Function at 0x401641
Capabilities:
Query environment variable

Disassembly:
sub esi, 2
sub esi, 1
neg esi
lea edx, [0x5f]
add edx, 1
sub edi, 2
mov ebx, eax
add eax, edi
cdq
leave
jmp section..fF
cmp bx, 0x8c1
jns 0x40104d
add edx, ebx
dec edi
dec edi
sub ebx, 2
or eax, 0x7e
sub eax, edx
leave
jmp 0x401043
cmp si, 0x472d
jnp 0x4010a8
mov ebx, 0x2d
add eax, 1
lea ecx, [eax + 0xf]
lea edx, [ecx + 8]
dec edx
leave
jmp 0x40109c
add edi, ecx
sub ecx, 1
mov eax, 0x11
mov esi, 0x8b
or ecx, esp
lea edi, [ecx + 0xb]
add edx, 2
inc ebx
add ecx, 1
inc ebx
leave
jmp 0x4010ea
lea edi, [eax + 0xb]
lea eax, [edx + 0x9b]
sub ecx, 1
test ecx, ebx
jne 0x401150
mov edx, ebx
inc eax
add esi, ecx
lea ebx, [esi]
add ebx, edi
add edx, esi
dec eax
leave
jmp 0x401137
xor edi, edx
cmp ecx, dword [0x413326]
xor ebx, ecx
lea edi, [0x17]
leave
jmp 0x401163
xor ecx, dword [0x413ef6]
mov edx, 0xa4
lea ebx, [esi + 0xcf]
or ecx, 0x2e
dec ecx
sub esi, ebx
leave
jmp 0x401179
mov edx, ecx
add edi, eax
mov edi, 0xd9
mov edi, eax
mov edi, 6
lea eax, [ebx + 0xc]
sub esi, dword [0x41365b]
sub ebx, 1
inc ecx
leave
jmp 0x4011bd
xor ecx, ecx
push ecx
push 0x92
pop ecx
push ecx
mov eax, 0x43
push eax
mov dword [0x413188], 0
mov eax, dword [0x413188]
push eax
push 0
pop eax
push eax
mov ebx, 0
mov edx, ebx
push edx
call dword [sym.imp.USER32.DLL_CreateDesktopA]
mov dword [0x41314f], eax
xor eax, eax
sub eax, dword [0x4130b3]
mov ecx, eax
shl ecx, 5
sub dword [0x4131e7], ecx
rol ecx, 1
add dword [0x4130d9], ecx
dec ecx
sub ecx, ebx
add ecx, 0x3c4
shl ecx, 1
mov dword [0x413133], ecx
mov ecx, esi
dec ecx
sub ecx, ebx
rol ecx, 5
add ecx, dword [0x41313b]
ror ecx, 1
shr ecx, 5
dec ecx
add ecx, dword [0x413089]
add dword [0x413144], ecx
jmp 0x402450
mov eax, ebp
push eax
push esp
pop ebp
sub esp, 0x30
push edi
push esi
lea eax, [0x413007]
push eax
call fcn.004015f4
mov dword [ebp - 0x2c], eax
mov edx, 0
ror edx, 1
add edx, 0x94
mov dword [0x4131ab], edx
sub edx, edi
add edx, dword [0x4131a0]
inc edx
add edx, ebx
mov eax, edx
rol eax, 3
sub eax, dword [0x413026]
add dword [0x413121], eax
push 0
push 0
push 0x4130d8
push 0x413051
push 0x80000000
mov dword [ebp - 0x20], 0x40ec02
mov ecx, dword [ebp - 0x20]
mov dword [0x413125], 0x154ee
add ecx, dword [0x413125]
push dword [ecx]
pop dword [0x4131f4]
mov ecx, dword [0x4131f4]
call ecx
mov dword [ebp - 0x10], edx
push 0xbc834
call fcn.00401374
mov dword [0x4131bb], eax
mov dword [ebp - 0xc], 0
mov edi, dword [ebp - 0xc]
push edi
mov dword [0x413011], 0
mov esi, dword [0x413011]
push esi
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x28]
push ebx
push 0xed
pop edx
push edx
push 0x124213
pop esi
mov dword [0x4130d7], 0x2ffecd
add esi, dword [0x4130d7]
push dword [esi]
pop esi
call esi
or eax, eax
jne 0x40104c
mov esi, eax
sub esi, dword [0x4130bc]
mov edi, esi
add edi, dword [0x413075]
sub edi, 0x7d7
add edi, dword [0x413079]
sub edi, dword [0x413159]
inc edi
add edi, 0x98e
rol edi, 3
mov ebx, edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
push ecx
mov dword [ebp - 0x18], 0xb1
mov eax, dword [ebp - 0x18]
push eax
mov esi, 1
mov ecx, esi
push ecx
mov ecx, 0x212064
mov edi, ecx
shl edi, 1
call dword [edi]
inc eax
jne 0x401179
lea eax, [0x413005]
push eax
push 0
push 0
push ebx
push 0
call fcn.00401578
mov dword [0x413094], eax
xor edx, edx
sub edx, 0xf45
jne 0x4025bc
inc edx
shl edx, 1
sub edx, esi
shr edx, 3
add edx, 0x414
ja 0x4025cd
add edx, eax
mov eax, edx
mov dword [ebp - 0x2c], eax
add eax, 0x635
jne 0x4025df
sub eax, dword [0x4131b2]
ror eax, 4
sub eax, dword [0x4130cb]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xfaf4ee
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 0xb8b47a
sub eax, dword [ebp - 0x1c]
call dword [eax]
or eax, eax
je 0x401184
push 0
mov esi, 0x137bde19
sub esi, 0x133bbc21
call esi
xor ecx, ecx
push ecx
mov edx, 0x16
mov ecx, edx
push ecx
push 3
pop eax
push eax
mov edx, 0xcb0c10
sub edx, 0x88cb48
call dword [edx]
inc eax
jne 0x40104a
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
push eax
mov dword [ebp - 4], 0x46619
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], 0x3dda7f
add eax, dword [ebp - 0x18]
push dword [eax]
mov edi, 0x4131e8
pop dword [edi]
mov eax, dword [0x4131e8]
call eax
or eax, eax
jne 0x4010b4
push ebx
lea eax, [0x41300b]
push eax
dec edi
inc esi
inc edi
lea eax, [0x41300b]
push eax
push 0
add ebx, eax
inc eax
push 0xacea1
call fcn.004013f0
inc eax
push esi
push 0x36af4
push 0
push 0
or ebx, ebx
push eax
push 0
call fcn.004013b4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0xd3
mov ebx, dword [ebp - 0x10]
push ebx
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
push edx
mov dword [0x4131b7], 0
mov edx, dword [0x4131b7]
push edx
mov dword [ebp - 0x2c], 0xdd
mov ebx, dword [ebp - 0x2c]
push ebx
mov ebx, 0xed7a0
mov eax, ebx
mov dword [ebp - 4], 0x336944
add eax, dword [ebp - 4]
push dword [eax]
pop ecx
mov eax, ecx
call eax
or eax, eax
jne 0x40110a
push 0x939280
pop edi
mov dword [ebp - 0x2c], 0x515254
sub edi, dword [ebp - 0x2c]
call dword [edi]
or eax, eax
je 0x4011d9
mov dword [0x41315e], 0
mov edi, dword [0x41315e]
push edi
mov edx, 0
mov ecx, edx
push ecx
mov edx, 0xcc552d
mov ebx, edx
mov esi, 0x8a1505
mov ecx, esi
sub ebx, ecx
call dword [ebx]
or eax, eax
jne 0x4010ba
push eax
push 0x31fa1
or al, bl
lea eax, [0x41300d]
push eax
push ebx
push edi
call fcn.00401578
mov dword [0x4130cd], eax
mov dword [0x413022], 0
mov esi, dword [0x413022]
push esi
push 1
pop esi
push esi
mov dword [ebp - 0x14], 0x97af22
mov eax, dword [ebp - 0x14]
mov esi, 0x556e4a
mov ebx, esi
sub eax, ebx
call dword [eax]
or eax, eax
jne 0x4011d3
mov ecx, 0xab
push ecx
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, 1
push eax
mov esi, 0x212066
shl esi, 1
call dword [esi]
or eax, eax
jne 0x401143
mov dword [0x41310c], 0
mov esi, dword [0x41310c]
push esi
mov edi, 0x45
push edi
mov esi, 1
mov eax, esi
push eax
mov edi, 0x212064
mov eax, edi
shl eax, 1
call dword [eax]
inc eax
jne 0x401137
xor esi, esi
push esi
push 0
pop ecx
push ecx
mov dword [ebp - 0x28], 0
mov edi, dword [ebp - 0x28]
push edi
push 1
pop esi
push esi
mov eax, 0x212062
mov edx, eax
shl edx, 1
call dword [edx]
or eax, eax
jne 0x401165
xor ebx, ebx
push ebx
mov ebx, 0x11
push ebx
mov edi, 3
push edi
mov dword [ebp - 0x18], 0x16d831
mov edi, dword [ebp - 0x18]
add edi, 0x2b6897
push dword [edi]
pop dword [0x4131d2]
mov edi, dword [0x4131d2]
call edi
inc eax
jne 0x401152
push ebx
dec edi
inc esi
push 0
push edi
push edi
lea eax, [0x413005]
push eax
call fcn.00401578
mov dword [ebp - 0x18], eax
or eax, eax
je 0x402876
inc ebx
inc eax
sub edi, eax
sub eax, esi
lea eax, [0x413017]
push eax
push 0
push 0x70199
push ebx
push 0
lea eax, [0x413006]
push eax
call fcn.004014a4
mov dword [0x4130fa], eax
push 0xb2aac
push 0
push esi
lea eax, [0x413003]
push eax
push edi
push 0
mov ebx, 0x3effc4
add ebx, 0x1178c
call ebx
cmp eax, 0
je 0x40115a
push eax
add esi, edi
sub ebx, esi
lea eax, [0x413003]
push eax
call fcn.00401274
mov dword [ebp - 0xc], eax
or eax, eax
je 0x4028de
inc eax
mov edx, 0x575fc887
mov esi, edx
push esi
push 0x3bcaa7
pop ebx
add ebx, 0x56563
push ebx
push 0x3ba618
pop edx
add edx, 0x589fe
push edx
mov dword [ebp - 0x2c], 0
mov esi, dword [ebp - 0x2c]
push esi
mov eax, 0x18ad4b
mov esi, 0x2882c7
add eax, esi
push eax
mov esi, 0x25d809
mov eax, esi
mov dword [0x41301d], 0x1b5803
add eax, dword [0x41301d]
push eax
push 0x61
pop edx
push edx
mov dword [0x413075], 0
mov edi, dword [0x413075]
push edi
mov ebx, 0x4256b2
mov edi, 0x15ba
mov eax, edi
sub ebx, eax
call dword [ebx]
or eax, eax
je 0x4011bf
mov edx, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
call edx
or eax, eax
je 0x40100c
mov dword [ebp - 0x1c], eax
add eax, ebx
push 0
call fcn.00401374
mov dword [0x4131c0], eax
or eax, eax
je 0x402989
mov dword [ebp - 0x24], ebx
inc esi
xor ecx, ecx
sub ecx, esi
sub ecx, 0x2fe
shr ecx, 1
sub ecx, edi
add ecx, 0x7e5
dec ecx
shr ecx, 1
add ecx, 0xde0
jb 0x4029b6
cmp ecx, 0x18b
jae 0x4029b6
add ecx, dword [0x4131f6]
dec ecx
add ecx, edi
mov dword [ebp - 4], ecx
lea ebx, [eax + 0x413052]
mov dword [ebp - 0xc], ebx
shr ebx, 5
sub ebx, dword [0x41316b]
sub ebx, 0xe2
shr ebx, 1
cmp ebx, 0xde6
je 0x4029e1
ror ebx, 3
add ebx, dword [0x41300f]
shr ebx, 1
add ebx, 0xb16
mov eax, ebx
mov dword [0x4131a7], eax
lea eax, [edi + 0x41306b]
shr eax, 1
sub dword [0x413106], eax
sub eax, 0xfc0
shr eax, 2
add eax, eax
shl eax, 1
add eax, dword [0x41317f]
sub eax, 0xe64
mov esi, eax
add esi, 0x9cf
ja 0x402a2e
add esi, dword [0x4131e5]
mov dword [0x413149], esi
dec eax
dec ecx
sub ecx, edi
push edi
call fcn.00401374
mov dword [ebp - 0x24], eax
sub esi, ebx
inc edi
push esi
push esi
push 0xa26a8
inc esi
add eax, esi
inc edi
push 0
push edi
push 0xe03b0
call fcn.00401424
mov dword [0x413085], eax
or eax, eax
jne 0x402a69
mov dword [ebp - 4], eax
inc esi
dec esi
lea eax, [0x41300d]
push eax
push 0xbe852
push ebx
push 0xea7c3
call fcn.0040152c
mov dword [ebp - 0x1c], eax
lea ebx, [edi + 0x4130c2]
add ebx, 0x953
sub ebx, dword [0x413191]
rol ebx, 3
add ebx, edi
dec ebx
cmp ebx, 0x37e
jns 0x402aa6
mov edx, ebx
add edx, dword [0x413130]
inc edx
sub dword [0x41309e], edx
sub edx, 0x854
mov dword [0x4130ad], edx
mov eax, ebx
shr eax, 4
rol eax, 1
add eax, 0xf5e
jne 0x402ad6
sub eax, 0x141
jb 0x402ad6
sub eax, ebx
rol eax, 1
add eax, 0x85e
cmp eax, 0x856
jbe 0x402aeb
sub dword [0x413118], eax
dec eax
shr eax, 2
add eax, dword [0x413184]
mov dword [ebp - 0x10], eax
mov dword [0x4130d8], eax
lea esi, [eax + 0x413042]
sub esi, 0xbf
sub esi, eax
inc esi
cmp esi, 0x787
jbe 0x402b1b
sub esi, 0x6c1
shr esi, 1
mov dword [0x4131c0], esi
dec esi
sub esi, eax
shr esi, 1
ror esi, 1
add dword [0x413084], esi
sub ebx, edi
inc esi
or eax, eax
mov dword [ebp - 4], eax
lea eax, section.._3_pv7
push eax
push 0
push 0
lea eax, [0x413010]
push eax
push 0x988a0
push ebx
call fcn.00401424
mov dword [0x41311f], eax
or eax, eax
jne 0x402b5f
inc eax
pop ebx
push 0
mov ecx, 0xba0b20
sub ecx, 0x79f180
call ecx
push esi
push edi
push 0xdeda6
push 0
lea eax, [0x413018]
push eax
lea eax, [0x413011]
push eax
push 0xf605d
call fcn.004013f0
mov dword [ebp - 4], eax
lea eax, [0x41300a]
push eax
lea eax, [0x413006]
push eax
push 0
push eax
push esi
push 0xd98b1
call fcn.00401334
mov edx, 0
rol edx, 7
sub edx, esi
mov ebx, edx
sub ebx, dword [0x4131e1]
rol ebx, 4
sub ebx, edx
add ebx, esi
sub ebx, dword [0x413133]
inc ebx
add dword [0x41307d], ebx
mov dword [ebp - 0x18], ebx
xor edx, edx
sub edx, 0x5bb
ja 0x402be5
ror edx, 6
sub edx, 0x52f
ror edx, 4
sub edx, 0x199
add edx, edi
sub edx, 0xe7c
dec edx
shr edx, 8
add edx, edx
mov eax, edx
sub dword [0x4131c5], eax
mov esi, 0xd73
shr esi, 1
mov dword [ebp - 0x10], esi
shl esi, 8
sub esi, dword [0x41314f]
shr esi, 4
sub esi, 0x44b
sub esi, dword [0x413207]
mov dword [ebp - 0x20], esi
add esi, dword [0x41304a]
sub esi, 0xfa6
mov dword [0x413021], esi
lea eax, [0x413002]
push eax
call fcn.00401274
mov eax, 0
mov ebx, eax
inc ebx
cmp ebx, 0x4e
jbe 0x402c5f
mov edx, ebx
add edx, dword [0x4130d6]
add edx, edi
shr edx, 1
add edx, esi
rol edx, 1
dec edx
rol edx, 4
mov dword [ebp - 0x18], edx
ret