Function at 0x407024
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x94c
mov eax, dword [esp + 0x960]
lea esi, [eax + 0x411]
cmp byte [eax + 0x411], 0x2a
jne 0x4070b7
mov dword [esp], esi
call fcn.006f01a0
cmp eax, 1
ja 0x4070b7
lea esi, [esp + 0x744]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x104
mov dword [esp], 0x70aa62
call sub.KERNEL32.DLL_GetEnvironmentVariableW
sub esp, 0xc
mov dword [esp], esi
call fcn.0041e398
mov esi, eax
mov dword [esp + 4], esi
lea edi, [esp + 0x38]
mov dword [esp], edi
call fcn.006f0154
mov dword [esp], esi
call fcn.0041fbdc
mov dword [esp + 4], edi
call fcn.00406f0c
test al, al
je 0x4072a7
mov dword [esp], edi
call fcn.006f01a0
mov word [esp + eax + 0x38], 0x5c
jmp 0x4070d7
mov dword [esp + 4], esi
lea esi, [esp + 0x38]
mov dword [esp], esi
call fcn.006f0154
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.0041e298
xor ecx, ecx
lea esi, [esp + 0x240]
lea edi, [esp + 0x18]
lea ebx, [esp + 0x13c]
nop word [eax + eax]
mov ebp, ecx
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.006f0154
mov byte [esp + 0x140], 0
mov dword [esp + 0x13c], 0x67666366
mov dword [esp + 8], ebp
mov dword [esp], edi
mov dword [esp + 4], 0x70aa71
call fcn.006f490c
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.006f0054
mov dword [esp], ebx
call fcn.006f01a0
mov byte [esp + eax + 0x140], 0
mov dword [esp + eax + 0x13c], 0x706d742e
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.006f0054
mov dword [esp], esi
call fcn.006f01a0
cmp eax, 0x104
jae 0x40719d
lea eax, [esp + 0x344]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 8], 0
call fcn.006f1850
cmp ebp, 0xfe
ja 0x40719d
lea ecx, [ebp + 1]
test eax, eax
je 0x4070f4
cmp ebp, 0xfe
jg 0x407318
mov dword [esp + 4], esi
lea ebx, [esp + 0x38]
mov dword [esp], ebx
call fcn.006f0154
mov dword [esp], ebx
call fcn.0042309c
test al, al
je 0x4071cd
mov dword [esp], ebx
call fcn.006f77b8
mov dword [esp], ebx
mov dword [esp + 4], 0x70aa7b
call fcn.006f1e5c
mov esi, eax
test esi, esi
mov edi, dword [esp + 0x960]
mov ebp, dword [esp + 0x968]
je 0x407318
mov eax, dword [edi + 8]
mov dword [esp], eax
call fcn.006f3358
nop dword [eax]
mov eax, dword [edi + 8]
mov dword [esp], eax
call fcn.006f22ac
cmp eax, ebp
je 0x40723d
mov eax, dword [edi + 8]
mov dword [esp], eax
call fcn.006f77e0
cmp eax, 0xffffffff
je 0x4072b1
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.006f7838
cmp eax, 0xffffffff
jne 0x407204
jmp 0x407311
mov dword [esp + 4], esi
mov eax, dword [esp + 0x964]
mov dword [esp], eax
call fcn.006f1fe4
cmp eax, 0xffffffff
je 0x407311
mov eax, dword [edi + 8]
mov dword [esp + 8], eax
lea eax, [esp + 0x344]
mov dword [esp], eax
mov dword [esp + 4], 0x400
call fcn.006f15d8
test eax, eax
je 0x4072b1
nop word [eax + eax]
mov eax, dword [edi + 8]
mov dword [esp], eax
call fcn.006f77e0
cmp eax, 0xffffffff
je 0x4072ba
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.006f7838
cmp eax, 0xffffffff
jne 0x407284
jmp 0x407311
mov byte [esp + 0x38], 0
jmp 0x4070d7
mov dword [edi + 4], 3
jmp 0x407318
mov dword [esp], esi
call fcn.006f1200
mov eax, dword [edi + 8]
mov dword [esp], eax
call fcn.006f1200
mov eax, dword [edi]
mov dword [esp], eax
call fcn.006f77b8
test eax, eax
js 0x407311
mov eax, dword [edi]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.006f3330
test eax, eax
js 0x407311
mov eax, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], 0x70aa7d
call fcn.006f1e5c
mov dword [edi + 8], eax
test eax, eax
je 0x407325
mov dword [edi + 4], 0
mov al, 1
jmp 0x40731a
mov dword [edi + 4], 2
xor eax, eax
add esp, 0x94c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [edi + 4], 4
jmp 0x407318