Function at 0x4a6650
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 2
mov dword [ebp + 8], esi
mov edx, dword [esi]
je 0x4a673a
test edx, edx
je 0x4a66bd
mov al, byte [edx]
lea esi, [esi + 4]
mov ebx, edx
nop dword [eax]
cmp al, 0x20
jle 0x4a6695
inc edx
lea ecx, [edi + 1]
cmp al, 0x22
cmovne ecx, edi
mov al, byte [edx]
mov edi, ecx
cmp al, 0x20
jg 0x4a6684
test al, al
je 0x4a66b2
mov al, byte [edx + 1]
inc edx
add edi, 2
cmp al, 0x20
jg 0x4a6684
test al, al
je 0x4a66b2
mov al, byte [edx + 1]
inc edx
cmp al, 0x20
jle 0x4a66a4
jmp 0x4a6680
sub edx, ebx
inc edx
add edi, edx
mov edx, dword [esi]
test edx, edx
jne 0x4a6672
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
call fcn.004538c0
mov edi, dword [ebp + 8]
mov esi, eax
add esp, 4
mov ebx, esi
mov dword [ebp + 0x10], ebx
mov edx, dword [edi]
test edx, edx
je 0x4a67e4
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 0x10], esi
mov ecx, esi
mov al, byte [edx]
mov byte [ecx], al
test al, al
je 0x4a6725
nop
mov al, byte [edx]
lea edx, [edx + 1]
cmp al, 0x20
jle 0x4a6704
mov al, byte [edx]
inc ecx
mov byte [ecx], al
test al, al
jne 0x4a66f0
jmp 0x4a6725
mov byte [esi], 0x22
lea ecx, [esi + 1]
mov edx, dword [edi]
mov al, byte [edx]
mov byte [ecx], al
test al, al
je 0x4a6721
sub edx, ecx
mov al, byte [edx + ecx + 1]
inc ecx
mov byte [ecx], al
test al, al
jne 0x4a6716
mov byte [ecx], 0x22
inc ecx
mov edx, dword [edi + 4]
lea esi, [ecx + 1]
add edi, 4
test edx, edx
je 0x4a6816
mov byte [ecx], bl
jmp 0x4a66e5
test edx, edx
je 0x4a6758
nop
lea esi, [esi + 4]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4a6746
sub edx, ecx
inc edx
add edi, edx
mov edx, dword [esi]
test edx, edx
jne 0x4a6740
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ecx, eax
mov edx, eax
mov dword [ebp - 4], ecx
cmp byte [ecx], 0
je 0x4a678a
nop dword [eax]
inc ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a6771
cmp byte [edx], 0x3d
jne 0x4a6783
mov eax, ecx
sub eax, edx
add edi, eax
cmp byte [ecx], 0
mov edx, ecx
jne 0x4a6770
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
call fcn.004538c0
add esp, 4
mov dword [ebp + 0x10], eax
cmp edi, ebx
mov esi, eax
mov ebx, dword [ebp - 4]
jle 0x4a67d3
cmp byte [ebx], 0
mov ecx, ebx
mov edx, ebx
je 0x4a67d3
nop dword [eax]
inc ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a67b1
cmp byte [edx], 0x3d
jne 0x4a67ca
sub edx, esi
nop
mov al, byte [edx + esi]
mov byte [esi], al
inc esi
test al, al
jne 0x4a67c0
cmp byte [ecx], 0
mov edx, ecx
jne 0x4a67b0
jmp 0x4a67d7
test ebx, ebx
je 0x4a67de
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x4a6819
mov ebx, dword [ebp + 0xc]
nop dword [eax]
mov al, byte [ecx]
lea edi, [edi + 4]
mov byte [esi], al
test al, al
je 0x4a680d
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
inc esi
mov byte [esi], al
test al, al
jne 0x4a6800
mov byte [esi], bl
inc esi
mov ecx, dword [edi]
test ecx, ecx
jne 0x4a67f0
mov ebx, dword [ebp + 0x10]
mov word [esi], 0
mov eax, ebx
cmp esi, ebx
jbe 0x4a6828
mov byte [esi - 1], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret