Function at 0x102181a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 8
push ebx
push esi
push edi
xor ebx, ebx
push ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [esp + 0x14], ebx
cmp dword [0x1024ab28], ebx
jne 0x102181f1
call esi
mov ebx, eax
test ebx, ebx
je 0x102181cf
mov dword [0x1024ab28], 1
jmp 0x102181f1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x102181e7
mov dword [0x1024ab28], 2
jmp 0x102181f1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x1024ab28], 1
jne 0x1021827e
test ebx, ebx
jne 0x10218214
call esi
mov ebx, eax
test ebx, ebx
jne 0x10218214
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp word [ebx], 0
mov ebp, ebx
je 0x10218230
add ebp, 2
cmp word [ebp], 0
jne 0x1021821c
add ebp, 2
cmp word [ebp], 0
jne 0x1021821c
sub ebp, ebx
add ebp, 2
push ebp
call sym.MSVCRT40.dll_malloc
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x10218257
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x1024ab28], 2
jne 0x10218377
test ebx, ebx
jne 0x102182a5
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x102182a5
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov esi, ebx
cmp byte [ebx], 0
je 0x102182dd
push 0
mov eax, dword [0x1024ad48]
push 0
push 0xffffffffffffffff
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x10218309
mov edi, esi
mov ecx, 0xffffffff
add dword [esp + 0x14], eax
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
add esi, ecx
cmp byte [esi], 0
jne 0x102182ac
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add eax, eax
push eax
call sym.MSVCRT40.dll_malloc
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x10218313
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov esi, ebx
mov ebp, dword [esp + 0x10]
cmp byte [ebx], 0
je 0x10218366
mov eax, dword [esp + 0x14]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov edx, dword [0x1024ad48]
sar ecx, 1
sub eax, ecx
push eax
push ebp
push 0xffffffffffffffff
push esi
push 1
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1021837f
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
add esi, ecx
call sym.MSVCRT40.dll_wcslen
add esp, 4
lea ebp, [ebp + eax*2 + 2]
cmp byte [esi], 0
jne 0x1021831e
mov word [ebp], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push eax
call sym.MSVCRT40.dll_free
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret