Function at 0x405b70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x498b5789]
inc eax
test eax, eax
jne 0x405b87
mov eax, dword [esi + 0x20]
cmp byte [eax], 0
jne 0x405bd6
mov esp, dword [ebx]
or al, 0x8b
pop ecx
sbb byte [ebx], bh
rol edi, cl
inc esi
adc al, 0
add byte [ecx - 0x2a], dl
jge 0x405bbc
mov eax, dword [0x48b1c56]
mov cl, byte [ecx - 0x477fdfba]
sub eax, 0x508a1675
add dword [esp + eax*4 - 0x2e], ecx
dec eax
sub ch, ah
mov ah, byte [eax]
cld
fild word [eax + 0x1e752d14]
inc ecx
mov dword [esi + 0xc], ecx
mov dword [ebp + 0x20], 0x394102d4
inc ebp
and ah, dl
add al, byte [ecx + 0x39]
mov ecx, dword [ebp + 0x10]
mov al, byte [esi + 0x10]
push 0x5e
mov byte [ecx], al
mov eax, 0xc9fb117e
pop ebp
ret 0x6a
mov edx, dword [esi + 0x20]
mov edi, dword [ebp + 0xc]
movsx eax, byte [edx]
inc edx
xor eax, 0xffffffea
mov dword [0x2a308910], edi
sbb al, 0x84
rol byte [eax], 1
push ecx
add byte [eax + 0x57], dl
mov eax, 0x40c18315
add byte [ebx - 0x6591f73c], al
movzx edi, word [ebp - 0x7f700000]
mov dword [ecx], 0x8b1a743a
dec ebp
xchg dword [esp + ebx], edi
mov edx, dword [eax]
sbb byte [ebx], 0
punpckhbw mm2, qword [edx - 0x17000000]
mov dh, byte [ebp]
add byte [ebx + 0x38802046], cl
add byte [edi + eax - 0x75], dh
dec ebp
adc al, 0x89
add ebx, ebp
je 0x405bbd
push esi
leave
mov ecx, dword [esi + 0x18]
inc edx
mov esi, dword [edi]
mov dword [esi + 0xc], edx
cmp ecx, eax
jg 0x405c9a
invalid
mov esi, dword [edi - 0x7eeb74e4]
mov eax, dword [ebp + 0x14]
push edi
adc bh, ch
inc esi
cmpsd dword [esi], dword es:[edi]
push edi
jb 0x405cec
add byte [edi + 0x46], al
or al, 0x47
push ebp
adc byte [edx + 0x335f104e], cl
ror byte [eax - 0x3da2a1f6], 0x10
add byte [ebx + 0xf2d847e], al
test dl, bh
aaa
invalid
mov edx, 0x8b500000
inc esi
cmpsb byte [esi], byte es:[edi]
push 0x6740a6cc
push eax
call dword [esi - 0xd]
sub al, 0x7f
pop ss
mov edx, dword [ebp + 0x42]
mov cl, byte [esi + 0x45]
pop edi
mov eax, 0x68117c
mov byte [edx], cl
pop esi
pop ebp
test byte [eax], dl
xchg ecx, eax
nop
outsd dx, dword [esi]
salc
cwde
nop
nop
xchg esp, eax
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push ecx
push esi
push edi
inc ebx
mov al, 1
out dx, eax
add byte [ebp + 0x6d9d0fc0], al
add dh, ch
add byte [ebx - 0x34f747c3], al
mov word [edi + ecx], ss
mov esi, gs
add byte [eax], al
add byte [ecx + 0x410384], ah
test eax, eax
cdq
test ecx, esp
add byte [ecx], ch
mov dword [0x26f284], 1
adc al, byte [eax + 0x5c]
sar dl, 0xaa
mov esi, eax
test esi, esi
je 0x405d7a
mov eax, dword [0xfc0358]
mov byte [0x501d7565], al
push 0xa7f42a
pop esp
add al, 0xe8
mov esi, 0x83000014
les ecx, [ebx]
pop eax
add eax, dword [ecx + 0x1a]
ror byte [bx], 0x84
xchg byte [eax], al
add byte [eax], al
lea ecx, [ebp - 4]
inc ecx
push esi
call eax
mov esi, eax
test esi, esi
je 0x405db3
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [esi], bl
push eax
xor al, 0x2c
add byte cs:[eax], al
mov ecx, dword [ebp + 0x44]
add esp, 0xc
push esi
mov dword [ecx], eax
call dword [0xd2c0fa]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
push 0xffffffffffffffff
jbe 0x405dbf
invalid
call dword [ebp - 0x63ff6d3f]
call fcn.00405e50
xchg ebp, eax
jge 0x405dde
xor ebp, 0xffffffed
invalid
adc eax, 0xfc15b
add esp, 0xffffffbb
mov dword [edi], eax
call dword [0x83c19f]
pop eax
aas
mov ecx, esi
mov esi, dword [eax]
mov dword [0x2e9d8d1], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
loope 0x405e03
rep movsb byte es:[edi], byte [esi]
push ebx
jmp dword [edx + sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]