Function at 0x41ebe0
Capabilities:
Get file version info
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push str.bash
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ed74
push 0x4ac0ff
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ed74
push 0x4ac102
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ee4a
push str.fish
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ee5a
push 0x4ac10b
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ef19
push 0x4ac110
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ee4a
push str.tcsh
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41ee4a
push 0x4ac119
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f16b
push 0x4ac11c
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f2dd
push str.oksh
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f301
push str.oil.ovm
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f438
push str.elvish
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f448
push 0x4ac134
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f49f
push str.xonsh
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f4c3
push 0x4ac13e
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f4d3
push 0x4ac149
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x41f4d3
mov ecx, dword [edi + 8]
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getFileVersion
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], str.__version
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
push 0
push eax
push esi
call dbg.ffProcessAppendOutput
add esp, 0xc
test eax, eax
je 0x41eda6
xor ebx, ebx
jmp 0x41f42e
mov eax, dword [esi + 4]
xor ebp, ebp
test eax, eax
je 0x41f096
mov ebx, dword [esi + 8]
cmp byte [eax + ebx - 1], 0xa
jne 0x41ef89
inc eax
nop word cs:[eax + eax]
mov edi, eax
add eax, 0xfffffffe
mov dword [esi + 4], eax
cmp edi, 2
je 0x41ef70
lea eax, [edi - 1]
cmp byte [ebx + edi - 3], 0xa
je 0x41edd0
cmp dword [esi], 0
jne 0x41ef79
lea ecx, [eax - 1]
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esi + 4], 0
mov ecx, 0x20
nop word [eax + eax]
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x41ee10
push esi
call sym._malloc
add esp, 4
mov byte [eax], 0
mov ecx, dword [esp]
mov dword [ecx + 8], eax
mov dword [ecx], esi
mov esi, ecx
push dword [esp + 4]
push ebx
push eax
mov ebx, eax
call sym._memcpy
add esp, 0xc
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
jmp 0x41ef79
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getExeVersionGeneral
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], str.__version
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
push 0
push eax
push esi
call dbg.ffProcessAppendOutput
add esp, 0xc
test eax, eax
jne 0x41ed9f
mov edi, dword [esi + 4]
test edi, edi
je 0x41f42c
mov ebx, dword [esi + 8]
cmp byte [edi + ebx - 1], 0xa
jne 0x41f32a
inc edi
mov ebp, edi
lea eax, [edi - 2]
mov dword [esi + 4], eax
cmp edi, 2
je 0x41f311
lea edi, [ebp - 1]
cmp byte [ebx + ebp - 3], 0xa
je 0x41eea3
cmp dword [esi], 0
jne 0x41f31a
lea eax, [edi - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esi + 4], 0
mov eax, 0x20
mov esi, eax
add eax, eax
cmp edi, esi
ja 0x41eedd
push esi
call sym._malloc
add esp, 4
mov edi, eax
mov byte [eax], 0
mov eax, dword [esp]
mov dword [eax + 8], edi
mov dword [eax], esi
mov esi, eax
push dword [esp + 4]
push ebx
push edi
call sym._memcpy
add esp, 0xc
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov ebx, edi
jmp 0x41f31a
mov ecx, dword [edi + 8]
mov edx, esi
call dbg.getFileVersion
test al, al
je 0x41f01d
mov ebp, dword [esi + 4]
mov bl, 1
test ebp, ebp
je 0x41f42e
mov edi, dword [esi + 8]
mov ecx, ebp
mov eax, ebp
nop
sub eax, 1
jb 0x41f42e
cmp byte [edi + ecx - 1], 0x2e
mov ecx, eax
jne 0x41ef40
cmp ebp, eax
jbe 0x41f42e
cmp dword [esi], 0
je 0x41f458
add edi, eax
mov dword [esi + 4], eax
mov byte [edi], 0
jmp 0x41f42e
cmp dword [esi], 0
je 0x41f081
mov byte [ebx + edi - 2], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x41f096
mov ebx, dword [esi + 8]
cmp byte [eax + ebx - 1], 0x20
jne 0x41f019
inc eax
nop dword [eax + eax]
mov edi, eax
add eax, 0xfffffffe
mov dword [esi + 4], eax
cmp edi, 2
je 0x41f072
lea eax, [edi - 1]
cmp byte [ebx + edi - 3], 0x20
je 0x41efa0
cmp dword [esi], 0
jne 0x41f077
lea ecx, [eax - 1]
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esi + 4], 0
mov ecx, 0x20
nop word [eax + eax]
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x41efe0
push esi
call sym._malloc
add esp, 4
mov ebp, eax
mov byte [eax], 0
mov eax, dword [esp]
mov dword [eax + 8], ebp
mov dword [eax], esi
mov esi, eax
push dword [esp + 4]
push ebx
push ebp
call sym._memcpy
add esp, 0xc
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov ebx, ebp
jmp 0x41f077
mov ebp, eax
jmp 0x41f096
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
mov dword [esp + 0xc], str.__version
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
push 0
push eax
push esi
call dbg.ffProcessAppendOutput
add esp, 0xc
test eax, eax
jne 0x41ed9f
push 0xa
push esi
call dbg.ffStrbufTrimRight
add esp, 8
push 0x20
push esi
call dbg.ffStrbufTrimRight
add esp, 8
push 0x20
push esi
call dbg.ffStrbufSubstrAfterLastC
add esp, 8
jmp 0x41f42c
cmp dword [esi], 0
je 0x41f081
mov byte [ebx + edi - 2], 0
mov ebp, dword [esi + 4]
jmp 0x41f096
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [0x5052b0]
mov dword [esi + 8], eax
mov ebx, dword [esi + 8]
push ebp
push 0xa
push ebx
call sym._memchr
add esp, 0xc
mov ecx, eax
sub ecx, ebx
test eax, eax
cmove ecx, ebp
cmp ebp, ecx
jbe 0x41f126
cmp dword [esi], 0
je 0x41f0c0
mov dword [esi + 4], ecx
add ebx, ecx
mov edi, ebx
jmp 0x41f120
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [0x5052b0]
mov dword [esi + 8], eax
test ebx, ebx
je 0x41f164
mov dword [esp], esi
lea eax, [ebp + 1]
mov ecx, 0x20
nop dword [eax + eax]
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x41f0f0
push esi
call sym._malloc
add esp, 4
mov edi, eax
mov byte [eax], 0
mov eax, dword [esp]
mov dword [eax + 8], edi
mov dword [eax], esi
mov esi, eax
push ebp
push ebx
push edi
call sym._memcpy
add esp, 0xc
mov dword [esi + 4], ebp
add edi, ebp
mov byte [edi], 0
mov ebp, dword [esi + 4]
xor edi, edi
test ebp, ebp
je 0x41f234
mov ebx, dword [esi + 8]
mov ecx, ebp
mov eax, ebp
nop word [eax + eax]
sub eax, 1
jb 0x41f1c8
cmp byte [ebx + ecx - 1], 0x20
mov ecx, eax
jne 0x41f140
cmp ebp, eax
jbe 0x41f1c8
cmp dword [esi], 0
je 0x41f17b
add ebx, eax
mov dword [esi + 4], eax
mov edi, ebx
jmp 0x41f1c0
xor edi, edi
jmp 0x41f234
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionNushell
mov dword [esp], esi
mov dword [esi + 4], 0
lea eax, [ebp + 1]
mov ecx, 0x20
nop dword [eax]
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x41f190
push esi
call sym._malloc
add esp, 4
mov edi, eax
mov byte [eax], 0
mov eax, dword [esp]
mov dword [eax + 8], edi
mov dword [eax], esi
mov esi, eax
push ebp
push ebx
push edi
call sym._memcpy
add esp, 0xc
mov dword [esi + 4], ebp
add edi, ebp
mov byte [edi], 0
mov ebp, dword [esi + 4]
xor edi, edi
test ebp, ebp
je 0x41f234
mov eax, dword [esi + 8]
mov edi, ebp
neg edi
add eax, ebp
dec eax
xor ecx, ecx
nop dword [eax + eax]
mov edx, ebp
add edx, ecx
je 0x41f232
lea ebx, [ecx - 1]
inc edi
cmp byte [eax + ecx], 0x20
mov ecx, ebx
jne 0x41f1e0
mov eax, ebp
add eax, ebx
jae 0x41f232
cmp dword [esi], 0
je 0x41f2ed
mov eax, dword [esi + 8]
lea ecx, [eax + ebp]
add ecx, ebx
inc ecx
mov edx, ebx
not edx
push edx
push ecx
push eax
call sym._memmove
add esp, 0xc
mov eax, dword [esi + 4]
not ebp
add ebp, eax
sub ebp, ebx
mov dword [esi + 4], ebp
add eax, dword [esi + 8]
mov byte [edi + eax - 1], 0
mov edi, dword [esi + 4]
jmp 0x41f234
mov edi, ebp
mov ebp, dword [esi + 8]
push edi
push 0x28
push ebp
call sym._memchr
add esp, 0xc
mov ecx, eax
sub ecx, ebp
test eax, eax
cmove ecx, edi
mov bl, 1
cmp edi, ecx
jbe 0x41f42e
cmp dword [esi], 0
je 0x41f26b
mov dword [esi + 4], ecx
add ebp, ecx
mov edi, ebp
mov byte [ebp], 0
jmp 0x41f42e
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [0x5052b0]
mov dword [esi + 8], eax
test ebp, ebp
je 0x41f42e
mov dword [esp], esi
mov dword [esp + 4], edi
lea eax, [edi + 1]
mov ecx, 0x20
nop word [eax + eax]
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x41f2a0
push esi
call sym._malloc
add esp, 4
mov edi, eax
mov byte [eax], 0
mov eax, dword [esp]
mov dword [eax + 8], edi
mov dword [eax], esi
mov esi, dword [esp + 4]
push esi
push ebp
push edi
call sym._memcpy
add esp, 0xc
mov eax, dword [esp]
mov dword [eax + 4], esi
add edi, esi
mov byte [edi], 0
jmp 0x41f42e
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionKsh
mov edi, ebx
neg edi
mov dword [esi + 4], edi
add ebp, dword [esi + 8]
add ebp, ebx
mov dword [esi + 8], ebp
jmp 0x41f237
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionOksh
cmp dword [esi], 0
je 0x41f417
mov byte [ebx + ebp - 2], 0
mov edi, dword [esi + 4]
test edi, edi
je 0x41f42c
mov ebx, dword [esi + 8]
cmp byte [edi + ebx - 1], 0x20
jne 0x41f3b1
inc edi
mov ebp, edi
lea eax, [edi - 2]
mov dword [esi + 4], eax
cmp edi, 2
je 0x41f3a0
lea edi, [ebp - 1]
cmp byte [ebx + ebp - 3], 0x20
je 0x41f335
cmp dword [esi], 0
jne 0x41f3a5
lea eax, [edi - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esi + 4], 0
mov eax, 0x20
mov esi, eax
add eax, eax
cmp edi, esi
ja 0x41f367
push esi
call sym._malloc
add esp, 4
mov edi, eax
mov byte [eax], 0
mov eax, dword [esp]
mov dword [eax + 8], edi
mov dword [eax], esi
mov esi, eax
push dword [esp + 4]
push ebx
push edi
call sym._memcpy
add esp, 0xc
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov ebx, edi
jmp 0x41f3a5
cmp dword [esi], 0
je 0x41f417
mov byte [ebx + ebp - 2], 0
mov edi, dword [esi + 4]
test edi, edi
je 0x41f42c
mov dword [esp], esi
mov eax, dword [esi + 8]
mov ebp, edi
neg ebp
add eax, edi
dec eax
xor ecx, ecx
mov bl, 1
mov edx, edi
add edx, ecx
je 0x41f42e
lea esi, [ecx - 1]
inc ebp
cmp byte [eax + ecx], 0x20
mov ecx, esi
jne 0x41f3c0
mov eax, edi
add eax, esi
jae 0x41f42e
mov ecx, dword [esp]
cmp dword [ecx], 0
je 0x41f4af
mov eax, dword [ecx + 8]
lea ecx, [eax + edi]
add ecx, esi
inc ecx
mov edx, esi
not edx
push edx
push ecx
push eax
call sym._memmove
add esp, 0xc
mov ecx, dword [esp]
mov eax, dword [ecx + 4]
not edi
add edi, eax
sub edi, esi
mov dword [ecx + 4], edi
add eax, dword [ecx + 8]
mov byte [ebp + eax - 1], 0
jmp 0x41f42e
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [0x5052b0]
mov dword [esi + 8], eax
mov bl, 1
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionOils
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp sym._getExeVersionRaw
mov dword [esp], esi
mov dword [esi + 4], 0
lea eax, [ebp + 1]
mov ecx, 0x20
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x41f46a
push esi
call sym._malloc
add esp, 4
mov byte [eax], 0
mov ecx, dword [esp]
mov dword [ecx + 8], eax
mov dword [ecx], esi
mov esi, ecx
push ebp
push edi
push eax
mov edi, eax
call sym._memcpy
add esp, 0xc
mov dword [esi + 4], ebp
add edi, ebp
mov byte [edi], 0
jmp 0x41f42e
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionAsh
mov eax, esi
neg eax
mov dword [ecx + 4], eax
add edi, dword [ecx + 8]
add edi, esi
mov dword [ecx + 8], edi
jmp 0x41f42e
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionXonsh
mov ecx, edi
mov edx, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp dbg.getShellVersionWinPowerShell