Function at 0x42afa0
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x303c]
mov eax, 0x303c
call fcn.00466a00
push 0xffffffffffffffff
push 0x47b08d
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x48d1f4]
xor eax, ebp
mov dword [ebp + 0x3038], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x3048]
mov eax, dword [ebp + 0x3044]
mov dword [ebp - 0x58], ecx
xor ecx, ecx
mov word [ebp + 0x2038], cx
test eax, eax
je 0x42b02a
cmp byte [ebp + 0x304c], cl
je 0x42b018
push ecx
push 1
push 0x800
lea ecx, [ebp + 0x2038]
push ecx
push eax
call fcn.0043bab0
jmp 0x42b02a
push 0x800
push eax
lea eax, [ebp + 0x2038]
push eax
call fcn.00456ab0
lea ecx, [ebp]
call fcn.00427a00
cmp word [ebp + 0x2038], 0
mov dword [ebp - 4], 0
je 0x42b089
mov bl, byte [ebp + 0x3050]
lea eax, [ebp + 0x2038]
lea ecx, [ebp]
test bl, bl
je 0x42b05e
push eax
call fcn.00428bd0
jmp 0x42b066
push 0
push eax
call fcn.00428160
test al, al
jne 0x42b090
test bl, bl
je 0x42b07a
push 6
mov ecx, 0x49d17c
call fcn.00421270
lea ecx, [ebp]
call fcn.00427a50
xor al, al
jmp 0x42b6e3
mov dword [ebp + 0x10], 1
xor edi, edi
mov byte [ebp - 0x30], 0
push 0x1000
push edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], 0x1000
call fcn.0046a903
mov ebx, eax
add esp, 8
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x42b0c1
mov ecx, 0x49d17c
call fcn.004213d0
mov esi, 0x1000
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], esi
push esi
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.00428550
test eax, eax
je 0x42b180
mov ecx, dword [ebp - 0x3c]
add edi, eax
add ecx, eax
mov dword [ebp - 0x3c], ecx
cmp ecx, esi
jbe 0x42b123
mov eax, esi
add esi, 0x20
shr eax, 2
add esi, eax
cmp ecx, esi
jbe 0x42b103
mov esi, ecx
push esi
push ebx
call fcn.0046a903
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x42b11d
mov ecx, 0x49d17c
call fcn.004213d0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], esi
lea eax, [ebx + edi]
push 0x1000
push eax
lea ecx, [ebp]
call fcn.00428550
test eax, eax
jne 0x42b0e5
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
cmp edi, esi
jbe 0x42b180
mov eax, esi
mov dword [ebp - 0x3c], edi
shr eax, 2
add esi, 0x20
add esi, eax
mov dword [ebp - 0x20], esi
cmp edi, esi
jbe 0x42b15b
mov esi, edi
mov dword [ebp - 0x20], esi
push esi
push ebx
call fcn.0046a903
mov ebx, eax
add esp, 8
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x42b178
mov ecx, 0x49d17c
call fcn.004213d0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], esi
jmp 0x42b183
mov dword [ebp - 0x3c], edi
cmp edi, 2
jb 0x42b1fe
cmp byte [ebx], 0xff
jne 0x42b1fe
cmp byte [ebx + 1], 0xfe
jne 0x42b1fe
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x2c], 0
cmp edi, 3
jb 0x42b1bb
cmp byte [ebx], 0xef
jne 0x42b1bb
cmp byte [ebx + 1], 0xbb
jne 0x42b1bb
cmp byte [ebx + 2], 0xbf
mov byte [ebp - 0x11], 1
je 0x42b1bf
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 0x3054]
test eax, eax
jne 0x42b28b
cmp edi, 3
jbe 0x42b23a
cmp byte [ebx], 0xef
jne 0x42b243
cmp byte [ebx + 1], 0xbb
jne 0x42b243
cmp byte [ebx + 2], 0xbf
jne 0x42b243
lea eax, [edi - 3]
push eax
lea eax, [ebx + 3]
push eax
call fcn.00459df0
test al, al
je 0x42b243
mov eax, 4
jmp 0x42b285
mov dword [ebp - 0x18], 0
cmp edi, 2
jb 0x42b19a
cmp byte [ebx], 0xfe
mov dword [ebp - 0x18], 0
jne 0x42b19a
cmp byte [ebx + 1], 0xff
mov dword [ebp - 0x18], 0
jne 0x42b19a
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x18], 0
jmp 0x42b1a1
cmp edi, 2
jbe 0x42b3ec
cmp byte [ebx], 0xff
jne 0x42b3ec
cmp byte [ebx + 1], 0xfe
jne 0x42b3ec
mov al, 1
test al, al
je 0x42b283
movzx eax, al
add eax, 2
cmp eax, edi
jae 0x42b283
mov cl, byte [ebx + eax]
cmp cl, 0x20
jae 0x42b27c
cmp cl, 0xd
je 0x42b27c
cmp cl, 0xa
jne 0x42b40f
add eax, 2
cmp eax, edi
jb 0x42b266
xor eax, eax
mov dword [ebp + 0x3054], eax
xor ecx, ecx
xor edx, edx
xor edi, edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov byte [ebp - 0x44], cl
mov byte [ebp - 4], 2
test eax, eax
je 0x42b2bc
cmp eax, 2
je 0x42b2bc
cmp eax, 1
jne 0x42b36e
mov edi, dword [ebp - 0x3c]
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, esi
jbe 0x42b306
mov eax, esi
add esi, 0x20
shr eax, 2
add esi, eax
mov dword [ebp - 0x20], esi
cmp edi, esi
jbe 0x42b2dd
mov esi, edi
mov dword [ebp - 0x20], esi
push esi
push ebx
call fcn.0046a903
mov ebx, eax
add esp, 8
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x42b2fa
mov ecx, 0x49d17c
call fcn.004213d0
mov eax, dword [ebp + 0x3054]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], esi
mov byte [edi + ebx - 1], 0
cmp eax, 2
jne 0x42b318
push ebx
push ebx
call dword [sym.imp.USER32.dll_OemToCharA]
mov dword [ebp - 0x50], edi
test edi, edi
je 0x42b358
mov eax, edi
cmp edi, 0x20
ja 0x42b32b
mov eax, 0x20
mov dword [ebp - 0x1c], eax
add eax, eax
push eax
push 0
call fcn.0046a903
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x42b34f
mov ecx, 0x49d17c
call fcn.004213d0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
push edi
push dword [ebp - 0x10]
push ebx
call fcn.00459db0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x3054]
mov edx, dword [ebp - 0x10]
cmp eax, 3
jne 0x42b4c3
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 2
jne 0x42b396
cmp dword [ebp - 0x2c], 0
jne 0x42b396
xor eax, eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
shr eax, 1
inc eax
cmp eax, ecx
jbe 0x42b419
sub eax, edi
add edi, eax
mov dword [ebp - 0x50], edi
cmp edi, ecx
jbe 0x42b41c
mov eax, ecx
add ecx, 0x20
shr eax, 2
add ecx, eax
mov dword [ebp - 0x1c], ecx
cmp edi, ecx
jbe 0x42b3c1
mov ecx, edi
mov dword [ebp - 0x1c], ecx
lea eax, [ecx + ecx]
push eax
push edx
call fcn.0046a903
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x42b3e1
mov ecx, 0x49d17c
call fcn.004213d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], eax
jmp 0x42b41c
xor al, al
cmp edi, 2
jbe 0x42b258
cmp byte [ebx], 0xfe
jne 0x42b258
cmp byte [ebx + 1], 0xff
jne 0x42b258
jmp 0x42b25c
mov eax, 3
jmp 0x42b285
mov dword [ebp - 0x50], eax
mov edi, dword [ebp - 0x3c]
mov edx, edi
mov ecx, dword [ebp - 0x28]
and edx, 0xfffffffe
cmp ecx, edx
jae 0x42b4ae
lea eax, [ebx + ecx]
sub edx, ecx
mov dword [ebp - 0x28], eax
mov ebx, eax
mov eax, dword [ebp - 0x2c]
xor edi, edi
sub dword [ebp - 0x18], eax
add ebx, eax
mov esi, dword [ebp - 0x18]
lea eax, [edx - 1]
shr eax, 1
inc eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov eax, 0x100
mov edx, dword [ebp - 0x28]
lea ebx, [ebx]
movzx ecx, byte [esi + ebx]
lea ebx, [ebx + 2]
mov esi, dword [ebp - 0x10]
movzx eax, ax
imul ecx, eax
movzx eax, byte [ebx - 2]
add cx, ax
mov eax, edi
shr eax, 1
add edi, 2
mov word [esi + eax*2], cx
mov eax, 0x100
mov esi, dword [ebp - 0x18]
sub edx, 1
jne 0x42b460
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x3c]
shr edx, 1
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x3054]
jmp 0x42b4c6
mov eax, dword [ebp - 0x10]
sub edx, ecx
shr edx, 1
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [ebp + 0x3054]
jmp 0x42b4c6
mov edi, dword [ebp - 0x3c]
cmp eax, 4
jne 0x42b579
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, esi
jbe 0x42b50a
mov eax, esi
add esi, 0x20
shr eax, 2
add esi, eax
cmp edi, esi
jbe 0x42b4e7
mov esi, edi
push esi
push ebx
call fcn.0046a903
mov ebx, eax
add esp, 8
mov dword [ebp - 0x24], ebx
test ebx, ebx
jne 0x42b504
mov ecx, 0x49d17c
call fcn.004213d0
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x1c]
mov byte [edi + ebx - 1], 0
cmp edi, ecx
jbe 0x42b55e
sub edi, dword [ebp - 0x50]
add edi, dword [ebp - 0x50]
mov dword [ebp - 0x50], edi
cmp edi, ecx
jbe 0x42b561
mov eax, ecx
lea esi, [ecx + 0x20]
shr eax, 2
add esi, eax
cmp edi, esi
jbe 0x42b533
mov esi, edi
lea eax, [esi + esi]
push eax
push dword [ebp - 0x10]
call fcn.0046a903
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x42b556
mov ecx, 0x49d17c
call fcn.004213d0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], esi
jmp 0x42b564
mov dword [ebp - 0x50], edi
mov eax, dword [ebp - 0x10]
push edi
push eax
movzx eax, byte [ebp - 0x11]
neg eax
sbb eax, eax
and eax, 3
add eax, ebx
push eax
call fcn.00459eb0
mov eax, dword [ebp - 0x10]
mov esi, eax
movzx eax, word [eax]
test ax, ax
je 0x42b6be
mov ecx, eax
lea esp, [esp]
movzx eax, cx
xor edx, edx
mov edi, esi
mov ebx, eax
cmp eax, 0xd
je 0x42b5dd
mov ecx, eax
movzx ebx, cx
cmp cx, 0xa
je 0x42b5dd
movzx ebx, cx
test cx, cx
je 0x42b5dd
cmp byte [ebp + 0x305c], 0
je 0x42b5cd
cmp cx, 0x2f
jne 0x42b5cd
cmp word [edi + 2], cx
jne 0x42b5cd
xor eax, eax
mov edx, edi
mov word [edi], ax
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
mov ebx, eax
cmp eax, 0xd
jne 0x42b5a0
xor eax, eax
mov word [edi], ax
test edx, edx
jne 0x42b5e8
mov edx, edi
lea eax, [edx - 2]
cmp eax, esi
jb 0x42b609
nop
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x42b5fd
cmp ecx, 9
jne 0x42b609
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, esi
jae 0x42b5f0
cmp byte [ebp + 0x3058], 0
je 0x42b641
cmp word [esi], 0x22
jne 0x42b641
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42b620
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x22
jne 0x42b641
xor eax, eax
mov word [esi + ecx*2 - 2], ax
add esi, 2
cmp byte [ebp + 0x3060], 0
je 0x42b68a
cmp word [esi], 0x25
jne 0x42b68a
xor eax, eax
mov word [ebp + 0x1038], ax
lea eax, [ebp + 0x1038]
push 0x800
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x42b68a
cmp eax, 0x800
jae 0x42b68a
cmp word [ebp + 0x1038], 0
je 0x42b699
lea eax, [ebp + 0x1038]
push eax
jmp 0x42b691
cmp word [esi], 0
je 0x42b699
push esi
mov ecx, dword [ebp - 0x58]
call fcn.00456b50
test bx, bx
je 0x42b6be
lea esi, [edi + 2]
movzx eax, word [esi]
mov ecx, eax
cmp eax, 0xd
je 0x42b6b0
cmp eax, 0xa
jne 0x42b6b5
add esi, 2
jmp 0x42b6a1
test ax, ax
jne 0x42b590
push dword [ebp - 0x10]
call fcn.0046a8f3
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x42b6d9
push eax
call fcn.0046a8f3
add esp, 4
lea ecx, [ebp]
call fcn.00427a50
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3038]
xor ecx, ebp
call fcn.004669f1
lea esp, [ebp + 0x303c]
pop ebp
ret 0x20