Function at 0x4396d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x254
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4b5040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x60
call fcn.0045e423
add esp, 4
lea ecx, [eax + 0x38]
mov dword [eax + 4], ecx
mov dword [eax], 0x4a2948
xorps xmm0, xmm0
movups xmmword [eax + 0x38], xmm0
movups xmmword [eax + 8], xmm0
movups xmmword [eax + 0x18], xmm0
movups xmmword [eax + 0x28], xmm0
movups xmmword [eax + 0x48], xmm0
xorps xmm0, xmm0
movsd qword [eax + 0x58], xmm0
mov dword [eax + 0x38], 0x28
mov dword [eax + 0x3c], 0x4a751c
mov dword [esi], eax
mov dword [ebp - 0x25c], edi
movzx ecx, byte [edi + 0xb]
mov edx, ecx
test cl, cl
jns 0x439747
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 4]
cmp edx, 0x12
mov dword [ebp - 0x250], eax
jbe 0x4397ef
mov esi, dword [ebp + 0xc]
test cl, cl
jns 0x439762
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
lea eax, [esi - 0x1a]
mov dword [ebp - 0x258], eax
lea eax, [edx*2 - 0x16]
mov dword [ebp - 0x260], eax
add edx, edx
mov eax, 0x18
sub eax, esi
mov dword [ebp - 0x254], eax
mov ebx, esi
neg ebx
lea edi, [esi - 0x18]
mov dword [ebp - 0x24c], edx
jmp 0x4397cc
mov edx, dword [edx]
test eax, eax
je 0x439c16
add dword [ebp - 0x258], 0xfffffffe
mov eax, dword [ebp - 0x260]
add eax, esi
add eax, 0xfffffffe
add esi, 0xfffffffe
add dword [ebp - 0x254], 2
add ebx, 2
add edi, 0xfffffffe
cmp eax, edx
mov edx, dword [ebp - 0x24c]
je 0x4397ec
lea eax, [edi + edx]
push 0xc
push str.Application
push eax
call fcn.00460229
add esp, 0xc
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 0xb]
test cl, cl
jns 0x439798
jmp 0x439796
xorps xmm0, xmm0
movsd qword [ebp - 0x218], xmm0
mov dword [ebp - 0x210], 0
cmp byte [ebp - 0x20d], 0
mov edi, dword [ebp - 0x250]
js 0x439818
lea eax, [ebp - 0x218]
jmp 0x43981e
mov eax, dword [ebp - 0x218]
push 0x4ad44a
push eax
call fcn.00471984
add esp, 8
cmp byte [ebp - 0x20d], 0
jns 0x439843
push dword [ebp - 0x218]
call fcn.0045e41e
add esp, 4
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.004628e0
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push 0x104
push esi
push str.PROGRAMFILES
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
dec eax
cmp eax, 0x102
ja 0x4398b0
cmp word [ebp + ebx*2 - 0x21a], 0x5c
je 0x439bf2
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0xb], 0
jns 0x43989d
mov eax, dword [eax]
push ebx
push esi
push eax
call fcn.00460229
add esp, 0xc
test eax, eax
je 0x439d2d
mov word [ebp - 0x218], 0
push 0x104
push esi
push 0x4ad418
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
dec eax
cmp eax, 0x102
ja 0x439901
cmp word [ebp + ebx*2 - 0x21a], 0x5c
je 0x439bfe
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0xb], 0
jns 0x4398ee
mov eax, dword [eax]
push ebx
push esi
push eax
call fcn.00460229
add esp, 0xc
test eax, eax
je 0x439d78
mov word [ebp - 0x218], 0
push 0x104
push esi
push str.PROGRAMW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
dec eax
cmp eax, 0x102
ja 0x439952
cmp word [ebp + ebx*2 - 0x21a], 0x5c
je 0x439c0a
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0xb], 0
jns 0x43993f
mov eax, dword [eax]
push ebx
push esi
push eax
call fcn.00460229
add esp, 0xc
test eax, eax
je 0x439dbb
xor eax, eax
mov dword [edi + 0x40], 0x4a7d90
mov dword [ebp - 0x24c], eax
mov byte [edi + 0x5c], al
xor eax, eax
dec eax
lea esi, [ebp - 0x224]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push 0x4ad44a
push esi
call fcn.0043d430
add esp, 8
xor eax, eax
mov dword [ebp - 0x228], eax
xorps xmm0, xmm0
movsd qword [ebp - 0x230], xmm0
cmp byte [esi + 0xb], 0
jns 0x4399a2
mov esi, dword [ebp - 0x224]
mov edi, dword [ebp - 0x250]
lea ebx, [edi + 8]
movzx eax, byte [ebp - 0x24c]
mov ecx, 2
sub ecx, eax
lea eax, [ebp - 0x230]
push eax
push str.channel
push esi
push 0x200
push ecx
call fcn.00415e10
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x234], eax
xorps xmm0, xmm0
movsd qword [ebp - 0x23c], xmm0
mov dword [ebp - 0x240], eax
movsd qword [ebp - 0x248], xmm0
xor eax, eax
dec eax
mov dword [ebp - 0x208], eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x218], xmm0
mov byte [ebp - 0x208], 0
cmp byte [edi + 0x13], 0
js 0x439b8f
xorps xmm0, xmm0
movsd qword [ebx], xmm0
mov dword [ebx + 8], 0
mov esi, dword [ebp + 8]
movzx eax, byte [edi + 0x13]
test al, al
jns 0x439a38
mov ebx, dword [edi + 8]
mov eax, dword [edi + 0xc]
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], eax
mov eax, dword [ebp - 0x20c]
mov dword [edi + 0x4c], eax
cmp eax, 1
jne 0x439a86
lea ebx, [edi + 0x14]
cmp byte [edi + 0x1f], 0
movzx eax, byte [ebp - 0x225]
js 0x439bce
test al, al
jns 0x439b75
mov ecx, ebx
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
call fcn.004099b0
cmp byte [edi + 0x1f], 0
jns 0x439a83
mov ebx, dword [ebx]
mov dword [edi + 0x50], ebx
mov al, byte [ebp - 0x208]
mov byte [edi + 0x5d], al
lea ebx, [edi + 0x20]
cmp byte [edi + 0x2b], 0
js 0x439ba4
mov eax, dword [ebp - 0x234]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x23c]
movsd qword [ebx], xmm0
cmp byte [edi + 0x2b], 0
jns 0x439ab9
mov ebx, dword [ebx]
mov dword [edi + 0x54], ebx
mov ebx, edi
add ebx, 0x2c
cmp byte [edi + 0x37], 0
js 0x439bb9
mov eax, dword [ebp - 0x240]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x248]
movsd qword [ebx], xmm0
cmp byte [edi + 0x37], 0
jns 0x439ae8
mov ebx, dword [ebx]
mov dword [edi + 0x58], ebx
cmp byte [ebp - 0x20d], 0
jns 0x439b02
push dword [ebp - 0x218]
call fcn.0045e41e
add esp, 4
cmp byte [ebp - 0x23d], 0
jns 0x439b19
push dword [ebp - 0x248]
call fcn.0045e41e
add esp, 4
cmp byte [ebp - 0x231], 0
jns 0x439b30
push dword [ebp - 0x23c]
call fcn.0045e41e
add esp, 4
cmp byte [ebp - 0x225], 0
jns 0x439b47
push dword [ebp - 0x230]
call fcn.0045e41e
add esp, 4
cmp byte [ebp - 0x219], 0
jns 0x439b5e
push dword [ebp - 0x224]
call fcn.0045e41e
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461246
mov eax, esi
add esp, 0x254
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x228]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x230]
movsd qword [ebx], xmm0
jmp 0x439a7b
mov ecx, ebx
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00409a50
jmp 0x439a27
lea eax, [ebp - 0x23c]
mov ecx, ebx
push 0
push eax
call fcn.00409a50
jmp 0x439ab1
lea eax, [ebp - 0x248]
mov ecx, ebx
push 0
push eax
call fcn.00409a50
jmp 0x439ae0
test al, al
cmovs eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x230]
cmovs edx, dword [ebp - 0x230]
mov ecx, ebx
push eax
push edx
call fcn.00409a50
jmp 0x439a7b
dec ebx
jne 0x439883
jmp 0x4398b0
dec ebx
jne 0x4398d4
jmp 0x439901
dec ebx
jne 0x439925
jmp 0x439952
mov eax, dword [ebp - 0x24c]
add eax, esi
add eax, 0xffffffea
cmp eax, edx
je 0x4397ec
mov edi, edx
test cl, cl
jns 0x439c35
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
lea eax, [edi + ecx*2]
mov edx, dword [ebp - 0x24c]
mov ecx, edx
sub ecx, eax
add dword [ebp - 0x258], edx
cmp ecx, ebx
je 0x439c5d
mov eax, dword [ebp - 0x24c]
cmp word [esi + eax], 0x5c
jne 0x4397ec
mov eax, dword [ebp - 0x258]
add eax, 2
cmp eax, edi
je 0x439c84
mov ecx, dword [ebp - 0x258]
lea eax, [ecx - 2]
cmp word [ecx], 0x5c
mov dword [ebp - 0x258], eax
jne 0x439c5d
add eax, 4
mov edi, eax
push 7
push 0x4a7d80
push edi
call fcn.00460229
add esp, 0xc
test eax, eax
jne 0x4397ec
mov eax, dword [ebp - 0x24c]
sub eax, edi
sub eax, dword [ebp - 0x254]
sar eax, 1
mov ecx, eax
mov dword [ebp - 0x24c], eax
lea ebx, [eax - 7]
cmp ebx, 0x7ffffff8
jae 0x439e01
cmp ebx, 5
jb 0x439e14
mov esi, ebx
or esi, 3
lea eax, [esi*2 + 2]
inc esi
push eax
call fcn.0045e423
add esp, 4
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x218], eax
or esi, 0x80000000
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x214], ebx
add edi, 0xe
add ebx, ebx
push ebx
push edi
push dword [ebp - 0x254]
call fcn.00462360
add esp, 0xc
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x254]
mov word [ecx + eax*2 - 0xe], 0
jmp 0x439801
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0xb]
mov ecx, eax
test al, al
jns 0x439d40
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
cmp ecx, ebx
je 0x439e07
jb 0x439e04
mov ecx, dword [ebp + 0xc]
test al, al
jns 0x439d5a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp word [ecx + ebx*2], 0x5c
mov edi, dword [ebp - 0x250]
lea esi, [ebp - 0x218]
mov al, 1
jne 0x4398b0
jmp 0x439954
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0xb]
mov ecx, eax
test al, al
jns 0x439d8b
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
cmp ecx, ebx
je 0x439e07
jb 0x439e04
mov ecx, dword [ebp + 0xc]
test al, al
jns 0x439d9d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp word [ecx + ebx*2], 0x5c
mov edi, dword [ebp - 0x250]
lea esi, [ebp - 0x218]
mov al, 1
jne 0x439901
jmp 0x439954
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0xb]
mov ecx, eax
test al, al
jns 0x439dce
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
cmp ecx, ebx
je 0x439e07
jb 0x439e04
test al, al
jns 0x439de3
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
cmp word [eax + ebx*2], 0x5c
mov edi, dword [ebp - 0x250]
mov al, 1
jne 0x439952
jmp 0x439954
int3
int3
mov edi, dword [ebp - 0x250]
mov al, 1
jmp 0x439954
lea eax, [ebp - 0x218]
mov dword [ebp - 0x254], eax
mov byte [eax + 0xb], bl
test ebx, ebx
jne 0x439d00
jmp 0x439d15