Function at 0x5d9ea0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov esi, esp
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x9dd4b4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x5d9ee4
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edi, eax
add eax, 0xffff3bd4
cmp eax, 0xa
jae 0x5d9efe
mov ecx, 0x2a7
bt ecx, eax
jae 0x5d9f09
xor ecx, ecx
jmp 0x5d9f1f
call fcn.005e81c0
xor ecx, ecx
test eax, eax
jne 0x5da131
push ebx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
jmp 0x5da133
lea eax, [edi - 0xdeaa]
cmp eax, 0xa
jb 0x5d9ee0
xor eax, eax
cmp edi, 0x2a
setne al
shl eax, 3
xor ecx, ecx
cmp edi, 0xfde8
cmovne ecx, eax
push 0
push 0
push 0xffffffffffffffff
push ebx
mov dword [esi + 8], ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
test eax, eax
jle 0x5da131
mov ebx, eax
lea eax, [eax*2 + 8]
cmp eax, 0x400
ja 0x5d9f65
add eax, 3
and eax, 0xfffffffc
call fcn.00787ee0
mov eax, esp
and eax, 0xfffffff0
mov esp, eax
mov dword [eax], 0xcccc
jmp 0x5d9f7e
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
xor ecx, ecx
add esp, 4
test eax, eax
je 0x5da131
mov dword [eax], 0xdddd
mov dword [esi + 0xc], eax
add eax, 8
push ebx
mov ebx, eax
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dl, 1
xor ecx, ecx
test eax, eax
jle 0x5d9fdb
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x5d9ff1
mov edi, eax
mov dword [esi + 8], ebx
lea eax, [eax*2 + 8]
cmp eax, 0x400
ja 0x5da00b
add eax, 3
and eax, 0xfffffffc
call fcn.00787ee0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
mov dword [ebx], 0xcccc
jmp 0x5da030
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5da0da
jmp 0x5da114
xor ebx, ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5da0da
jmp 0x5da114
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov ebx, 0
test eax, eax
mov ecx, 0
mov dl, 1
je 0x5da0cf
mov dword [eax], 0xdddd
mov ebx, eax
add ebx, 8
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
cmp eax, edi
jae 0x5da0bc
sub esp, 0x20
movss xmm0, dword [0x9dd4b0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x5da0cb
mov edi, eax
push 0x46
push str.crypto_getenv.c
push eax
call fcn.005db3a0
add esp, 0xc
test eax, eax
je 0x5da0cb
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
test eax, eax
je 0x5da0f5
mov ecx, edi
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5da0da
jmp 0x5da114
xor edx, edx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5da0da
jmp 0x5da114
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
jne 0x5da114
push eax
mov edi, ecx
mov dword [esi + 8], ebx
mov ebx, edx
call fcn.00786dc0
mov ecx, edi
add esp, 4
test bl, bl
mov ebx, dword [esi + 8]
je 0x5da118
jmp 0x5da131
push 0x4c
push str.crypto_getenv.c
push edi
call fcn.005db5b0
xor edx, edx
add esp, 0xc
xor ecx, ecx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5da0da
test dl, dl
jne 0x5da131
cmp dword [ebx - 8], 0xdddd
jne 0x5da131
add ebx, 0xfffffff8
push ebx
mov edi, ecx
call fcn.00786dc0
mov ecx, edi
add esp, 4
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret