Function at 0xf04f2a3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x134], ecx
cmp eax, esi
jne 0xf04f2d8
xor eax, eax
jmp 0xf04f4dd
push ebx
mov dword [ebp - 0x120], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
cmp word [eax], si
jne 0xf04f2f2
cmp word [eax + 2], si
je 0xf04f2f6
inc eax
inc eax
jmp 0xf04f2e7
sub eax, ebx
sar eax, 1
lea esi, [eax + eax + 4]
push edi
push esi
call fcn.0f005706
mov edi, eax
pop ecx
test edi, edi
je 0xf04f5e5
push esi
push ebx
push edi
call fcn.0f00a4b0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateEnvironment]
test eax, eax
jl 0xf04f5d0
mov dword [ebp - 0x114], ebx
mov esi, edi
cmp word [edi], bx
jne 0xf04f4f2
push edi
call fcn.0f00996a
mov eax, dword [ebp - 0x110]
xor esi, esi
cmp byte [eax], 0
pop ecx
je 0xf04f495
mov edi, dword [sym.imp.ntdll.dll_RtlInitString]
push dword [ebp - 0x110]
lea eax, [ebp - 0x13c]
push eax
call edi
movzx ebx, word [ebp - 0x13c]
mov dword [ebp - 0x120], ebx
test esi, esi
jne 0xf04f3a4
push 8
push str.COMSPEC
push dword [ebp - 0x110]
call fcn.0f00d1bf
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0xf04f47c
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
call fcn.0f04f147
push eax
lea eax, [ebp - 0x13c]
push eax
call edi
push 1
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jl 0xf04f5d9
push 0x3d
push dword [ebp - 0x12c]
call fcn.0f05fb04
pop ecx
pop ecx
test eax, eax
je 0xf04f47c
mov ecx, dword [ebp - 0x12c]
mov edx, eax
sub edx, ecx
add eax, 2
push eax
sar edx, 1
lea eax, [ebp - 0x128]
add edx, edx
push eax
mov dword [ebp - 0x118], ecx
mov word [ebp - 0x11c], dx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
mov ebx, eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test ebx, ebx
jl 0xf04f5d9
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x128]
mov ebx, dword [ebp - 0x120]
add eax, ecx
mov ecx, dword [ebp - 0x114]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x110]
lea eax, [eax + ebx + 1]
cmp byte [eax], 0
mov dword [ebp - 0x110], eax
jne 0xf04f362
mov eax, dword [ebp - 0x114]
add eax, 2
mov word [ebp - 0x130], ax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x12c], eax
push 1
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x134]
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
push dword [ebp - 0x10c]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0f0057d5
leave
ret 8
mov ebx, dword [ebp - 0x114]
cmp word [esi], 0x3d
jne 0xf04f521
lea eax, [esi + 2]
push 0x3d
push eax
call fcn.0f05fb04
pop ecx
pop ecx
test eax, eax
je 0xf04f59f
mov ecx, eax
sub ecx, esi
sar ecx, 1
add ecx, ecx
mov word [ebp - 0x11c], cx
add eax, 2
jmp 0xf04f554
cmp dword [ebp - 0x120], 0
jne 0xf04f59f
push 8
push 0xf004570
push esi
call fcn.0f05fa59
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x120], eax
je 0xf04f59f
push 0xe
pop eax
mov word [ebp - 0x11c], ax
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x118], esi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
test eax, eax
jl 0xf04f5c4
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x128]
add eax, ecx
lea eax, [ebx + eax + 4]
mov dword [ebp - 0x114], eax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0xf04f5a4
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp word [esi], cx
jne 0xf04f4ec
jmp 0xf04f344
push dword [ebp - 0x10c]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
push edi
call fcn.0f00996a
pop ecx
jmp 0xf04f5e5
push dword [ebp - 0x10c]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
jmp 0xf04f4db