Function at 0x41d760
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x48]
mov edi, 0x7f2bb707
cmp dword [ebp], 0x7f2bb707
jne 0x41e221
push 0xc8
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x41d912
mov ebx, eax
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
mov edi, ebx
mov dword [ebx], 0x7f2bb701
or eax, 0x200
mov dword [ebx + 8], eax
mov dword [ebx + 0x5c], 0x12
push str.E2FSPROGS_FAKE_TIME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x41d7d6
push 0
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [edi + 0x60], eax
mov dword [esp], edi
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
inc eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41e1fa
mov edi, eax
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x38]
mov eax, dword [esp]
mov dword [eax + 0xc], edi
push esi
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push 0x3f
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test ebx, ebx
jne 0x41d82d
test eax, eax
je 0x41d82d
mov ebx, eax
inc ebx
mov byte [eax], 0
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
mov esi, dword [esp + 0x3c]
mov eax, esi
and eax, 1
mov ecx, esi
shr ecx, 0xd
and ecx, 2
mov edx, esi
shr edx, 0x11
and edx, 4
or edx, ecx
mov ecx, esi
shr ecx, 0x16
and ecx, 0x10
or ecx, edx
or ecx, eax
mov eax, dword [esp + 4]
add eax, 4
mov dword [esp + 0x10], eax
push eax
push ecx
push edi
call dword [ebp + 8]
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x41e1ff
test ebx, ebx
je 0x41d88f
push ebx
mov eax, dword [esp + 0x14]
push dword [eax]
call fcn.0041aa70
add esp, 8
mov edi, eax
test eax, eax
jne 0x41e1ff
mov ecx, dword [esp]
mov eax, dword [ecx + 4]
mov dword [ecx + 0x88], eax
mov dword [eax + 0x5c], ecx
mov eax, dword [esp + 4]
add eax, 0x10
mov ebp, eax
push eax
push 0xfffffc00
push dword [ecx + 4]
call fcn.0041ac60
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x41e1ff
test dword [esp + 0x3c], 0x2000
jne 0x41d91c
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
test ebx, ebx
je 0x41d98a
mov esi, dword [esp]
test edi, edi
je 0x41d980
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esp + 4], edi
push edi
push eax
call dword [ecx + 0x10]
add esp, 8
mov eax, ebx
sar eax, 0x1f
mov dword [esp + 0x18], eax
mov dword [esi + 0x54], 0
mov dword [esp + 0xc], ebx
jmp 0x41d9d3
mov edi, 0x7f2bb746
jmp 0x41e221
push 0x14c
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41e1fa
mov ecx, dword [esp]
mov dword [ecx + 0x58], eax
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + 4]
push eax
push 0xfffffeb4
push 0
push ecx
call dword [edx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41e1ff
mov esi, dword [esp]
mov eax, dword [esi + 0x58]
mov edi, 0x7f2bb710
cmp dword [eax], 0x7f2bb710
jne 0x41e221
mov edi, dword [eax + 0xcc]
mov ebx, 1
test edi, edi
jne 0x41d8e7
mov edi, 0x7f2bb747
jmp 0x41e1ff
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push 0x400
push eax
call dword [ecx + 0x10]
add esp, 8
push 0x400
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
mov esi, dword [esp]
je 0x41e1fa
mov dword [esp + 4], edi
mov dword [esi + 0x54], eax
mov dword [esp + 0xc], 0
mov ebx, 1
mov dword [esp + 0x18], 0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push dword [esi + 0x10]
push 0xfffffc00
push ebx
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41e1ff
mov dword [esp + 0x1c], ebx
mov esi, dword [esp]
mov eax, dword [esi + 0x54]
test eax, eax
mov ebx, ebp
je 0x41da13
push 0x400
push dword [ebx]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor edx, edx
test byte [esi + 0xa], 0x20
jne 0x41da49
push dword [esi + 0x10]
push esi
call fcn.00412470
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.004124a0
add esp, 8
test eax, eax
je 0x41db13
xor eax, eax
test edi, edi
mov edx, 0x7f2bb799
cmovne edx, eax
mov edi, 0x7f2bb750
test byte [esi + 8], 0x40
jne 0x41e1ff
mov eax, dword [ebp]
movzx ecx, word [eax + 0x38]
cmp ecx, 0xef53
mov edi, 0x7f2bb713
cmove edi, edx
test edi, edi
jne 0x41e1ff
mov edi, 0x7f2bb714
cmp dword [eax + 0x4c], 1
ja 0x41e1ff
test dword [esp + 0x3c], 0x400
jne 0x41dae8
mov ecx, dword [eax + 0x60]
mov edi, 0x7f2bb743
test ecx, 0xfffc1921
jne 0x41e1ff
mov esi, dword [eax + 0x64]
mov edx, esi
and edx, 0xffff0084
mov ebx, dword [esp + 0x3c]
test ebx, 0x8000
cmove edx, esi
test bl, 1
je 0x41dad0
mov edi, 0x7f2bb744
and edx, 0xffff0884
jne 0x41e1ff
test dword [esp + 0x3c], 0x1000
jne 0x41dae8
mov edi, 0x7f2bb743
and ecx, 8
jne 0x41e1ff
mov ecx, dword [eax + 0x18]
cmp ecx, 6
ja 0x41db09
mov edx, dword [eax + 0x1c]
cmp edx, 0x13
ja 0x41db09
cmp ecx, edx
ja 0x41db09
cmp byte [eax + 0x174], 0x1f
jbe 0x41dc77
mov edi, 0x7f2bb73c
jmp 0x41e1ff
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push dword [ebx]
push 0xfffffc00
push dword [esp + 0x24]
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41e1ff
mov esi, dword [esp]
mov eax, dword [esi + 0x54]
test eax, eax
mov ebx, ebp
je 0x41db54
push 0x400
push dword [ebx]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
test byte [esi + 0xa], 0x20
jne 0x41db80
push dword [esi + 0x10]
push esi
call fcn.00412470
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.004124a0
add esp, 8
test eax, eax
je 0x41db87
mov esi, dword [esp]
jmp 0x41da3d
xor edx, edx
jmp 0x41da49
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push dword [ebx]
push 0xfffffc00
push dword [esp + 0x24]
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41e1ff
mov eax, dword [esp]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x41dbc7
push 0x400
push dword [ebp]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
test byte [eax + 0xa], 0x20
jne 0x41dccf
mov esi, dword [esp]
push dword [esi + 0x10]
push esi
call fcn.00412470
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.004124a0
add esp, 8
test eax, eax
jne 0x41db78
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push dword [ebp]
push 0xfffffc00
push dword [esp + 0x24]
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41e1ff
mov eax, dword [esp]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x41dc36
push 0x400
push dword [ebp]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov esi, dword [esp]
test byte [esi + 0xa], 0x20
mov edx, 0
jne 0x41da49
push dword [esi + 0x10]
push esi
call fcn.00412470
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.004124a0
add esp, 8
test eax, eax
jne 0x41db78
mov edx, 0x7f2bb798
mov esi, dword [esp]
jmp 0x41da49
mov esi, dword [eax + 0x64]
test dword [esp + 0x3c], 0x20000
jne 0x41dc97
mov ebx, esi
mov edi, 0x7f2bb789
and ebx, 0x200
jne 0x41e1ff
test esi, 0x200
jne 0x41dca7
cmp ecx, edx
jne 0x41db09
mov edx, 0x400
shl edx, cl
mov ecx, dword [esp]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], edx
cmp dword [eax + 0x4c], 0
je 0x41dcd9
movzx ecx, word [eax + 0x58]
cmp ecx, 0x80
jb 0x41db09
jmp 0x41dcde
mov esi, dword [esp]
xor edx, edx
jmp 0x41da49
mov ecx, 0x80
cmp ecx, edx
ja 0x41db09
mov esi, ecx
shr esi, 1
and esi, 0x5555
sub ecx, esi
mov esi, ecx
and esi, 0x33333333
shr ecx, 2
and ecx, 0x33333333
add ecx, esi
mov esi, ecx
shr esi, 4
add esi, ecx
and esi, 0xf0f0f0f
imul ecx, esi, 0x1010101
shr ecx, 0x18
cmp ecx, 1
ja 0x41db09
test dword [esp + 0x3c], 0x800000
jne 0x41dd92
test byte [eax + 0x60], 0x80
je 0x41dd92
movzx ecx, word [eax + 0xfe]
lea esi, [ecx - 0x40]
movzx esi, si
mov edi, 0x7f2bb791
cmp esi, 0x3c0
ja 0x41e1ff
mov esi, ecx
shr esi, 1
and esi, 0x5555
sub ecx, esi
mov esi, ecx
and esi, 0x3333
shr ecx, 2
and ecx, 0x3333
add ecx, esi
mov esi, ecx
shr esi, 4
add esi, ecx
and esi, 0xf0f
mov ecx, esi
shr ecx, 8
add ecx, esi
movzx ecx, cl
cmp cx, 1
ja 0x41e1ff
mov ecx, dword [eax + 0x1c]
sub ecx, dword [eax + 0x18]
mov esi, dword [esp]
mov dword [esi + 0x64], ecx
mov esi, dword [eax + 0x24]
shl esi, cl
cmp dword [eax + 0x20], esi
jne 0x41db09
mov esi, dword [eax + 0x28]
cmp dword [eax + 0x4c], 0
je 0x41ddbb
movzx edi, word [eax + 0x58]
jmp 0x41ddc0
mov edi, 0x80
movzx ecx, byte [eax + 0x18]
mov eax, 0x400
shl eax, cl
imul edi, esi
add eax, edi
dec eax
add cl, 0xa
shr eax, cl
mov ecx, dword [esp]
mov dword [ecx + 0x28], eax
cmp dword [esp + 4], 0
je 0x41ddf2
mov edi, 0x7f2bb722
cmp dword [esp + 4], edx
jne 0x41e1ff
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push edx
push eax
call dword [ecx + 0x10]
add esp, 8
mov eax, dword [ebp]
test byte [eax + 0x60], 8
jne 0x41de72
cmp dword [eax + 0x28], 0
je 0x41db09
mov esi, dword [esp]
push esi
call fcn.004123c0
add esp, 4
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 0x20]
mov dword [esp + 4], eax
cmp eax, 8
jb 0x41db09
movzx edx, byte [ebx + 0x18]
movzx ecx, byte [ebx + 0x1c]
mov edi, 0x400
mov eax, 0x400
shl eax, cl
mov ecx, edx
shl edi, cl
cdq
idiv edi
imul eax, eax, 0xfff8
cmp dword [esp + 4], eax
ja 0x41db09
mov eax, dword [esp]
mov ecx, dword [eax + 0x28]
cmp dword [ebx + 0x4c], 0
je 0x41de83
movzx esi, word [ebx + 0x58]
jmp 0x41de88
mov ecx, dword [esp]
mov dword [ecx + 0x1c], 0
xor edi, edi
jmp 0x41e21b
mov esi, 0x80
mov eax, edi
cdq
idiv esi
mov edx, 0x10000
sub edx, eax
cmp ecx, edx
ja 0x41db09
mov ecx, 0x20
test byte [ebx + 0x60], 0x80
je 0x41deae
movzx ecx, word [ebx + 0xfe]
mov eax, edi
cdq
idiv ecx
test eax, eax
je 0x41db09
mov esi, dword [ebx + 0x14]
push ebx
call fcn.00411820
add esp, 4
xor edi, edi
cmp esi, eax
mov eax, 0
sbb eax, edx
jae 0x41db09
mov esi, ebp
push dword [ebp]
call fcn.00411820
add esp, 4
mov ecx, dword [ebp]
mov dword [esp + 8], ecx
mov ecx, dword [ecx + 0x14]
mov esi, eax
xor esi, ecx
or esi, edx
je 0x41df22
not ecx
add eax, ecx
adc edx, 0xffffffff
push 0
push dword [esp + 8]
push edx
push eax
call fcn.004236c0
add esp, 0x10
mov edi, eax
xor eax, eax
mov ecx, 0xfffffffe
cmp ecx, edi
sbb eax, edx
jb 0x41db09
inc edi
mov eax, dword [esp]
mov dword [eax + 0x1c], edi
test dword [esp + 0x3c], 0x800000
jne 0x41df45
mov eax, edi
mov ecx, dword [esp + 8]
mul dword [ecx + 0x28]
xor eax, dword [ecx]
or eax, edx
jne 0x41db09
mov edx, dword [esp + 8]
movzx ecx, byte [edx + 0x18]
mov eax, 0x400
shl eax, cl
mov ecx, 0x20
test byte [edx + 0x60], 0x80
je 0x41df6a
mov ecx, dword [esp + 8]
movzx ecx, word [ecx + 0xfe]
test edi, edi
je 0x41df7f
cdq
idiv ecx
mov ecx, eax
dec edi
mov eax, edi
xor edx, edx
div ecx
mov ebx, eax
inc ebx
jmp 0x41df81
xor ebx, ebx
mov eax, dword [esp]
mov dword [eax + 0x20], ebx
mov eax, dword [esp + 8]
test byte [eax + 0x60], 0x10
je 0x41dfb0
test dword [esp + 0x3c], 0x800000
jne 0x41dfb0
mov edi, 0x7f2bb73c
mov eax, dword [esp + 8]
cmp dword [eax + 0x104], ebx
ja 0x41e1ff
test dword [esp + 0x3c], 0x800
jne 0x41e1b5
mov eax, dword [esp]
mov esi, dword [eax + 0x14]
test ebx, ebx
je 0x41dfd2
mov eax, ebx
mul esi
jo 0x41e1fa
mov eax, esi
imul eax, ebx
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x41e1fa
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x24], ecx
xor eax, eax
mov ecx, dword [esp + 0xc]
or ecx, dword [esp + 0x18]
jne 0x41e039
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x18], 0
mov eax, 0
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0x41e039
xor eax, eax
cmp esi, 0x400
sete al
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], ebx
test dword [esp + 0x3c], 0x2000
jne 0x41e06c
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0x60]
mov dword [esp + 4], ebx
and ecx, 0x10
je 0x41e06c
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0x104]
mov edx, ebx
cmp ecx, ebx
cmovae ecx, ebx
mov dword [esp + 4], ecx
cmp dword [esp + 4], 0
je 0x41e0af
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
mov esi, dword [esp + 0xc]
add eax, esi
inc eax
push dword [esp + 0x14]
push dword [esp + 8]
push eax
push ecx
call dword [edx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41e1ff
mov ecx, dword [esp]
mov eax, dword [ecx + 0x14]
imul eax, dword [esp + 4]
add dword [esp + 0x14], eax
mov ebx, dword [ecx + 0x20]
cmp dword [esp + 4], ebx
jae 0x41e0e9
mov esi, dword [esp + 4]
mov edi, dword [esp]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x14]
push edi
call fcn.0041d5d0
add esp, 0x10
push 0
push 1
push edx
push eax
push dword [edi + 4]
call fcn.0041acc0
add esp, 0x14
inc esi
mov eax, dword [edi + 0x20]
mov ebx, eax
cmp esi, eax
jb 0x41e0bc
cmp dword [esp + 4], ebx
jae 0x41e13e
mov esi, dword [esp]
push dword [esp + 4]
push dword [esp + 0x1c]
push dword [esp + 0x14]
push esi
call fcn.0041d5d0
add esp, 0x10
push dword [esp + 0x14]
push 1
push edx
push eax
push dword [esi + 4]
call fcn.0041ab80
add esp, 0x14
test eax, eax
jne 0x41e294
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
add ecx, dword [eax + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 4]
inc ecx
mov dword [esp + 4], ecx
cmp ecx, dword [eax + 0x20]
jb 0x41e0f2
mov edx, dword [esp]
mov eax, dword [edx + 0x10]
movzx ecx, word [eax + 0x164]
mov dword [edx + 0x50], ecx
cmp dword [esp + 0x1c], 2
jl 0x41e1b5
movzx eax, word [eax + 0x64]
test eax, 0x410
je 0x41e1b5
mov eax, dword [esp]
cmp dword [eax + 0x1c], 0
je 0x41e1a2
xor esi, esi
mov edi, dword [esp]
push 2
push esi
push edi
call fcn.00411ff0
add esp, 0xc
push 1
push esi
push edi
call fcn.00411ff0
add esp, 0xc
push 0
push esi
push edi
call fcn.00411f20
add esp, 0xc
push esi
push edi
call fcn.00413440
add esp, 8
inc esi
cmp esi, dword [edi + 0x1c]
jb 0x41e16e
mov eax, dword [esp]
mov eax, dword [eax + 8]
test al, 1
je 0x41e1b5
or eax, 6
mov ecx, dword [esp]
mov dword [ecx + 8], eax
test dword [esp + 0x3c], 0x4001
je 0x41e22b
mov eax, dword [esp + 0x3c]
and eax, 0x100000
jne 0x41e22b
mov eax, dword [ebp]
mov ecx, 0x100
and ecx, dword [eax + 0x60]
je 0x41e22b
push dword [esp]
call fcn.0041c160
add esp, 4
test eax, eax
je 0x41e22b
mov edi, eax
mov eax, dword [esp]
or byte [eax + 0xa], 0x10
push eax
call fcn.0041c170
add esp, 4
jmp 0x41e1ff
mov edi, 0x7f2bb746
test dword [esp + 0x3c], 0x10000
jne 0x41e218
push dword [esp]
call fcn.0042eb20
add esp, 4
xor ecx, ecx
jmp 0x41e21b
mov ecx, dword [esp]
mov eax, dword [esp + 0x4c]
mov dword [eax], ecx
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
test byte [eax + 0xa], 0x40
je 0x41e267
push 0x1000
push 0x41e2a0
push 0x436810
call fcn.004368b0
add esp, 0xc
mov ecx, dword [esp]
mov dword [ecx + 0xc0], eax
mov edi, 0x7f2bb746
test eax, eax
je 0x41e1ff
mov eax, dword [ebp]
or dword [eax + 0x64], 0x4000
mov eax, dword [ebp]
test byte [eax + 0x62], 2
je 0x41e289
movzx eax, word [eax + 0x27c]
push eax
call fcn.00432110
add esp, 4
mov ecx, dword [esp]
mov dword [ecx + 0xc4], eax
mov ecx, dword [esp]
and byte [ecx + 0xa], 0xfe
xor edi, edi
jmp 0x41e21b
mov edi, eax
jmp 0x41e1ff