Function at 0x4281ec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x58]
sub esp, 0x6c
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e82b8]
test al, al
jne 0x428249
mov dword [esp], 0x4e82b8
call fcn.004d5a00
test eax, eax
je 0x428249
mov dword [esp], ebx
mov ecx, 0x4ecda0
call fcn.0043167c
push edx
mov dword [esp], 0x4d67c8
call fcn.004013f0
mov dword [esp], 0x4e82b8
call fcn.004d5ad0
mov ecx, 0x4ecda0
call fcn.0043164c
mov dword [esp], 0x4ecda0
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e8270]
test al, al
jne 0x4282b0
mov dword [esp], 0x4e8270
call fcn.004d5a00
test eax, eax
je 0x4282b0
mov dword [esp], ebx
mov ecx, 0x4eccec
call fcn.0043167c
push eax
mov dword [esp], 0x4d67cc
call fcn.004013f0
mov dword [esp], 0x4e8270
call fcn.004d5ad0
mov ecx, 0x4eccec
call fcn.0043164c
mov dword [esp], 0x4eccec
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e8280]
test al, al
jne 0x428317
mov dword [esp], 0x4e8280
call fcn.004d5a00
test eax, eax
je 0x428317
mov dword [esp], ebx
mov ecx, 0x4ecd04
call fcn.0043167c
push eax
mov dword [esp], 0x4d67d0
call fcn.004013f0
mov dword [esp], 0x4e8280
call fcn.004d5ad0
mov ecx, 0x4ecd04
call fcn.0043164c
mov dword [esp], 0x4ecd04
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e8288]
test al, al
jne 0x42837e
mov dword [esp], 0x4e8288
call fcn.004d5a00
test eax, eax
je 0x42837e
mov dword [esp], ebx
mov ecx, 0x4ecd10
call fcn.0043167c
push eax
mov dword [esp], 0x4d67d4
call fcn.004013f0
mov dword [esp], 0x4e8288
call fcn.004d5ad0
mov ecx, 0x4ecd10
call fcn.0043164c
mov dword [esp], 0x4ecd10
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e8290]
test al, al
jne 0x4283e5
mov dword [esp], 0x4e8290
call fcn.004d5a00
test eax, eax
je 0x4283e5
mov dword [esp], ebx
mov ecx, 0x4ecd1c
call fcn.0043167c
push eax
mov dword [esp], 0x4d67d8
call fcn.004013f0
mov dword [esp], 0x4e8290
call fcn.004d5ad0
mov ecx, 0x4ecd1c
call fcn.0043164c
mov dword [esp], 0x4ecd1c
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e8298]
test al, al
jne 0x42844c
mov dword [esp], 0x4e8298
call fcn.004d5a00
test eax, eax
je 0x42844c
mov dword [esp], ebx
mov ecx, 0x4ecd28
call fcn.0043167c
push eax
mov dword [esp], 0x4d67dc
call fcn.004013f0
mov dword [esp], 0x4e8298
call fcn.004d5ad0
mov ecx, 0x4ecd28
call fcn.0043164c
mov dword [esp], 0x4ecd28
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e82a0]
test al, al
jne 0x4284b3
mov dword [esp], 0x4e82a0
call fcn.004d5a00
test eax, eax
je 0x4284b3
mov dword [esp], ebx
mov ecx, 0x4ecd34
call fcn.0043167c
push edi
mov dword [esp], 0x4d67e0
call fcn.004013f0
mov dword [esp], 0x4e82a0
call fcn.004d5ad0
mov ecx, 0x4ecd34
call fcn.0043164c
mov dword [esp], 0x4ecd34
call fcn.00424ea0
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e82a8]
test al, al
jne 0x42851a
mov dword [esp], 0x4e82a8
call fcn.004d5a00
test eax, eax
je 0x42851a
mov dword [esp], ebx
mov ecx, 0x4ecd40
call fcn.0043167c
push esi
mov dword [esp], 0x4d67e4
call fcn.004013f0
mov dword [esp], 0x4e82a8
call fcn.004d5ad0
mov ecx, 0x4ecd40
mov esi, 0x4e7100
mov edi, ebx
call fcn.0043164c
mov dword [esp], 0x4ecd40
call fcn.00424ea0
mov ecx, 0x3f
mov dword [ebp - 0x5c], 0x71f0f67a
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e82b0]
test al, al
jne 0x428584
mov dword [esp], 0x4e82b0
call fcn.004d5a00
test eax, eax
je 0x428584
mov dword [esp], ebx
mov ecx, 0x4ecd60
call fcn.00431614
push ecx
mov dword [esp], 0x4d67f0
call fcn.004013f0
mov dword [esp], 0x4e82b0
call fcn.004d5ad0
mov ecx, 0x4ecd60
call fcn.004315e4
mov dword [esp], 0x4ecd60
call sub.msvcrt.dll_getenv
test eax, eax
je 0x42860a
lea eax, [ebp - 0x5c]
call eax
mov dword [ebp - 0x58], 0xc1eb1542
mov dword [ebp - 0x54], 0x7c90ec48
mov byte [ebp - 0x50], 0x42
mov al, byte [0x4e8278]
test al, al
jne 0x4285f4
mov dword [esp], 0x4e8278
call fcn.004d5a00
test eax, eax
je 0x4285f4
mov dword [esp], ebx
mov ecx, 0x4eccf8
call fcn.0043167c
push edx
mov dword [esp], 0x4d67fc
call fcn.004013f0
mov dword [esp], 0x4e8278
call fcn.004d5ad0
mov ecx, 0x4eccf8
call fcn.0043164c
mov dword [esp], 0x4eccf8
call fcn.00424ea0
xor eax, eax
mov dword [ebp - 0x58], eax
lea eax, [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x8000
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret