Function at 0x41778c
Capabilities:
Query environment variable

Disassembly:
push ebx
mov edx, 0xb
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x417792
call fcn.00489ac0
push dword [esp + 0x3c]
call fcn.004446d0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00444000
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 0x1f4
call fcn.00486f00
lea eax, [esp + 8]
push eax
call fcn.004899c0
push 0x1f4
mov eax, dword [esp + 8]
push eax
mov eax, 0x571726
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x41784c
push edx
call fcn.00489920
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, 0x56d8f4
push edx
call fcn.00489960
call fcn.00489a50
push dword [esp + 0xc]
mov eax, 0x576602
push eax
call fcn.004446b2
add dword [esp + 8], edx
call fcn.0046106e
call fcn.004446d0
mov dword [esp + 8], eax
jmp 0x4178c3
push edx
call fcn.00489920
pop edx
push eax
push 0x2e
mov edx, dword [esp + 0xc]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, 0x56d8f4
push edx
call fcn.00489960
call fcn.00489a50
mov edx, dword [esp + 0xc]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, 0x56ab60
push edx
call fcn.00489960
call fcn.00489a50
mov eax, 0x576602
push eax
call fcn.004446b2
add dword [esp + 4], edx
call fcn.004446b2
add dword [esp + 8], edx
call fcn.0046106e
call fcn.004446d0
mov dword [esp + 8], eax
mov edx, 0x560098
lea ecx, [esp + 0xc]
call fcn.00444008
cmp dword [esp + 8], 0
je 0x417bc9
push 0x9c40
call fcn.00488740
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.004615d3
and eax, eax
je 0x417b9d
push dword [esp + 8]
call fcn.0046161a
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x417b68
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.00461703
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0
je 0x417b68
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 0x18
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00488940
lea eax, [esp + 0x1c]
push eax
call fcn.004899c0
push dword [esp + 0x18]
call fcn.004874d0
mov ebx, eax
add ebx, 4
push ebx
call fcn.00488740
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.004874d0
mov ebx, eax
add ebx, 4
push ebx
call fcn.00488740
mov dword [esp + 0x20], eax
push 0x18
push 0xffffffff
push dword [esp + 0x20]
push dword [esp + 0x28]
call fcn.00488780
push dword [esp + 0x20]
push dword [esp + 0x20]
call sub.USER32.dll_OemToCharW
mov dword [esp + 0x24], 0
jmp 0x4179bd
push dword [esp + 0x18]
call fcn.004874d0
mov ebx, eax
add ebx, 4
cmp ebx, dword [esp + 0x24]
jl 0x417b02
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004888d0
mov ebx, eax
cmp ebx, 0x6a
jne 0x417a07
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004888d0
mov ebx, eax
cmp ebx, 0x26
jne 0x417a07
mov eax, 1
jmp 0x417a09
xor eax, eax
and eax, eax
je 0x417a34
push 0xd
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004888e0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004888e0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004888d0
mov ebx, eax
cmp ebx, 0xd9
jne 0x417a69
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004888d0
mov ebx, eax
cmp ebx, 0x25
jne 0x417a69
mov eax, 1
jmp 0x417a6b
xor eax, eax
and eax, eax
je 0x417a96
push 0xa
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004888e0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004888e0
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
push ebx
call fcn.004888d0
mov ebx, eax
cmp ebx, 0xcb
jne 0x417acb
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
inc ebx
push ebx
call fcn.004888d0
mov ebx, eax
cmp ebx, 0x25
jne 0x417acb
mov eax, 1
jmp 0x417acd
xor eax, eax
and eax, eax
je 0x417af8
push 9
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
push ebx
call fcn.004888e0
push 0
mov ebx, dword [esp + 0x24]
add ebx, dword [esp + 0x28]
inc ebx
push ebx
call fcn.004888e0
inc dword [esp + 0x24]
jno 0x4179bd
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push dword [esp + 0x28]
call fcn.004888f0
lea eax, [esp + 0x1c]
push eax
call fcn.004899c0
push dword [esp + 0x1c]
call fcn.00488760
push dword [esp + 0x20]
call fcn.00488760
mov edx, dword [esp + 0xc]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, dword [esp + 0x1c]
push edx
call fcn.00489960
mov edx, 0x5775b4
push edx
call fcn.00489960
lea eax, [esp + 0x10]
push eax
call fcn.004899c0
push dword [0x1c53098]
call fcn.0046dd15
and eax, eax
je 0x417b98
call fcn.0046e228
and eax, eax
je 0x417b82
jmp 0x417b77
call fcn.0046e228
and eax, eax
je 0x417b8d
jmp 0x417b82
call fcn.0046e228
and eax, eax
je 0x417b98
jmp 0x417b8d
jmp 0x4178ea
push dword [esp + 0x10]
call fcn.00488760
push dword [esp + 8]
call fcn.0046175d
and eax, eax
je 0x417bc9
push dword [esp + 8]
call fcn.0046168d
mov dword [esp + 0x28], eax
push dword [esp + 8]
call fcn.004616ad
mov ebx, dword [esp + 0x38]
and ebx, ebx
jle 0x417c01
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov eax, dword [esp + 0x30]
cdq
push edx
push eax
call fcn.004872f0
pop eax
push eax
call fcn.004446a0
pop edx
add eax, edx
jmp 0x417cf6
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov eax, 0x56058e
push eax
push dword [esp + 0x18]
call fcn.00487ac0
lea eax, [esp + 0x10]
push eax
call fcn.004899c0
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov eax, 0x5604e4
push eax
mov eax, 0x571e86
push eax
push dword [esp + 0x1c]
call fcn.00487e20
lea eax, [esp + 0x10]
push eax
call fcn.004899c0
mov eax, 0x571e86
push eax
push dword [esp + 0x10]
call fcn.004871f0
mov ebx, eax
and ebx, ebx
jne 0x417c2a
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 1
push dword [esp + 0x18]
call fcn.00487830
call fcn.00489a50
mov edx, 0x5604e4
pop ecx
push ecx
call fcn.004446e0
mov ecx, eax
call fcn.00444660
je 0x417cce
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.004872a0
lea eax, [esp + 0x10]
push eax
call fcn.004899c0
mov edx, dword [esp + 0xc]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
pop eax
push eax
call fcn.004446a0
pop edx
add eax, edx
jmp 0x417cf6
push dword [esp + 0xc]
call fcn.00489b20
push dword [esp]
call fcn.00489b20
push dword [esp + 4]
call fcn.00489b20
push dword [esp + 0x18]
call fcn.00489b20
add esp, 0x2c
pop ebx
ret 8