0xffffffffffffffff
push eax
mov ecx, ebx
call fcn.00403940
jmp 0x47ce14
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00403940
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0
test eax, eax
jne 0x47cc7c
mov edi, 0x649aa0
mov dword [ebp - 0x14], edi
jmp 0x47cc81
mov edi, eax
mov dword [ebp - 0x14], eax
push 0
mov ecx, ebx
call fcn.00409ed0
movzx eax, word [edi + 2]
lea esi, [edi + 2]
mov edx, eax
test ax, ax
je 0x47ccb6
mov ecx, eax
lea ebx, [ebx]
cmp cx, 0x25
je 0x47cccd
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
mov edx, eax
test ax, ax
jne 0x47cca0
cmp dx, 0x25
je 0x47cccd
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.004031a0
xor esi, esi
jmp 0x47cde7
push 0x1002
lea eax, [ebp]
add esi, 2
push 0
push eax
call fcn.004b40a0
add esp, 0xc
mov dword [ebp - 0x20], 0
mov eax, esi
mov dword [ebp - 0x1c], 0
sub eax, edi
mov dword [ebp - 0x18], 0
sar eax, 1
lea ecx, [ebp - 0x20]
push eax
push edi
call fcn.00403940
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x47cd1b
mov eax, 0x649aa0
push 0x800
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ax, word [ebp]
test ax, ax
je 0x47cd49
cmp ax, 0x25
je 0x47cd49
push 0xffffffffffffffff
lea eax, [ebp]
mov ecx, ebx
push eax
call fcn.004031a0
jmp 0x47cdb0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x47cd58
mov eax, 0x649aa0
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebx]
push eax
push dword [edi*8 + 0x664010]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x47cd8b
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, 0x10
jb 0x47cd60
push 0xffffffffffffffff
push dword [ebp - 0x14]
mov ecx, ebx
call fcn.004031a0
xor esi, esi
jmp 0x47cddf
mov eax, dword [edi*8 + 0x664014]
test eax, eax
jns 0x47cda6
push 0xffffffffffffffff
push dword [ebp - 0x14]
mov ecx, ebx
call fcn.004031a0
xor esi, esi
jmp 0x47cddf
push ebx
push eax
call fcn.0047cfe0
add esp, 8
movzx eax, word [esi]
test ax, ax
je 0x47cdda
cmp eax, 0x5c
je 0x47cdc2
cmp eax, 0x2f
jne 0x47cdc5
add esi, 2
push 0x5c
push ebx
call fcn.00471640
add esp, 8
mov ecx, ebx
push 0xffffffffffffffff
push esi
call fcn.004031a0
mov esi, 1
lea ecx, [ebp - 0x20]
call fcn.00403130
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 2
test eax, eax
je 0x47cdfe
push eax
call fcn.00446420
add esp, 4
mov eax, esi
jmp 0x47ce16
mov eax, dword [ebx]
mov dword [ebx + 4], 0
test eax, eax
je 0x47ce14
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1004]
xor ecx, ebp
call fcn.004b2558
lea esp, [ebp + 0x1008]
pop ebp
ret