Function at 0x430351
Capabilities:
Query environment variable

Disassembly:
push 0x48
mov eax, 0x4556f2
call fcn.00433180
mov edi, dword [ebp + 8]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push 7
pop esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x40], ax
push 0x405f54
push edi
mov byte [ebp - 4], 1
mov byte [ebp - 0x41], cl
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x4303b2
push 0x1a
pop esi
push 0x405f70
call fcn.0041193d
pop ecx
push eax
push 0x405f70
jmp 0x43047c
push 0x405f80
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x4303ca
push 0x23
jmp 0x430454
push 0x4011dc
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x4303f4
push 0x2b
pop esi
push 0x405fa8
call fcn.0041193d
pop ecx
push eax
push 0x405fa8
jmp 0x43047c
push 0x405fdc
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x430409
push 0x1c
jmp 0x430454
push 0x406004
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x430430
push 0x26
pop esi
push 0x40602c
call fcn.0041193d
pop ecx
push eax
push 0x40602c
jmp 0x43047c
push 0x406048
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
je 0x4304bb
push 0x406064
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x430457
push 0x25
pop esi
jmp 0x4304bb
push 0x406080
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x430486
push 0x24
pop esi
push 0x40609c
call fcn.0041193d
pop ecx
push eax
push 0x40609c
lea ecx, [ebp - 0x28]
call fcn.004117eb
jmp 0x4304bb
push 0x404cc0
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x4305cc
push 0x24
pop esi
push 0x40609c
call fcn.0041193d
pop ecx
push eax
push 0x40609c
lea ecx, [ebp - 0x28]
call fcn.004117eb
mov byte [ebp - 0x41], 1
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.00432467
pop ecx
pop ecx
test al, al
je 0x4304f1
cmp byte [ebp - 0x41], 0
jne 0x430596
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x4305c8
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00411757
jmp 0x4305c8
cmp dword [ebp - 0x18], 0
jbe 0x4305cc
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x430507
lea eax, [ebp - 0x28]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x4305cc
xor eax, eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x54]
push eax
push esi
call fcn.00414469
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 2
jae 0x430547
lea eax, [ebp - 0x28]
push esi
push dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp - 0x50]
call fcn.0041193d
pop ecx
push eax
push dword [ebp - 0x50]
lea ecx, [ebp - 0x40]
call fcn.004117eb
cmp byte [ebp - 0x41], 0
jne 0x43058a
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x430580
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.00411757
lea ecx, [ebp - 0x50]
call fcn.0041449a
jmp 0x4305c8
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0041449a
push 0x404cc0
push edi
call fcn.00438212
pop ecx
pop ecx
test eax, eax
jne 0x4305cc
cmp dword [ebp - 0x2c], 8
mov eax, dword [ebp - 0x40]
jae 0x4305b3
lea eax, [ebp - 0x40]
xor ecx, ecx
push ecx
push ecx
push ecx
push ebx
push eax
call fcn.0043168b
push ebx
call fcn.0042f177
add esp, 0x18
mov bl, 1
jmp 0x4305ce
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00411703
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00411703
mov al, bl
call fcn.0043312a
ret