Function at 0x402560
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x406014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc28], eax
push edi
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x4011dc
push 2
pop esi
push esi
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call esi
add esp, 0xc
mov ecx, eax
call fcn.00402f39
test al, al
je 0x4025b5
mov byte [0x4064ce], bl
push ebx
call esi
pop ecx
mov ecx, eax
call fcn.00402f39
test al, al
je 0x4025ca
mov byte [0x4064cb], bl
xor ecx, ecx
cmp dword [ebp + 8], ebx
je 0x402b8b
push ecx
push ecx
mov edi, ecx
mov byte [ebp - 0xc2b], cl
push 0x4011e4
mov byte [ebp - 0xc29], cl
mov byte [ebp - 0xc2a], bl
mov dword [ebp - 0xc], edi
mov byte [0x4064c8], cl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x402609
mov byte [0x4064c8], bl
cmp dword [ebp + 8], 1
push 0x2f
pop edx
push 7
mov dword [ebp - 0xc34], edx
mov dword [ebp - 0xc30], 0x2d
pop ecx
jle 0x4029bb
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov eax, dword [ebp - 0xc28]
mov esi, dword [eax + ebx*4]
movzx eax, word [esi]
cmp ax, dx
je 0x40264c
push 0x2d
pop edx
cmp ax, dx
jne 0x402988
push 2
pop eax
push ecx
add esi, eax
push 0x401210
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x402672
lea eax, [esi + 0xe]
mov dword [0x4064d8], eax
jmp 0x402971
push 0x401220
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x40268b
inc eax
mov byte [0x4064ca], al
jmp 0x402971
push 8
push 0x401234
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x402827
push 0x10
pop eax
add esi, eax
push 0x401248
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402809
push 0x401254
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4026ed
mov eax, 0x1c4
mov word [0x4064d0], ax
push 2
pop eax
mov word [0x4064cc], ax
mov eax, 0xf4
mov word [0x406028], ax
jmp 0x402971
push 0x40125c
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402716
mov eax, 0xaa64
mov word [0x4064d0], ax
push 2
pop eax
mov word [0x4064cc], ax
mov eax, 0xf6
jmp 0x4026e2
push 0x401268
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x40273f
mov eax, 0xa641
mov word [0x4064d0], ax
push 2
pop eax
mov word [0x4064cc], ax
mov eax, 0xf8
jmp 0x4026e2
push 0x401278
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x40276b
mov eax, 0xa64e
mov word [0x4064d0], ax
push 2
pop eax
mov word [0x4064cc], ax
mov eax, 0xf9
jmp 0x4026e2
push 0x401288
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402797
mov eax, 0xebc
mov word [0x4064d0], ax
xor eax, eax
inc eax
mov word [0x4064cc], ax
mov eax, 0xe0
jmp 0x4026e2
push 0x401290
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4027c1
mov eax, 0x200
mov word [0x4064d0], ax
push 0x10
pop eax
mov word [0x4064cc], ax
add eax, 0x70
jmp 0x4026e2
push 0x40129c
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402940
push 0x4012a8
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402940
push 0x4012b0
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402940
push 0x4012bc
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4029a8
mov eax, 0x8664
mov word [0x4064d0], ax
push 3
pop eax
mov word [0x4064cc], ax
mov eax, 0xd0
jmp 0x4026e2
push 0x4012c4
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402841
inc eax
mov byte [ebp - 0xc2b], al
jmp 0x402971
push 0x4012d4
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402864
mov eax, dword [ebp - 0xc28]
inc ebx
push 7
pop ecx
mov esi, dword [eax + ebx*4]
mov dword [ebp - 0xc], esi
jmp 0x40297a
push 4
push 0x4012d8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x402884
add esi, 8
mov dword [ebp - 0xc], esi
jmp 0x402971
push 0x4012e4
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40296a
push 0x4012f8
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x40296a
push 9
push 0x4012fc
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4028f1
lea ecx, [esi + 0x12]
call fcn.00402c4a
mov ecx, dword [0x406538]
mov esi, eax
inc ecx
push ecx
call fcn.00402e9f
test eax, eax
je 0x402b90
mov edx, dword [0x406538]
mov ecx, dword [0x406534]
mov dword [ecx + edx*4 - 4], esi
jmp 0x402971
push 0x401310
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402960
push 0x401320
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402960
push 0x401324
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x402924
inc eax
mov byte [ebp - 0xc29], al
jmp 0x402971
push 0x401334
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x402940
push 0x40129c
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4029a8
push 7
pop ecx
mov eax, 0x14c
mov word [0x4064cc], cx
push 3
mov word [0x4064d0], ax
pop eax
mov word [0x406028], ax
jmp 0x402974
xor eax, eax
inc eax
mov byte [0x4064c9], al
jmp 0x402971
mov byte [ebp - 0xc2a], 0
push 7
pop ecx
mov eax, dword [ebp - 0xc28]
inc ebx
cmp ebx, dword [ebp + 8]
jge 0x402988
push 0x2f
pop edx
jmp 0x402635
mov al, byte [ebp - 0xc2a]
mov edi, dword [ebp - 0xc]
mov byte [ebp - 0xc2a], al
mov al, byte [ebp - 0xc29]
mov byte [ebp - 0xc29], al
cmp ebx, dword [ebp + 8]
jne 0x4029b2
xor eax, eax
lea ecx, [eax + 1]
jmp 0x402b8b
cmp byte [ebp - 0xc2b], 0
jne 0x4029e8
push 0x4011bc
mov ecx, 0x1f43
call fcn.00404c9e
push eax
call fcn.00402fa7
pop ecx
pop ecx
mov ecx, 0x1f44
call fcn.00404c9e
mov ecx, eax
call fcn.00402fe2
call fcn.00402fb6
cmp word [0x4064d0], 0
jne 0x402a23
push 0x4012a8
push 0xfa1
call fcn.00402e75
pop ecx
pop ecx
mov eax, 0x14c
push 7
mov word [0x4064d0], ax
pop eax
push 3
pop edx
mov word [0x4064cc], ax
mov word [0x406028], dx
jmp 0x402a26
push 3
pop edx
cmp ebx, dword [ebp + 8]
jge 0x402b38
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp - 0xc28]
mov esi, dword [eax + ebx*4]
movzx eax, word [esi]
cmp ax, word [ebp - 0xc34]
je 0x4029a8
cmp ax, word [ebp - 0xc30]
je 0x4029a8
push ecx
lea eax, [ebp - 0x60c]
push eax
push ecx
lea eax, [ebp - 0x20c]
push eax
push ecx
lea eax, [ebp - 0x40c]
push eax
push edx
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x24
cmp word [ebp - 0x60c], 0
jne 0x402abd
push 0x401340
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x814]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s]
add esp, 0x18
lea esi, [ebp - 0x814]
test edi, edi
jne 0x402af3
push 0x40134c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xa1c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s]
add esp, 0x18
lea edi, [ebp - 0xa1c]
cmp dword [0x4064dc], 0
jne 0x402b03
mov ecx, edi
call fcn.00403b1b
push 0x104
lea eax, [ebp - 0xc24]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath]
add esp, 0xc
test eax, eax
jne 0x402b1f
mov eax, esi
mov ecx, eax
call fcn.00404278
inc ebx
mov ecx, pe_nt_image_headers32
push 3
pop edx
cmp ebx, dword [ebp + 8]
jl 0x402a34
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
mov bl, byte [ebp - 0xc29]
test bl, bl
je 0x402b4d
or eax, 0xffffffff
jmp 0x402b56
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
pop ecx
mov dl, byte [ebp - 0xc2a]
mov ecx, edi
push eax
call fcn.0040466e
test bl, bl
je 0x402b7a
push ecx
lea edx, [ebp - 0xc30]
mov ecx, edi
call fcn.0040235e
test eax, eax
je 0x402b9e
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405010
leave
ret
call fcn.00402502
xor eax, eax
inc eax
push eax
push 0x44e
call fcn.00402e2c
push dword [ebp - 0xc30]
push edi
push 0x457
call fcn.00402e2c
int3