Function at 0x41e1d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x40]
mov edi, 0x7f2bb707
cmp dword [ebp], 0x7f2bb707
jne 0x41ea9b
push 0xc8
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x41e379
mov edi, eax
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
mov dword [edi], 0x7f2bb701
or eax, 0x200
mov dword [edi + 8], eax
mov dword [edi + 0x5c], 0x12
push str.E2FSPROGS_FAKE_TIME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x41e244
push 0
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [edi + 0x60], eax
mov dword [esp], edi
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41ea78
mov edi, eax
mov ebx, dword [esp + 0x30]
mov eax, dword [esp]
mov dword [eax + 0xc], edi
push esi
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push 0x3f
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test ebx, ebx
jne 0x41e29b
test eax, eax
je 0x41e29b
mov ebx, eax
add ebx, 1
mov byte [eax], 0
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
mov esi, dword [esp + 0x34]
mov eax, esi
and eax, 1
mov ecx, esi
shr ecx, 0xd
and ecx, 2
mov edx, esi
shr edx, 0x11
and edx, 4
or edx, ecx
mov ecx, esi
shr ecx, 0x16
and ecx, 0x10
or ecx, edx
or ecx, eax
mov eax, dword [esp]
add eax, 4
mov dword [esp + 0xc], eax
push eax
push ecx
push edi
call dword [ebp + 8]
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x41ea7d
test ebx, ebx
je 0x41e2fc
push ebx
mov eax, dword [esp + 0x10]
push dword [eax]
call fcn.0041b5c0
add esp, 8
mov edi, eax
test eax, eax
jne 0x41ea7d
mov ecx, dword [esp]
mov eax, dword [ecx + 4]
mov dword [ecx + 0x88], eax
mov dword [eax + 0x5c], ecx
lea ebp, [ecx + 0x10]
push ebp
push 0xfffffc00
push dword [ecx + 4]
call fcn.0041b7c0
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x41ea7d
test dword [esp + 0x34], 0x2000
jne 0x41e383
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
test edi, edi
mov esi, dword [esp]
je 0x41e3f1
test ebx, ebx
je 0x41e3e7
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esp + 4], ebx
push ebx
push eax
call dword [ecx + 0x10]
add esp, 8
mov eax, edi
sar eax, 0x1f
mov dword [esp + 0x10], eax
mov dword [esi + 0x54], 0
mov dword [esp + 8], edi
jmp 0x41e437
mov edi, 0x7f2bb746
jmp 0x41ea9b
push 0x14c
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
mov ecx, dword [esp]
je 0x41ea78
mov dword [ecx + 0x58], eax
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + 4]
push eax
push 0xfffffeb4
push 0
push ecx
call dword [edx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41ea7d
mov esi, dword [esp]
mov eax, dword [esi + 0x58]
mov edi, 0x7f2bb710
cmp dword [eax], 0x7f2bb710
jne 0x41ea9b
mov ebx, dword [eax + 0xcc]
mov edi, 1
test ebx, ebx
jne 0x41e34e
mov edi, 0x7f2bb747
jmp 0x41ea7d
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push 0x400
push eax
call dword [ecx + 0x10]
add esp, 8
push 0x400
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41ea78
mov dword [esp + 4], ebx
mov dword [esi + 0x54], eax
mov dword [esp + 8], 0
mov edi, 1
mov dword [esp + 0x10], 0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push dword [esi + 0x10]
push 0xfffffc00
mov dword [esp + 0x1c], edi
push edi
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41ea7d
mov esi, dword [esp]
mov eax, dword [esi + 0x54]
test eax, eax
je 0x41e476
push 0x400
push dword [ebp]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor edx, edx
test byte [esi + 0xa], 0x20
jne 0x41e4ac
push dword [esi + 0x10]
push esi
call fcn.00412f90
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.00412fc0
add esp, 8
test eax, eax
je 0x41e55d
xor eax, eax
test edi, edi
mov edx, 0x7f2bb799
cmovne edx, eax
mov edi, 0x7f2bb750
test byte [esi + 8], 0x40
jne 0x41ea7d
mov eax, dword [ebp]
movzx ecx, word [eax + 0x38]
cmp ecx, 0xef53
mov edi, 0x7f2bb713
cmove edi, edx
test edi, edi
jne 0x41ea7d
mov edi, 0x7f2bb714
cmp dword [eax + 0x4c], 1
ja 0x41ea7d
test dword [esp + 0x34], 0x400
jne 0x41e54b
mov ecx, dword [eax + 0x60]
mov edi, 0x7f2bb743
test ecx, 0xfffc1921
jne 0x41ea7d
mov esi, dword [eax + 0x64]
mov edx, esi
and edx, 0xffff0084
mov ebx, dword [esp + 0x34]
test ebx, 0x8000
cmove edx, esi
test bl, 1
je 0x41e533
mov edi, 0x7f2bb744
and edx, 0xffff0884
jne 0x41ea7d
test dword [esp + 0x34], 0x1000
jne 0x41e54b
mov edi, 0x7f2bb743
and ecx, 8
jne 0x41ea7d
mov ecx, dword [eax + 0x18]
cmp ecx, 6
jbe 0x41e5d1
mov edi, 0x7f2bb73c
jmp 0x41ea7d
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push dword [ebp]
push 0xfffffc00
push dword [esp + 0x1c]
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41ea7d
mov esi, dword [esp]
mov eax, dword [esi + 0x54]
test eax, eax
je 0x41e59e
push 0x400
push dword [ebp]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
test byte [esi + 0xa], 0x20
jne 0x41e5ca
push dword [esi + 0x10]
push esi
call fcn.00412f90
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.00412fc0
add esp, 8
test eax, eax
je 0x41e62f
mov esi, dword [esp]
jmp 0x41e4a0
xor edx, edx
jmp 0x41e4ac
mov edx, dword [eax + 0x64]
bt edx, 9
jae 0x41e5ef
mov ebx, dword [esp + 0x34]
mov edi, 0x7f2bb789
and ebx, 0x20000
je 0x41ea7d
shr edx, 9
test dl, 1
jne 0x41e600
cmp ecx, dword [eax + 0x1c]
jne 0x41e553
mov edx, 0x400
shl edx, cl
mov ecx, dword [esp]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], edx
cmp dword [eax + 0x4c], 0
je 0x41e6ad
movzx ecx, word [eax + 0x58]
cmp ecx, 0x80
jb 0x41e553
jmp 0x41e6b2
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push dword [ebp]
push 0xfffffc00
push dword [esp + 0x1c]
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41ea7d
mov ebx, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x41e671
push 0x400
push dword [ebx]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
test byte [eax + 0xa], 0x20
jne 0x41e741
mov esi, dword [esp]
push dword [esi + 0x10]
push esi
call fcn.00412f90
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.00412fc0
add esp, 8
test eax, eax
je 0x41e74d
mov esi, dword [esp]
mov ebp, ebx
jmp 0x41e4a0
mov ecx, 0x80
cmp ecx, edx
ja 0x41e553
mov esi, ecx
shr esi, 1
and esi, 0x5555
sub ecx, esi
mov esi, ecx
and esi, 0x33333333
shr ecx, 2
and ecx, 0x33333333
add ecx, esi
mov esi, ecx
shr esi, 4
add esi, ecx
and esi, 0xf0f0f0f
imul ecx, esi, 0x1010101
shr ecx, 0x18
cmp ecx, 1
ja 0x41e553
test byte [eax + 0x60], 0x80
je 0x41e711
mov edi, 0x7f2bb791
cmp word [eax + 0xfe], 0x40
jb 0x41ea7d
mov ecx, dword [eax + 0x1c]
sub ecx, dword [eax + 0x18]
mov esi, dword [esp]
mov dword [esi + 0x64], ecx
mov esi, dword [eax + 0x24]
shl esi, cl
cmp dword [eax + 0x20], esi
jne 0x41e553
mov ecx, dword [eax + 0x28]
cmp dword [eax + 0x4c], 0
je 0x41e7d1
movzx esi, word [eax + 0x58]
jmp 0x41e7d6
mov esi, dword [esp]
mov ebp, ebx
xor edx, edx
jmp 0x41e4ac
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push dword [ebx]
push 0xfffffc00
push dword [esp + 0x1c]
push eax
call dword [ecx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41ea7d
mov eax, dword [esp]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x41e78c
push 0x400
push dword [ebx]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov esi, dword [esp]
test byte [esi + 0xa], 0x20
mov ebp, ebx
mov edx, 0
jne 0x41e4ac
push dword [esi + 0x10]
push esi
call fcn.00412f90
add esp, 8
mov edi, eax
push dword [esi + 0x10]
push esi
call fcn.00412fc0
add esp, 8
test eax, eax
jne 0x41e6a3
mov edx, 0x7f2bb798
mov esi, dword [esp]
mov ebp, ebx
jmp 0x41e4ac
mov esi, 0x80
imul esi, ecx
mov cl, byte [eax + 0x18]
mov eax, 0x400
shl eax, cl
add eax, esi
add eax, 0xffffffff
add cl, 0xa
shr eax, cl
mov ecx, dword [esp]
mov dword [ecx + 0x28], eax
cmp dword [esp + 4], 0
mov esi, ebp
je 0x41e80b
mov edi, 0x7f2bb722
cmp dword [esp + 4], edx
jne 0x41ea7d
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
push edx
push eax
call dword [ecx + 0x10]
add esp, 8
mov eax, dword [esi]
test byte [eax + 0x60], 8
jne 0x41e885
cmp dword [eax + 0x28], 0
je 0x41e553
mov esi, dword [esp]
push esi
call fcn.00412ee0
add esp, 4
mov ebx, dword [esi + 0x10]
mov esi, dword [ebx + 0x20]
test esi, esi
je 0x41e553
mov dl, byte [ebx + 0x18]
mov cl, byte [ebx + 0x1c]
mov eax, 0x400
shl eax, cl
mov edi, 0x400
mov ecx, edx
shl edi, cl
cdq
idiv edi
imul eax, eax, 0xfff8
cmp esi, eax
ja 0x41e553
mov eax, dword [esp]
mov eax, dword [eax + 0x28]
mov dword [esp + 4], eax
cmp dword [ebx + 0x4c], 0
je 0x41e89c
movzx ecx, word [ebx + 0x58]
jmp 0x41e8a1
mov eax, dword [esp]
mov dword [eax + 0x1c], 0
mov ecx, dword [esp + 0x44]
mov dword [ecx], eax
xor edi, edi
jmp 0x41ea9b
mov ecx, 0x80
mov eax, edi
cdq
idiv ecx
mov edx, 0x10000
sub edx, eax
cmp dword [esp + 4], edx
ja 0x41e553
mov ecx, 0x20
test byte [ebx + 0x60], 0x80
je 0x41e8c9
movzx ecx, word [ebx + 0xfe]
mov eax, edi
cdq
idiv ecx
test eax, eax
je 0x41e553
mov edi, dword [ebx + 0x14]
push ebx
call fcn.00412170
add esp, 4
xor ebx, ebx
cmp edi, eax
mov eax, 0
sbb eax, edx
jae 0x41e553
mov edi, ebp
push dword [ebp]
call fcn.00412170
add esp, 4
mov ecx, dword [ebp]
mov dword [esp + 4], ecx
sub eax, dword [ecx + 0x14]
sbb edx, 0
mov ecx, eax
or ecx, edx
je 0x41e93c
add eax, 0xffffffff
adc edx, 0xffffffff
push 0
push esi
push edx
push eax
call fcn.004242b0
add esp, 0x10
mov ebx, eax
xor eax, eax
mov ecx, 0xfffffffe
cmp ecx, ebx
sbb eax, edx
jb 0x41e553
add ebx, 1
mov eax, dword [esp]
mov dword [eax + 0x1c], ebx
test dword [esp + 0x34], 0x800000
jne 0x41e964
mov eax, ebx
mov ecx, dword [esp + 4]
mul dword [ecx + 0x28]
xor eax, dword [ecx]
or eax, edx
mov edi, 0x7f2bb73c
jne 0x41ea7d
mov edx, dword [esp + 4]
mov cl, byte [edx + 0x18]
mov eax, 0x400
shl eax, cl
mov ecx, 0x20
test byte [edx + 0x60], 0x80
je 0x41e988
mov ecx, dword [esp + 4]
movzx ecx, word [ecx + 0xfe]
test ebx, ebx
je 0x41e9cb
cdq
idiv ecx
mov ecx, eax
add ebx, 0xffffffff
mov eax, ebx
xor edx, edx
div ecx
mov ecx, eax
add ecx, 1
mov eax, dword [esp]
mov dword [eax + 0x20], ecx
test dword [esp + 0x34], 0x800
jne 0x41ebe6
mov eax, dword [esp]
mov esi, dword [eax + 0x14]
mov eax, ecx
mul esi
jo 0x41ea78
mov edi, dword [esp]
add edi, 0x20
jmp 0x41e9f0
mov eax, dword [esp]
mov dword [eax + 0x20], 0
test dword [esp + 0x34], 0x800
jne 0x41ebe6
mov eax, dword [esp]
mov edi, eax
add edi, 0x20
mov esi, dword [eax + 0x14]
xor ecx, ecx
imul ecx, esi
push ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41ea78
mov ebx, eax
mov eax, dword [esp]
mov dword [eax + 0x24], ebx
xor eax, eax
mov ecx, dword [esp + 8]
or ecx, dword [esp + 0x10]
jne 0x41ea4b
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x10], 0
mov eax, 0
mov dword [esp + 8], ecx
test ecx, ecx
jne 0x41ea4b
xor eax, eax
cmp esi, 0x400
sete al
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 4]
test byte [ecx + 0x60], 0x10
je 0x41eaa5
mov ecx, dword [esp + 0x34]
and ecx, 0x2000
jne 0x41eaa5
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 0x104]
mov ecx, dword [edi]
cmp edx, ecx
cmova edx, ecx
mov dword [esp + 4], edx
jmp 0x41eaab
mov edi, 0x7f2bb746
test dword [esp + 0x34], 0x10000
mov eax, dword [esp]
jne 0x41ea95
push eax
call fcn.00431300
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword [ecx], eax
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [edi]
mov dword [esp + 4], ecx
cmp dword [esp + 4], 0
je 0x41eae7
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx]
mov edx, dword [ecx + 4]
mov esi, dword [esp + 8]
add eax, esi
add eax, 1
push ebx
push dword [esp + 8]
push eax
push ecx
call dword [edx + 0x14]
add esp, 0x10
mov edi, eax
test eax, eax
jne 0x41ea7d
mov ecx, dword [esp]
mov eax, dword [ecx + 0x14]
imul eax, dword [esp + 4]
add ebx, eax
mov ecx, dword [ecx + 0x20]
cmp dword [esp + 4], ecx
jae 0x41eb21
mov esi, dword [esp + 4]
mov edi, dword [esp]
push esi
push dword [esp + 0x14]
push dword [esp + 0x10]
push edi
call fcn.0041e040
add esp, 0x10
push 0
push 1
push edx
push eax
push dword [edi + 4]
call fcn.0041b820
add esp, 0x14
add esi, 1
mov ecx, dword [edi + 0x20]
cmp esi, ecx
jb 0x41eaf4
cmp dword [esp + 4], ecx
jae 0x41eb6d
mov esi, dword [esp]
push dword [esp + 4]
push dword [esp + 0x14]
push dword [esp + 0x10]
push esi
call fcn.0041e040
add esp, 0x10
push ebx
push 1
push edx
push eax
push dword [esi + 4]
call fcn.0041b6e0
add esp, 0x14
test eax, eax
jne 0x41ec9b
mov eax, dword [esp]
add ebx, dword [eax + 0x14]
mov ecx, dword [esp + 4]
add ecx, 1
mov dword [esp + 4], ecx
cmp ecx, dword [eax + 0x20]
jb 0x41eb2a
mov edx, dword [esp]
mov eax, dword [edx + 0x10]
movzx ecx, word [eax + 0x164]
mov dword [edx + 0x50], ecx
cmp dword [esp + 0x14], 2
jl 0x41ebe6
movzx eax, word [eax + 0x64]
test eax, 0x410
je 0x41ebe6
mov eax, dword [esp]
cmp dword [eax + 0x1c], 0
je 0x41ebd3
xor esi, esi
mov edi, dword [esp]
push 2
push esi
push edi
call fcn.00412940
add esp, 0xc
push 1
push esi
push edi
call fcn.00412940
add esp, 0xc
push 0
push esi
push edi
call fcn.00412870
add esp, 0xc
push esi
push edi
call fcn.00413f90
add esp, 8
add esi, 1
cmp esi, dword [edi + 0x1c]
jb 0x41eb9d
mov eax, dword [esp]
mov eax, dword [eax + 8]
test al, 1
je 0x41ebe6
or eax, 6
mov ecx, dword [esp]
mov dword [ecx + 8], eax
mov eax, dword [ebp]
test byte [eax + 0x61], 1
je 0x41ec2b
mov eax, dword [esp + 0x34]
and eax, 0x100000
jne 0x41ec2b
mov eax, dword [esp + 0x34]
and eax, 0x4001
je 0x41ec2b
push dword [esp]
call fcn.0041cd10
add esp, 4
test eax, eax
je 0x41ec2b
mov edi, eax
mov eax, dword [esp]
or byte [eax + 0xa], 0x10
push eax
call fcn.0041cd20
add esp, 4
jmp 0x41ea7d
mov eax, dword [esp]
test byte [eax + 0xa], 0x40
je 0x41ec6d
push 0x1000
push 0x41ecb0
push 0x439520
call fcn.004395d0
add esp, 0xc
mov ecx, dword [esp]
mov dword [ecx + 0xc0], eax
mov edi, 0x7f2bb746
test eax, eax
je 0x41ea7d
mov eax, ebp
mov eax, dword [ebp]
or dword [eax + 0x64], 0x4000
mov eax, dword [ebp]
test byte [eax + 0x62], 2
je 0x41ec8f
movzx eax, word [eax + 0x27c]
push eax
call fcn.00434bd0
add esp, 4
mov ecx, dword [esp]
mov dword [ecx + 0xc4], eax
mov eax, dword [esp]
and byte [eax + 0xa], 0xfe
jmp 0x41e88f
mov edi, eax
jmp 0x41ea7d