Function at 0x100468a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc54
lea eax, [ebp - 4]
push eax
push 0x100249c
push 0x10024bc
call fcn.01006b1a
test eax, eax
jl 0x10049a7
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x1001aa4
push eax
call dword [ecx]
mov eax, dword [0x1009258]
mov eax, dword [eax]
and dword [ebp - 0xc], 0
test eax, eax
mov dword [ebp - 0x18], eax
jle 0x1004995
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, 0x104
push dword [ebp - 0xc]
push dword [0x1009258]
call dword [sym.imp.COMCTL32.dll_DSA_GetItemPtr]
mov esi, eax
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
add eax, dword [ebp + 0x10]
push eax
call fcn.01006854
push edi
lea eax, [ebp - 0x22c]
push eax
push dword [esi + 4]
call dword [sym.imp.COMCTL32.dll_Ordinal_235]
lea eax, [ebp - 0x22c]
push eax
call sub.SHELL32.dll_Ordinal_33
lea eax, [ebp - 0x22c]
push eax
call sub.SHELL32.dll_Ordinal_52
mov ebx, eax
xor eax, eax
cmp word [ebx], ax
je 0x1004738
mov word [ebx - 2], ax
cmp dword [ebp + 0xc], eax
je 0x100477d
lea eax, [ebp - 0x22c]
push eax
call sub.SHELL32.dll_Ordinal_34
push eax
push 0x1001438
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100497d
lea eax, [ebp - 0x22c]
push eax
call sub.SHELL32.dll_Ordinal_34
push eax
push 0x1001450
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100497d
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x2c]
xor ebx, ebx
cmp word [ebp - 0x22c], 0x22
jne 0x10047c0
cmp word [ebp - 0x22a], bx
lea eax, [ebp - 0x22a]
je 0x10047b6
mov cx, word [eax]
cmp cx, 0x22
je 0x10047bc
mov word [eax - 2], cx
inc eax
inc eax
cmp word [eax], bx
jne 0x10047a2
cmp word [eax], 0x22
jne 0x10047c0
mov word [eax - 2], bx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x10047d8
cmp word [eax], bx
je 0x10047d8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
jmp 0x100480a
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHELL32.dll_Ordinal_31]
push 0x10019ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
jne 0x1004801
push 0x1001cbc
jmp 0x1004806
push 0x100162c
push eax
call dword [ecx + 0x24]
cmp word [esi + 0x10], bx
jne 0x1004828
lea eax, [ebp - 0x22c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1004828
push ebx
push ebx
jmp 0x1004841
push dword [esi + 0xc]
call sub.SHELL32.dll_Ordinal_52
cmp word [eax], bx
je 0x1004839
mov word [eax - 2], bx
movzx edx, word [esi + 0x10]
push edx
push dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [esi + 0x12]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 4]
push dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
push dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 8]
mov dword [ebp - 0x24], eax
push edi
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x20], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call ebx
and word [ebp - 0xa4e], 0
push 3
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc54]
push eax
call dword [sym.imp.SHELL32.dll_PathResolve]
test eax, eax
jne 0x10048c9
push edi
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x22c]
push eax
call ebx
and word [ebp - 0xa4e], 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x22c]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x100248c
push eax
call dword [ecx]
test eax, eax
jl 0x1004924
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x100491b
cmp dword [esi + 0x18], 0
je 0x100490b
or byte [ebp - 7], 4
jmp 0x100490f
and byte [ebp - 7], 0xfb
mov eax, dword [ebp - 0x10]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi]
lea eax, [ebp - 0x434]
push dword [ebp + 8]
push eax
call sub.SHELL32.dll_Ordinal_37
push 0x1001658
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.SHELL32.dll_PathQualify]
push 0xffffffffffffffff
lea eax, [ebp - 0x434]
push eax
push edi
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.SHELL32.dll_Ordinal_79]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x63c]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp + 0x10]
inc dword [ebp - 0xc]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jl 0x10046e1
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
leave
ret 0xc