Function at 0x436230
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x436279
lea eax, [ebp + 0xc]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
movzx eax, byte [eax]
test eax, eax
je 0x436269
push 0x89f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x436274
push 0x7cc
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x43682b
mov dword [ebp - 0x20], 0x67e307b5
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x14], 0xffffffff
push 3
lea ecx, [ebp - 0xa4]
call fcn.0041257d
mov dword [ebp - 0xb0], 0xfe831e34
mov dword [ebp - 0x24], 0xeeff
mov dword [ebp - 0x3c], 0x73439d6f
mov dword [ebp - 4], 0
jmp 0x4362c6
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4362d9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 8], 1
jmp 0x4362bf
mov dword [ebp - 4], 0
jmp 0x4362e9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4362fc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10], 0x4dde9ab
jmp 0x4362e2
mov dword [ebp - 4], 0
jmp 0x43630c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x436325
push dword [ebp - 4]
lea ecx, [ebp - 0xa4]
call fcn.0041261e
and dword [eax], 0
jmp 0x436305
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0xc4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xc4]
jl 0x43636d
mov dword [ebp - 0xa8], 1
jmp 0x436374
and dword [ebp - 0xa8], 0
imul eax, dword [ebp - 0xa8], 0xfbe5
cmp eax, 0x9968
jge 0x436391
mov dword [ebp - 0xac], 1
jmp 0x436398
and dword [ebp - 0xac], 0
cmp dword [ebp - 0x20], 0
je 0x4363b4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 8], 0
je 0x4363b4
mov dword [ebp - 0x30], 1
jmp 0x4363b8
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 0xcd9796a
jne 0x4363ca
mov dword [ebp - 0x38], 1
jmp 0x4363ce
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x38]
cmp eax, 0xfffb
ja 0x4363ea
mov dword [ebp - 0x8c], 1
jmp 0x4363f1
and dword [ebp - 0x8c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x8c], eax
jg 0x43640c
mov dword [ebp - 0x40], 1
jmp 0x436410
and dword [ebp - 0x40], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x40]
mov dword [ebp + eax - 8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x14], eax
jg 0x436435
mov dword [ebp - 0x74], 1
jmp 0x436439
and dword [ebp - 0x74], 0
push 0
lea ecx, [ebp - 0xa4]
call fcn.0041261e
mov eax, dword [eax]
add eax, dword [ebp - 0x74]
cmp eax, 0x4356e3f0
jle 0x43645b
mov dword [ebp - 0x48], 1
jmp 0x43645f
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x48]
jle 0x436473
mov dword [ebp - 0xc0], 1
jmp 0x43647a
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0x14], 1
jl 0x436489
mov dword [ebp - 0x78], 1
jmp 0x43648d
and dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0xbfb41ce0
jbe 0x43649f
mov dword [ebp - 0x50], 1
jmp 0x4364a3
and dword [ebp - 0x50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0x50]
jle 0x4364bb
mov dword [ebp - 0x80], 1
jmp 0x4364bf
and dword [ebp - 0x80], 0
cmp dword [ebp - 0x80], 0xf7d6
je 0x4364d1
mov dword [ebp - 0x58], 1
jmp 0x4364d5
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x58], eax
jne 0x4364e9
mov dword [ebp - 0x88], 1
jmp 0x4364f0
and dword [ebp - 0x88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x88], eax
jne 0x43651a
push 0
lea ecx, [ebp - 0xa4]
call fcn.0041261e
cmp dword [eax], 0
jne 0x43651a
and dword [ebp - 0x60], 0
jmp 0x436521
mov dword [ebp - 0x60], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x60], eax
jle 0x43653c
mov dword [ebp - 0xc8], 1
jmp 0x436543
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe4], eax
push 0
lea ecx, [ebp - 0xa4]
call fcn.0041261e
cmp dword [ebp - 0xb0], 0
je 0x4366ea
mov dword [ebp - 0x98], 0x33e235bd
mov dword [ebp - 0x84], 0xf9d9
mov dword [ebp - 0x34], 0x714a8a5a
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xe8], 4
mov esi, dword [ebp - 0x98]
push 0
lea ecx, [ebp - 0xa4]
call fcn.0041261e
cmp esi, dword [eax]
jge 0x4365b8
mov dword [ebp - 0x90], 1
jmp 0x4365bf
and dword [ebp - 0x90], 0
cmp dword [ebp - 0x90], 0x211a
je 0x4365d4
mov dword [ebp - 0x68], 1
jmp 0x4365d8
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x68]
jne 0x4365e9
mov dword [ebp - 0x70], 1
jmp 0x4365ed
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x70], eax
jne 0x436601
mov dword [ebp - 0x28], 1
jmp 0x436605
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0
jae 0x436617
mov dword [ebp - 0xd0], 1
jmp 0x43661e
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov dword [ebp - 0xec], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0xb0], eax
jg 0x43664c
mov dword [ebp - 0xcc], 1
jmp 0x436653
and dword [ebp - 0xcc], 0
push 0
lea ecx, [ebp - 0xa4]
call fcn.0041261e
imul esi, dword [ebp - 0x84], 0
push 0
lea ecx, [ebp - 0xa4]
call fcn.0041261e
cmp esi, dword [eax]
jg 0x43668a
mov eax, 0xf0cd
test eax, eax
je 0x43668a
mov dword [ebp - 0x7c], 1
jmp 0x43668e
and dword [ebp - 0x7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp eax, dword [ebp - 0x7c]
jge 0x4366a9
mov dword [ebp - 0x94], 1
jmp 0x4366b0
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0
je 0x4366cb
cmp dword [ebp - 0x84], 0
je 0x4366cb
mov dword [ebp - 0x2c], 1
jmp 0x4366cf
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
jmp 0x436818
mov dword [ebp - 0x1c], 0x7bd5
mov dword [ebp - 0xc], 0
push 2
lea ecx, [ebp - 0xe0]
call fcn.0041257d
mov dword [ebp - 0x18], 0
jmp 0x436715
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x436731
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe0]
call fcn.0041261e
mov dword [eax], 0xfffffffa
jmp 0x43670e
cmp dword [ebp - 0x1c], 0
je 0x436746
cmp dword [ebp - 0x1c], 0
je 0x436746
mov dword [ebp - 0x54], 1
jmp 0x43674a
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xbc], eax
jne 0x43675e
mov dword [ebp - 0x44], 1
jmp 0x436762
and dword [ebp - 0x44], 0
cmp dword [ebp - 0x44], 0xfffffff9
jl 0x436771
mov dword [ebp - 0x4c], 1
jmp 0x436775
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4c], eax
je 0x436786
mov dword [ebp - 0x64], 1
jmp 0x43678a
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x5c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5c]
mov dword [ebp + eax - 8], ecx
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x64]
jge 0x4367b4
mov dword [ebp - 0x6c], 1
jmp 0x4367b8
and dword [ebp - 0x6c], 0
push 1
lea ecx, [ebp - 0xe0]
call fcn.0041261e
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0x24], 0
jmp 0x4367da
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 5
jle 0x43680d
mov dword [ebp - 0xc], 0
jmp 0x4367f0
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x43680b
push 1
lea ecx, [ebp - 0xe0]
call fcn.0041261e
mov dword [eax], 0x1f29c70a
jmp 0x4367e9
jmp 0x4367d3
lea ecx, [ebp - 0xe0]
call fcn.00412619
lea ecx, [ebp - 0xa4]
call fcn.00412619
push 0
call fcn.0043740c
pop ecx
pop esi
mov esp, ebp
pop ebp
ret