Function at 0xf04cf61
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xf04cf78
xor eax, eax
jmp 0xf04d0c0
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
cmp word [eax], si
jne 0xf04cf8f
cmp word [eax + 2], si
je 0xf04cf93
inc eax
inc eax
jmp 0xf04cf84
sub eax, ebx
sar eax, 1
lea esi, [eax + eax + 4]
push edi
push esi
call fcn.0f007089
mov edi, eax
test edi, edi
pop ecx
jne 0xf04cfb0
xor eax, eax
jmp 0xf04d0be
push esi
push ebx
push edi
call fcn.0f01cd90
add esp, 0xc
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateEnvironment]
test eax, eax
jl 0xf04d0ce
cmp word [edi], bx
mov dword [ebp - 8], ebx
mov esi, edi
je 0xf04d078
cmp word [esi], 0x3d
jne 0xf04d006
lea eax, [esi + 2]
push 0x3d
push eax
call fcn.0f0570a1
cmp eax, ebx
pop ecx
pop ecx
je 0xf04d064
mov ecx, eax
sub ecx, esi
sar ecx, 1
shl ecx, 1
mov word [ebp - 0x14], cx
add eax, 2
jmp 0xf04d02e
cmp dword [ebp - 0xc], ebx
jne 0xf04d064
push 8
push 0xf003920
push esi
call fcn.0f056ffc
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
je 0xf04d064
mov word [ebp - 0x14], 0xe
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
test eax, eax
jl 0xf04d0c5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
push esi
call fcn.0f056fdd
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
pop ecx
jne 0xf04cfde
push edi
call fcn.0f0058a2
mov edi, dword [ebp + 8]
mov dword [0xf077458], ebx
cmp byte [edi], 0
pop ecx
jne 0xf04d0dd
mov eax, dword [ebp - 8]
add eax, 2
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
push 1
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
pop esi
leave
ret 8
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
push edi
call fcn.0f0058a2
pop ecx
jmp 0xf04cfa9
mov edi, dword [ebp + 8]
push edi
call sym.ntvdm.exe_cmdCheckTemp
test eax, eax
je 0xf04d102
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf04d0f7
sub eax, ecx
jmp 0xf04d111
push edi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
movzx eax, word [ebp - 0x2c]
test ebx, ebx
mov dword [ebp + 8], eax
jne 0xf04d131
push 8
push str.COMSPEC
push edi
call fcn.0f00816a
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0xf04d1a9
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jl 0xf04d1c1
push 0x3d
push dword [ebp - 0x20]
call fcn.0f0570a1
test eax, eax
pop ecx
pop ecx
je 0xf04d1a9
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
add eax, 2
push eax
sar edx, 1
lea eax, [ebp - 0x1c]
shl edx, 1
push eax
mov dword [ebp - 0x10], ecx
mov word [ebp - 0x14], dx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
jl 0xf04d1c1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea eax, [edi + eax + 1]
cmp byte [eax], 0
mov dword [ebp + 8], eax
jne 0xf04d0da
jmp 0xf04d08d
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
jmp 0xf04cfa9