Function at 0x4ed810
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
and dword [esp + 0x90], 0x3000
mov esi, dword [esp + 0x9c]
mov ebx, dword [esp + 0xa0]
mov dword [esp], 0x6961c0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4ed925
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
ja 0x4ed925
mov edx, 2
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x3c], 0xfffffffd
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x90]
mov word [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x48], eax
movzx eax, byte [esi]
movsx eax, al
test eax, eax
je 0x4ed919
nop
add esi, 1
cmp eax, 0x25
jne 0x4ed940
mov edx, dword [esp + 0x90]
xor ecx, ecx
mov dword [esp + 0x38], 0xffffffff
lea ebp, [esp + 0x34]
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], edx
movzx eax, byte [esi]
xor edx, edx
test al, al
je 0x4ed90c
movsx edi, al
sub eax, 0x20
add esi, 1
cmp al, 0x5a
jbe 0x4ed950
cmp edx, 3
jbe 0x4edb50
movzx eax, byte [esi]
mov edi, ebx
mov edx, 4
mov ebx, edi
test al, al
jne 0x4ed8e6
mov ebp, ebx
nop
mov ebx, ebp
movsx eax, al
test eax, eax
jne 0x4ed8b0
mov eax, dword [esp + 0x44]
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004f0828
mov edx, 3
test al, 1
je 0x4ed858
jmp 0x4ed853
lea edx, [esp + 0x2c]
mov ebp, ebx
call fcn.004ec180
movzx eax, byte [esi]
jmp 0x4ed910
movzx eax, al
jmp dword [eax*4 + 0x6961f8]
cmp byte [esi], 0x6c
mov ecx, 2
jne case.0x4ed953.44
add esi, 1
mov ecx, 3
or dword [esp + 0x30], 4
mov edi, ebx
mov edx, 4
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
or dword [esp + 0x30], 0x20
test byte [esp + 0x30], 4
je 0x4edb30
mov edx, dword [ebx]
lea ebp, [ebx + 0xc]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x2c]
mov ebx, dword [ebx + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov ebx, ebp
call fcn.004ed070
movzx eax, byte [esi]
jmp 0x4ed912
or dword [esp + 0x30], 0x20
test byte [esp + 0x30], 4
je 0x4edb10
mov edx, dword [ebx]
lea ebp, [ebx + 0xc]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x2c]
mov ebx, dword [ebx + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov ebx, ebp
call fcn.004eced0
movzx eax, byte [esi]
jmp 0x4ed912
or dword [esp + 0x30], 0x20
test byte [esp + 0x30], 4
je 0x4edaf0
mov edx, dword [ebx]
lea ebp, [ebx + 0xc]
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x2c]
mov ebx, dword [ebx + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov ebx, ebp
call fcn.004ecd50
movzx eax, byte [esi]
jmp 0x4ed912
or dword [esp + 0x30], 0x20
mov ecx, dword [esp + 0x30]
test cl, 4
je 0x4edf00
fld xword [ebx]
lea ebp, [ebx + 0xc]
fld st(0)
fstp xword [esp + 0x60]
fxam
wait
fnstsw ax
and eax, 0x4500
cmp eax, 0x100
je 0x4ee0a9
movzx edx, word [esp + 0x68]
mov ebx, edx
and ebx, 0x8000
jne 0x4edfc5
fxam
wait
fnstsw ax
fstp st(0)
and eax, 0x4500
cmp eax, 0x500
je 0x4ee143
and dx, 0x7fff
test dx, dx
mov word [esp + 0x68], dx
je 0x4ee014
lea eax, [edx - 0x3fff]
mov word [esp + 0x68], ax
lea eax, [esp + 0x2c]
mov ebx, ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
call fcn.004ed2c0
movzx eax, byte [esi]
jmp 0x4ed912
fld qword [ebx]
lea eax, [esp + 0x2c]
lea ebp, [ebx + 8]
fstp xword [esp]
mov ebx, ebp
call fcn.004ecd50
movzx eax, byte [esi]
jmp 0x4ed912
fld qword [ebx]
lea eax, [esp + 0x2c]
lea ebp, [ebx + 8]
fstp xword [esp]
mov ebx, ebp
call fcn.004eced0
movzx eax, byte [esi]
jmp 0x4ed912
fld qword [ebx]
lea eax, [esp + 0x2c]
lea ebp, [ebx + 8]
fstp xword [esp]
mov ebx, ebp
call fcn.004ed070
movzx eax, byte [esi]
jmp 0x4ed912
cmp edi, 0x39
jg 0x4ed8fc
cmp edi, 0x2f
lea esi, [esi]
jle 0x4ed8fc
test edx, edx
jne 0x4ee15d
mov dl, 1
test ebp, ebp
je 0x4edef0
mov eax, dword [ebp]
test eax, eax
js 0x4ee200
lea eax, [eax + eax*4]
lea eax, [edi + eax*2 - 0x30]
mov edi, ebx
mov dword [ebp], eax
mov ebx, edi
movzx eax, byte [esi]
jmp 0x4ed908
cmp byte [esi + 1], 0x34
jne 0x4edde9
add esi, 2
mov edi, ebx
mov edx, 4
movzx eax, byte [esi]
mov ecx, 3
mov ebx, edi
jmp 0x4ed908
test edx, edx
jne 0x4edef0
or dword [esp + 0x30], 0x800
mov edi, ebx
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
test edx, edx
jne 0x4edef0
or dword [esp + 0x30], 0x40
mov edi, ebx
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
or dword [esp + 0x30], 0x80
cmp ecx, 3
je 0x4ee0ca
cmp ecx, 2
je 0x4ee066
mov eax, dword [ebx]
lea ebp, [ebx + 4]
mov edx, eax
sar edx, 0x1f
cmp ecx, 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
je 0x4ee183
cmp ecx, 4
je 0x4ee1b6
nop
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x2c]
mov ebx, ebp
mov edx, dword [esp + 0x74]
call fcn.004ec440
movzx eax, byte [esi]
jmp 0x4ed912
cmp ecx, 4
je 0x4ee0df
cmp ecx, 1
lea esi, [esi]
je 0x4ee093
cmp ecx, 2
je 0x4edc86
cmp ecx, 3
nop
je 0x4ee1cd
mov edx, dword [ebx]
lea ebp, [ebx + 4]
mov eax, dword [esp + 0x44]
mov ebx, ebp
mov dword [edx], eax
movzx eax, byte [esi]
jmp 0x4ed912
cmp byte [esi], 0x68
je 0x4ee109
mov edi, ebx
mov edx, 4
movzx eax, byte [esi]
mov ecx, 1
mov ebx, edi
jmp 0x4ed908
or dword [esp + 0x30], 0x800
xor ecx, ecx
mov edx, dword [ebx]
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ebp, [ebx + 4]
mov eax, 0x78
mov dword [esp + 0x74], ecx
mov ebx, ebp
mov dword [esp + 0x70], edx
call fcn.004ec6b0
movzx eax, byte [esi]
jmp 0x4ed912
test edx, edx
jne 0x4edef0
or dword [esp + 0x30], 0x400
mov edi, ebx
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
test edx, edx
jne 0x4edef0
or dword [esp + 0x30], 0x100
mov edi, ebx
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
test ebp, ebp
je 0x4ed8fc
test edx, edx
sete byte [esp + 0x27]
jne 0x4ee027
mov eax, dword [ebx]
lea edi, [ebx + 4]
test eax, eax
mov dword [ebp], eax
js 0x4ee19a
xor ebp, ebp
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
mov eax, edi
mov ebp, ebx
lea edx, [esp + 0x2c]
mov ebx, ebp
call fcn.004ec180
movzx eax, byte [esi]
jmp 0x4ed912
cmp ecx, 3
je 0x4ee0f4
cmp ecx, 2
je 0x4ee07d
mov eax, dword [ebx]
cmp ecx, 1
lea ebp, [ebx + 4]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], eax
je 0x4ee16d
cmp ecx, 4
je 0x4ee1ea
cmp edi, 0x75
je 0x4edc40
mov edx, dword [esp + 0x70]
lea eax, [esp + 0x2c]
mov ebx, ebp
mov ecx, dword [esp + 0x74]
mov dword [esp], eax
mov eax, edi
call fcn.004ec6b0
movzx eax, byte [esi]
jmp 0x4ed912
movzx eax, byte [esi]
cmp al, 0x36
je 0x4edb99
cmp al, 0x33
je 0x4ee043
mov edi, ebx
mov edx, 4
mov ecx, 2
mov ebx, edi
jmp 0x4ed908
mov dword [esp + 0x38], 0xffffffff
movzx eax, word [ebx]
lea ebp, [ebx + 4]
mov edx, 1
lea ecx, [esp + 0x2c]
mov ebx, ebp
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], eax
lea eax, [esp + 0x70]
call fcn.004ec1d0
movzx eax, byte [esi]
jmp 0x4ed912
test edx, edx
jne case.0x4ed953.1
or dword [esp + 0x30], 0x200
mov edi, ebx
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
cmp edx, 1
ja 0x4ed8fc
mov edi, ebx
mov edx, 2
mov dword [esp + 0x38], 0
lea ebp, [esp + 0x38]
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
lea eax, [ecx - 2]
cmp eax, 1
jbe case.0x4ed953.51
mov edi, dword [ebx]
mov eax, str._null_
mov edx, 6
test edi, edi
je 0x4edea0
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, edi
lea ebp, [ebx + 4]
lea ecx, [esp + 0x2c]
mov ebx, ebp
call fcn.004ec2e0
movzx eax, byte [esi]
jmp 0x4ed912
lea eax, [ecx - 2]
cmp eax, 1
mov dword [esp + 0x38], 0xffffffff
jbe 0x4ede08
mov eax, dword [ebx]
lea ebp, [ebx + 4]
mov edx, 1
lea ecx, [esp + 0x2c]
mov ebx, ebp
mov byte [esp + 0x70], al
lea eax, [esp + 0x70]
call fcn.004ec2e0
movzx eax, byte [esi]
jmp 0x4ed912
mov edi, ebx
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
fld qword [ebx]
lea ebp, [ebx + 8]
fst qword [esp + 0x50]
fxam
wait
fnstsw ax
and eax, 0x4500
cmp eax, 0x100
je 0x4ee0ad
movzx ebx, word [esp + 0x56]
mov edi, ebx
and edi, 0x8000
je 0x4edf34
or cl, 0x80
mov dword [esp + 0x30], ecx
fstp qword [esp]
call fcn.004ec160
cmp eax, 0x500
je 0x4ee21c
mov eax, dword [esp + 0x50]
mov ecx, ebx
mov edx, dword [esp + 0x54]
shr cx, 4
and cx, 0x7ff
mov word [esp + 0x58], cx
shld edx, eax, 8
mov dword [esp + 0x54], edx
shl eax, 8
and word [esp + 0x56], 0xfff
test cx, cx
mov dword [esp + 0x50], eax
jne 0x4ee122
mov eax, dword [esp + 0x54]
or eax, dword [esp + 0x50]
je 0x4edf8f
mov word [esp + 0x58], 0xfc01
lea eax, [esp + 0x2c]
mov ebx, ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
call fcn.004ed2c0
movzx eax, byte [esi]
jmp 0x4ed912
or cl, 0x80
mov dword [esp + 0x30], ecx
jmp 0x4eda85
mov edi, dword [ebx]
test edi, edi
je 0x4ee212
mov dword [esp], edi
lea ebp, [ebx + 4]
call sub.msvcrt.dll_wcslen
lea ecx, [esp + 0x2c]
mov ebx, ebp
mov edx, eax
mov eax, edi
call fcn.004ec1d0
movzx eax, byte [esi]
jmp 0x4ed912
movzx eax, byte [esi]
mov edi, ebx
mov edx, 4
mov ecx, 2
jmp 0x4eddf5
mov eax, dword [esp + 0x64]
or eax, dword [esp + 0x60]
je 0x4edaba
jmp 0x4edaaf
cmp edx, 2
je 0x4edd45
mov edi, ebx
mov edx, 4
movzx eax, byte [esi]
xor ebp, ebp
mov ebx, edi
jmp 0x4ed908
cmp byte [esi + 1], 0x32
jne 0x4edde9
add esi, 2
mov edi, ebx
mov edx, 4
mov ecx, 2
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
mov eax, dword [ebx]
lea ebp, [ebx + 4]
mov edx, eax
sar edx, 0x1f
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
jmp 0x4edc40
mov ecx, dword [ebx]
lea ebp, [ebx + 4]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], ecx
jmp 0x4eddad
mov edx, dword [ebx]
lea ebp, [ebx + 4]
mov eax, dword [esp + 0x44]
mov ebx, ebp
mov word [edx], ax
movzx eax, byte [esi]
jmp 0x4ed912
fstp st(0)
jmp 0x4ee0af
fstp st(0)
xor ax, ax
mov edx, 0x6961ed
lea ecx, [esp + 0x2c]
mov ebx, ebp
call fcn.004ec3a0
movzx eax, byte [esi]
jmp 0x4ed912
mov eax, dword [ebx]
lea ebp, [ebx + 8]
mov edx, dword [ebx + 4]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
jmp 0x4edc40
mov edx, dword [ebx]
lea ebp, [ebx + 4]
mov eax, dword [esp + 0x44]
mov ebx, ebp
mov byte [edx], al
movzx eax, byte [esi]
jmp 0x4ed912
mov eax, dword [ebx]
lea ebp, [ebx + 8]
mov edx, dword [ebx + 4]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
jmp 0x4eddad
add esi, 1
mov edi, ebx
mov edx, 4
mov ecx, 4
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908
lea eax, [ecx - 0x3ff]
cmp ax, 0xff83
mov word [esp + 0x58], ax
jl 0x4edf8f
add word [esp + 0x56], 0x1000
jmp 0x4edf8f
mov eax, ebx
mov edx, 0x6961f1
lea ecx, [esp + 0x2c]
mov ebx, ebp
call fcn.004ec3a0
movzx eax, byte [esi]
jmp 0x4ed912
cmp edx, 2
jne 0x4edb70
mov dl, 3
jmp 0x4edb70
movzx eax, word [esp + 0x70]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], eax
jmp 0x4eddad
movsx eax, word [esp + 0x70]
mov ecx, eax
sar ecx, 0x1f
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
jmp 0x4edc40
cmp byte [esp + 0x27], 0
je 0x4ee236
or dword [esp + 0x30], 0x400
neg dword [esp + 0x34]
jmp 0x4edd55
movsx eax, byte [esp + 0x70]
mov edx, eax
sar edx, 0x1f
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
jmp 0x4edc40
mov eax, dword [esp + 0x44]
lea ebp, [ebx + 4]
mov edx, dword [ebx]
mov ebx, ebp
mov ecx, eax
sar ecx, 0x1f
mov dword [edx], eax
mov dword [edx + 4], ecx
movzx eax, byte [esi]
jmp 0x4ed912
movzx eax, byte [esp + 0x70]
mov dword [esp + 0x74], 0
mov dword [esp + 0x70], eax
jmp 0x4eddad
lea eax, [edi - 0x30]
mov edi, ebx
mov dword [ebp], eax
mov ebx, edi
movzx eax, byte [esi]
jmp 0x4ed908
mov edi, 0x6961d8
jmp 0x4edfdb
mov eax, edi
mov edx, 0x6961f1
lea ecx, [esp + 0x2c]
mov ebx, ebp
call fcn.004ec3a0
movzx eax, byte [esi]
jmp 0x4ed912
mov dword [esp + 0x38], 0xffffffff
xor ebp, ebp
movzx eax, byte [esi]
mov ebx, edi
jmp 0x4ed908