Function at 0x5d98f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov esi, esp
mov ebx, dword [ebp + 8]
push 0
push 0
push 0xa8db74
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x5d9934
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edi, eax
add eax, 0xffff3bd4
cmp eax, 0xa
jae 0x5d994e
mov ecx, 0x2a7
bt ecx, eax
jae 0x5d9959
xor ecx, ecx
jmp 0x5d996f
call fcn.005e7c10
xor ecx, ecx
test eax, eax
jne 0x5d9b81
push ebx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
jmp 0x5d9b83
lea eax, [edi - 0xdeaa]
cmp eax, 0xa
jb 0x5d9930
xor eax, eax
cmp edi, 0x2a
setne al
shl eax, 3
xor ecx, ecx
cmp edi, 0xfde8
cmovne ecx, eax
push 0
push 0
push 0xffffffffffffffff
push ebx
mov dword [esi + 8], ecx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
test eax, eax
jle 0x5d9b81
mov ebx, eax
lea eax, [eax*2 + 8]
cmp eax, 0x400
ja 0x5d99b5
add eax, 3
and eax, 0xfffffffc
call fcn.00787ee0
mov eax, esp
and eax, 0xfffffff0
mov esp, eax
mov dword [eax], 0xcccc
jmp 0x5d99ce
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
xor ecx, ecx
add esp, 4
test eax, eax
je 0x5d9b81
mov dword [eax], 0xdddd
mov dword [esi + 0xc], eax
add eax, 8
push ebx
mov ebx, eax
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push dword [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dl, 1
xor ecx, ecx
test eax, eax
jle 0x5d9a2b
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x5d9a41
mov edi, eax
mov dword [esi + 8], ebx
lea eax, [eax*2 + 8]
cmp eax, 0x400
ja 0x5d9a5b
add eax, 3
and eax, 0xfffffffc
call fcn.00787ee0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
mov dword [ebx], 0xcccc
jmp 0x5d9a80
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5d9b2a
jmp 0x5d9b64
xor ebx, ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5d9b2a
jmp 0x5d9b64
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov ebx, 0
test eax, eax
mov ecx, 0
mov dl, 1
je 0x5d9b1f
mov dword [eax], 0xdddd
mov ebx, eax
add ebx, 8
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
cmp eax, edi
jae 0x5d9b0c
sub esp, 0x20
movss xmm0, dword [0xa8db70]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x5d9b1b
mov edi, eax
push 0x46
push str.crypto_getenv.c
push eax
call fcn.005dadf0
add esp, 0xc
test eax, eax
je 0x5d9b1b
push 0
push 0
push edi
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
test eax, eax
je 0x5d9b45
mov ecx, edi
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5d9b2a
jmp 0x5d9b64
xor edx, edx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5d9b2a
jmp 0x5d9b64
xor ecx, ecx
xor edx, edx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
jne 0x5d9b64
push eax
mov edi, ecx
mov dword [esi + 8], ebx
mov ebx, edx
call fcn.00786dc0
mov ecx, edi
add esp, 4
test bl, bl
mov ebx, dword [esi + 8]
je 0x5d9b68
jmp 0x5d9b81
push 0x4c
push str.crypto_getenv.c
push edi
call fcn.005db000
xor edx, edx
add esp, 0xc
xor ecx, ecx
mov eax, dword [esi + 0xc]
cmp dword [eax], 0xdddd
je 0x5d9b2a
test dl, dl
jne 0x5d9b81
cmp dword [ebx - 8], 0xdddd
jne 0x5d9b81
add ebx, 0xfffffff8
push ebx
mov edi, ecx
call fcn.00786dc0
mov ecx, edi
add esp, 4
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret