Function at 0x4929b0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x3044]
mov eax, 0x3044
call fcn.00530230
push 0xffffffffffffffff
push 0x5513fd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp + 0x3040], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x3050]
mov eax, dword [ebp + 0x304c]
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov word [ebp + 0x2040], cx
test eax, eax
je 0x492a3a
cmp byte [ebp + 0x3054], cl
je 0x492a28
push ecx
push 1
push 0x800
lea ecx, [ebp + 0x2040]
push ecx
push eax
call fcn.004a2690
jmp 0x492a3a
push 0x800
push eax
lea eax, [ebp + 0x2040]
push eax
call fcn.004bdae0
lea ecx, [ebp]
call fcn.0048f110
mov dword [ebp - 4], 0
cmp word [ebp + 0x2040], 0
je 0x492aa0
mov bl, byte [ebp + 0x3058]
lea eax, [ebp + 0x2040]
lea ecx, [ebp]
test bl, bl
je 0x492a6e
push eax
call fcn.004903c0
jmp 0x492a76
push 0
push eax
call fcn.0048f900
test al, al
jne 0x492aa7
test bl, bl
je 0x492a8a
push 6
mov ecx, 0x5d381c
call fcn.00487c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0048f160
xor al, al
jmp 0x493023
mov dword [ebp + 0x10], 1
xor esi, esi
xor eax, eax
push 0x1000
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0x1000
call fcn.0053869a
mov ebx, eax
add esp, 8
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x492adf
mov ecx, 0x5d381c
call fcn.00487da0
mov eax, 0x1000
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
lea ecx, [ebp]
push eax
push ebx
call fcn.0048fd40
test eax, eax
je 0x492baa
push eax
lea ecx, [ebp - 0x30]
add esi, eax
call fcn.004082f0
mov eax, dword [ebp - 0x30]
lea ecx, [ebp]
mov dword [ebp - 0x10], eax
add eax, esi
push 0x1000
push eax
call fcn.0048fd40
test eax, eax
jne 0x492b03
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
cmp esi, ebx
jbe 0x492baa
mov eax, dword [ebp - 0x2c]
mov edi, esi
sub edi, eax
add edi, eax
mov dword [ebp - 0x2c], edi
cmp edi, ebx
jbe 0x492baf
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x492b6a
cmp edi, eax
jbe 0x492b6a
push eax
push str.Maximum_allowed_array_size___u__is_exceeded
push 0x5d381c
call fcn.00487c80
add esp, 0xc
mov ecx, 0x5d381c
call fcn.00487da0
mov eax, ebx
add ebx, 0x20
shr eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
cmp edi, ebx
jbe 0x492b80
mov ebx, edi
mov dword [ebp - 0x20], ebx
push ebx
push dword [ebp - 0x10]
call fcn.0053869a
mov ecx, eax
add esp, 8
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x492ba2
mov ecx, 0x5d381c
call fcn.00487da0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ebx
jmp 0x492bb2
mov edi, esi
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp - 0x10]
cmp esi, 2
jb 0x492c2d
cmp byte [ecx], 0xff
jne 0x492c2d
cmp byte [ecx + 1], 0xfe
jne 0x492c2d
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x34], 0
cmp esi, 3
jb 0x492bea
cmp byte [ecx], 0xef
jne 0x492bea
cmp byte [ecx + 1], 0xbb
jne 0x492bea
cmp byte [ecx + 2], 0xbf
mov byte [ebp - 0x11], 1
je 0x492bee
mov byte [ebp - 0x11], 0
mov ebx, dword [ebp + 0x305c]
test ebx, ebx
jne 0x492cc7
cmp esi, 3
jbe 0x492c69
cmp byte [ecx], 0xef
jne 0x492c85
cmp byte [ecx + 1], 0xbb
jne 0x492c85
cmp byte [ecx + 2], 0xbf
jne 0x492c85
lea eax, [esi - 3]
push eax
lea eax, [ecx + 3]
push eax
call fcn.004c1530
test al, al
je 0x492c82
mov ebx, 4
jmp 0x492cc7
mov dword [ebp - 0x18], 0
cmp esi, 2
jb 0x492bc9
cmp byte [ecx], 0xfe
mov dword [ebp - 0x18], 0
jne 0x492bc9
cmp byte [ecx + 1], 0xff
mov dword [ebp - 0x18], 0
jne 0x492bc9
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x18], 0
jmp 0x492bd0
cmp esi, 2
ja 0x492c85
xor al, al
cmp esi, 2
jbe 0x492c92
cmp byte [ecx], 0xfe
jne 0x492c92
cmp byte [ecx + 1], 0xff
jne 0x492c92
jmp 0x492c96
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0xff
jne 0x492c6e
cmp byte [ecx + 1], 0xfe
jne 0x492c6e
mov al, 1
test al, al
je 0x492cc5
movzx eax, al
add eax, 2
cmp eax, esi
jae 0x492cc5
mov cl, byte [ecx + eax]
cmp cl, 0x20
jae 0x492cb2
cmp cl, 0xd
je 0x492cb2
cmp cl, 0xa
jne 0x492cbe
add eax, 2
cmp eax, esi
jae 0x492cc5
mov ecx, dword [ebp - 0x10]
jmp 0x492ca0
mov ebx, 3
jmp 0x492cc7
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
test ebx, ebx
je 0x492cee
cmp ebx, 2
je 0x492cee
cmp ebx, 1
jne 0x492dc1
inc edi
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp - 0x20]
cmp edi, esi
jbe 0x492d59
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x492d21
cmp edi, eax
jbe 0x492d21
push eax
push str.Maximum_allowed_array_size___u__is_exceeded
push 0x5d381c
call fcn.00487c80
add esp, 0xc
mov ecx, 0x5d381c
call fcn.00487da0
mov eax, esi
add esi, 0x20
shr eax, 2
add esi, eax
cmp edi, esi
jbe 0x492d31
mov esi, edi
push esi
push dword [ebp - 0x10]
call fcn.0053869a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x492d51
mov ecx, 0x5d381c
call fcn.00487da0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], esi
jmp 0x492d5c
mov eax, dword [ebp - 0x10]
mov byte [edi + eax - 1], 0
cmp ebx, 2
jne 0x492d6e
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov esi, edi
mov dword [ebp - 0x40], esi
test edi, edi
je 0x492db5
cmp edi, 0x20
jbe 0x492d83
mov eax, edi
mov dword [ebp - 0x20], edi
jmp 0x492d8b
mov eax, 0x20
mov dword [ebp - 0x20], eax
add eax, eax
push eax
push 0
call fcn.0053869a
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x492dac
mov ecx, 0x5d381c
call fcn.00487da0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.004c1480
cmp ebx, 3
jne 0x492e62
cmp dword [ebp - 0x18], 0
lea esi, [ebx - 1]
jne 0x492de2
cmp dword [ebp - 0x34], 0
jne 0x492de2
xor esi, esi
mov dword [ebp - 0x18], 1
mov eax, edi
lea ecx, [ebp - 0x44]
shr eax, 1
inc eax
push eax
call fcn.0040d760
mov ebx, dword [ebp - 0x44]
and edi, 0xfffffffe
mov edx, edi
mov dword [ebp - 0x1c], ebx
sub edx, esi
mov dword [ebp - 0x20], edx
cmp esi, edi
jae 0x492e58
mov eax, dword [ebp - 0x34]
lea edi, [edx - 1]
add esi, dword [ebp - 0x10]
xor ebx, ebx
sub dword [ebp - 0x18], eax
add esi, eax
mov edx, dword [ebp - 0x18]
mov eax, 0x100
shr edi, 1
inc edi
nop
movzx ecx, byte [edx + esi]
lea esi, [esi + 2]
mov edx, dword [ebp - 0x1c]
movzx eax, ax
imul ecx, eax
movzx eax, byte [esi - 2]
add cx, ax
mov eax, ebx
shr eax, 1
add ebx, 2
movzx ecx, cx
mov word [edx + eax*2], cx
mov eax, 0x100
mov edx, dword [ebp - 0x18]
sub edi, 1
jne 0x492e20
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
shr edx, 1
xor eax, eax
mov word [ebx + edx*2], ax
jmp 0x492eaa
cmp ebx, 4
jne 0x492ea7
push 1
lea ecx, [ebp - 0x30]
call fcn.004082f0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
mov ebx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x10], ebx
mov byte [eax + ebx - 1], 0
call fcn.0040d760
movzx eax, byte [ebp - 0x11]
push dword [ebp - 0x40]
neg eax
sbb eax, eax
and eax, 3
add eax, ebx
mov ebx, dword [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.004c15f0
jmp 0x492eaa
mov ebx, dword [ebp - 0x1c]
cmp word [ebx], 0
mov esi, ebx
je 0x492ff1
movzx ecx, word [esi]
lea esp, [esp]
movzx eax, cx
xor edx, edx
mov edi, esi
mov ebx, eax
cmp eax, 0xd
je 0x492f0d
mov ecx, eax
movzx ebx, cx
cmp cx, 0xa
je 0x492f0d
movzx ebx, cx
test cx, cx
je 0x492f0d
cmp byte [ebp + 0x3064], 0
je 0x492efd
cmp cx, 0x2f
jne 0x492efd
cmp word [edi + 2], cx
jne 0x492efd
xor eax, eax
mov edx, edi
mov word [edi], ax
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
mov ebx, eax
cmp eax, 0xd
jne 0x492ed0
xor eax, eax
mov word [edi], ax
test edx, edx
jne 0x492f18
mov edx, edi
lea eax, [edx - 2]
cmp eax, esi
jb 0x492f39
nop
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x492f2d
cmp ecx, 9
jne 0x492f39
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, esi
jae 0x492f20
cmp byte [ebp + 0x3060], 0
je 0x492f71
cmp word [esi], 0x22
jne 0x492f71
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x492f50
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x22
jne 0x492f71
xor eax, eax
mov word [esi + ecx*2 - 2], ax
add esi, 2
cmp byte [ebp + 0x3068], 0
je 0x492fba
cmp word [esi], 0x25
jne 0x492fba
xor eax, eax
mov word [ebp + 0x1040], ax
lea eax, [ebp + 0x1040]
push 0x800
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x492fba
cmp eax, 0x800
jae 0x492fba
cmp word [ebp + 0x1040], 0
je 0x492fc9
lea eax, [ebp + 0x1040]
push eax
jmp 0x492fc1
cmp word [esi], 0
je 0x492fc9
push esi
mov ecx, dword [ebp - 0x48]
call fcn.004bdbd0
test bx, bx
je 0x492fee
lea esi, [edi + 2]
movzx eax, word [esi]
mov ecx, eax
cmp eax, 0xd
je 0x492fe0
cmp eax, 0xa
jne 0x492fe5
add esi, 2
jmp 0x492fd1
test ax, ax
jne 0x492ec0
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
push ebx
call fcn.0053867f
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x493012
push eax
call fcn.0053867f
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0048f160
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3040]
xor ecx, ebp
call fcn.00530218
lea esp, [ebp + 0x3044]
pop ebp
ret 0x20