Function at 0x5982e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.RANDFILE
call esi
sub esp, 0xc
test eax, eax
je 0x598463
mov ebx, eax
lea eax, [eax + eax + 0x1e]
shr eax, 4
shl eax, 4
call fcn.006b7700
sub esp, eax
lea edi, [esp + 0x2f]
mov dword [esp + 8], ebx
and edi, 0xfffffff0
mov dword [esp], str.RANDFILE
mov dword [esp + 4], edi
call esi
sub esp, 0xc
cmp ebx, eax
jbe 0x598453
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call esi
sub esp, 0x20
mov edx, eax
test eax, eax
je 0x598453
lea eax, [eax + 0x1e]
shr eax, 4
shl eax, 4
call fcn.006b7700
sub esp, eax
lea ecx, [esp + 0x2f]
mov dword [esp + 0x1c], 0
and ecx, 0xfffffff0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], ecx
call esi
sub esp, 0x20
test eax, eax
je 0x598453
mov edi, 1
mov ecx, dword [ebp - 0x1c]
cmp byte [ecx], 0
je 0x598453
mov edx, ecx
mov esi, dword [edx]
add edx, 4
lea eax, [esi - 0x1010101]
xor esi, 0xffffffff
and eax, esi
and eax, 0x80808080
je 0x5983fe
test eax, 0x8080
jne 0x598422
shr eax, 0x10
add edx, 2
mov bl, al
add bl, al
sbb edx, 3
sub edx, ecx
test edi, edi
je 0x59843b
lea eax, [edx + 1]
cmp eax, dword [ebp + 0xc]
jb 0x598571
add edx, 6
cmp dword [ebp + 0xc], edx
ja 0x598522
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x59845b
xor eax, eax
jmp 0x59845b
mov eax, dword [ebp + 8]
mov byte [eax], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.HOME
call esi
mov ecx, str.HOME
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x5984c6
lea eax, [ebx + ebx + 0x1e]
and eax, 0xfffffff0
call fcn.006b7700
sub esp, eax
lea edi, [esp + 0x2f]
mov dword [esp + 8], ebx
and edi, 0xfffffff0
mov dword [esp], ecx
mov dword [esp + 4], edi
call esi
sub esp, 0xc
cmp eax, ebx
jb 0x5985a1
mov edx, 2
mov ecx, 0x76e846
jmp 0x59843b
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.USERPROFILE
call esi
mov ecx, str.USERPROFILE
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x59848a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x76e80e
call esi
sub esp, 0xc
mov ebx, eax
test eax, eax
jne 0x598597
mov edx, 8
mov ecx, 0x76e846
jmp 0x59843e
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00588e10
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x76e85c
mov dword [esp], eax
call fcn.00588e70
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], str..rnd
mov dword [esp], eax
call fcn.00588e70
jmp 0x598447
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00588e10
cmp eax, dword [ebp + 0xc]
jb 0x598447
xor eax, eax
jmp 0x59845b
mov ecx, 0x76e80e
jmp 0x59848a
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call esi
sub esp, 0x20
mov edx, eax
test eax, eax
je 0x5984b7
lea eax, [eax + 0x1e]
shr eax, 4
shl eax, 4
call fcn.006b7700
sub esp, eax
lea ecx, [esp + 0x2f]
mov dword [esp + 0x1c], 0
and ecx, 0xfffffff0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], ecx
call esi
sub esp, 0x20
test eax, eax
je 0x5984b7
xor edi, edi
mov ecx, dword [ebp - 0x1c]
jmp 0x5983f7