Function at 0x4024d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x188
push ebx
push ebp
push esi
mov esi, ecx
xor eax, eax
push edi
mov edi, dword [esp + 0x19c]
push eax
mov byte [esi + 5], 0
mov byte [esi + 4], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.MSVCRT.dll_time]
mov ebx, dword [esp + 0x1a4]
mov ecx, dword [esi + 0xc]
add esp, 4
mov edx, ebx
mov dword [esi + 8], eax
call fcn.00402a20
mov edx, ebx
xor ecx, ecx
mov ebp, eax
call fcn.00402a20
xor ebx, ebx
test edi, edi
mov dword [esp + 0x10], eax
mov eax, edi
jne 0x402556
push 0x20
lea eax, [esp + 0x18]
push eax
push str.____70AA37E1_6D4D_11d4_A90B_0050DACE2436__x
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x402554
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
jmp 0x402556
xor eax, eax
dec eax
cmp eax, 0x12
ja case.0x40255c.6
jmp dword [eax*4 + 0x402810]
mov ebx, 3
jmp case.0x40255c.6
mov ebx, 8
jmp case.0x40255c.6
mov ebx, 0x16
jmp case.0x40255c.6
mov ebx, 0x17
jmp case.0x40255c.6
mov ebx, 2
jmp case.0x40255c.6
mov ebx, 0x18
jmp case.0x40255c.6
mov ebx, 4
jmp case.0x40255c.6
mov ebx, 5
jmp case.0x40255c.6
mov ebx, 0xe
jmp case.0x40255c.6
mov ebx, 1
jmp case.0x40255c.6
mov ebx, 0xf
jmp case.0x40255c.6
mov ebx, 9
jmp case.0x40255c.6
mov ebx, 0x10
jmp case.0x40255c.6
mov ebx, 7
jmp case.0x40255c.6
mov ebx, 0x14
jmp case.0x40255c.6
mov ebx, 0x15
test ebp, ebp
je 0x402803
mov al, byte [ebp + 4]
mov edx, dword [ebp]
test al, al
push 1
lea eax, [esp + 0x38]
mov ecx, ebp
push eax
call dword [edx + 4]
mov edi, eax
test edi, edi
je 0x40262b
mov al, byte [ebp + 4]
test al, al
je 0x402627
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x402627
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
mov ecx, dword [esi + 0xc]
xor edx, edx
call fcn.00402a20
mov ebp, eax
mov eax, dword [ebp]
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, ebp
call dword [eax + 4]
mov edi, eax
test edi, edi
jne 0x402649
movzx edx, word [esp + 0x34]
cmp edx, ebx
je 0x40263b
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x402649
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0xc], 0xe
jne 0x40267c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
test al, al
je 0x40267c
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
or ecx, 0x3000000
mov dword [esi + 0x1c], eax
mov eax, ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [esi + 0x1c]
and eax, 0xfffdffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x4026c2
test edi, edi
jne 0x4026c2
mov edx, dword [ebx]
push edi
lea eax, [esp + 0x88]
push eax
mov ecx, ebx
call dword [edx + 4]
mov eax, dword [esp + 0x8c]
and eax, 0x8000
xor ecx, ecx
cmp eax, 0x8000
jne 0x4026c2
test ecx, ecx
jne 0x4026c2
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
or eax, 0x8000
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
test ebx, ebx
je 0x4026d7
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x4027e7
push 0x20
lea ecx, [esp + 0x18]
push ecx
push str.____70AA37E1_6D4D_11d4_A90B_0050DACE2436__x
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x40270a
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov edi, eax
jmp 0x40270c
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
xor ecx, ecx
mov cx, ax
mov edi, eax
shl edi, 4
movzx edi, di
mov edx, eax
mov ebx, ecx
xor ebx, 0x5c9d
or edi, ebx
push edi
mov edi, eax
xor edi, 0x1a22b3c4
mov ebx, eax
shl edx, 6
movzx edx, dx
shl ebx, 0xe
or edi, ebx
push edi
mov edi, ecx
xor edi, 0xa9f1
or edi, edx
push edi
mov edi, ecx
xor edi, 0xfedc
or edi, edx
xor edx, edx
mov dh, al
xor ecx, 0x1234
push edi
movzx edx, dx
or edx, ecx
mov ecx, eax
push edx
xor ecx, 0xbadd
shl eax, 0x10
or ecx, eax
push ecx
push str.____
lea edx, [esp + 0xa4]
push str._s_08lX__04lX__04lX__04lX__08lX_04lX__X
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
lea eax, [esp + 0x104]
push eax
mov dword [esp + 0x108], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4027bf
mov ecx, dword [esp + 0x114]
mov eax, 1
cmp ecx, eax
je 0x4027c1
xor eax, eax
neg eax
sbb eax, eax
lea ecx, [esp + 0x84]
push ecx
and eax, 0xf0001
push 0
add eax, 0x100000
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [esi + 0x10], eax
je 0x4027f9
mov eax, dword [esi + 0x18]
and eax, 0x4000000
xor ecx, ecx
or eax, ecx
jne 0x4027f9
mov byte [esi + 5], 1
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov byte [esi + 4], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret 8