Function at 0xf093fdf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xf093ff6
xor eax, eax
jmp 0xf09413e
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
cmp word [eax], si
jne 0xf09400d
cmp word [eax + 2], si
je 0xf094011
inc eax
inc eax
jmp 0xf094002
sub eax, ebx
sar eax, 1
lea esi, [eax + eax + 4]
push edi
push esi
call fcn.0f009d40
mov edi, eax
test edi, edi
pop ecx
jne 0xf09402e
xor eax, eax
jmp 0xf09413c
push esi
push ebx
push edi
call fcn.0f021220
add esp, 0xc
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateEnvironment]
test eax, eax
jl 0xf09414c
cmp word [edi], bx
mov dword [ebp - 8], ebx
mov esi, edi
je 0xf0940f6
cmp word [esi], 0x3d
jne 0xf094084
lea eax, [esi + 2]
push 0x3d
push eax
call fcn.0f09bef0
cmp eax, ebx
pop ecx
pop ecx
je 0xf0940e2
mov ecx, eax
sub ecx, esi
sar ecx, 1
shl ecx, 1
mov word [ebp - 0x14], cx
add eax, 2
jmp 0xf0940ac
cmp dword [ebp - 0xc], ebx
jne 0xf0940e2
push 8
push 0xf006e9c
push esi
call fcn.0f09bda0
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
je 0xf0940e2
mov word [ebp - 0x14], 0xe
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
test eax, eax
jl 0xf094143
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
push esi
call fcn.0f01deb0
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
pop ecx
jne 0xf09405c
push edi
call fcn.0f008a60
mov edi, dword [ebp + 8]
mov dword [0xf205f98], ebx
cmp byte [edi], 0
pop ecx
jne 0xf09415b
mov eax, dword [ebp - 8]
add eax, 2
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
push 1
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
pop esi
leave
ret 8
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
push edi
call fcn.0f008a60
pop ecx
jmp 0xf094027
mov edi, dword [ebp + 8]
push edi
call sym.ntvdm.exe_cmdCheckTemp
test eax, eax
je 0xf094180
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf094175
sub eax, ecx
jmp 0xf09418f
push edi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
movzx eax, word [ebp - 0x2c]
test ebx, ebx
mov dword [ebp + 8], eax
jne 0xf0941af
push 8
push str.COMSPEC
push edi
call fcn.0f09a5b0
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0xf094227
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jl 0xf09423f
push 0x3d
push dword [ebp - 0x20]
call fcn.0f09bef0
test eax, eax
pop ecx
pop ecx
je 0xf094227
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
add eax, 2
push eax
sar edx, 1
lea eax, [ebp - 0x1c]
shl edx, 1
push eax
mov dword [ebp - 0x10], ecx
mov word [ebp - 0x14], dx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
jl 0xf09423f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea eax, [edi + eax + 1]
cmp byte [eax], 0
mov dword [ebp + 8], eax
jne 0xf094158
jmp 0xf09410b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
jmp 0xf094027