Function at 0x425780
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x110
call fcn.0041f0e0
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4259f6
mov dword [esp], eax
mov edi, eax
call sub.msvcrt.dll_strlen
mov ebx, eax
lea eax, [eax + 8]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 8], ebx
mov esi, eax
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [0x4342f0], eax
call sub.msvcrt.dll_memcpy
mov dword [esi + ebx], 0x776a2e2f
mov dword [esi + ebx + 4], 0x63726d
cmp dword [ebp + 8], 1
jle 0x425a2e
mov dword [esp + 0x38], 0
mov ebx, 1
lea esi, [esi]
lea eax, [ebx*4]
mov ecx, 3
mov edi, 0x428ecf
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + ebx*4]
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4259b1
mov edi, 0x428ed2
mov ecx, 3
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4259bd
mov edi, 0x428ed5
mov ecx, 3
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x425940
mov edi, str._restart
mov ecx, 9
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x425960
mov edi, str._exit
mov ecx, 6
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x425970
mov edi, str._reload
mov ecx, 8
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x425980
mov edi, str._display
mov ecx, 9
mov esi, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42598a
mov dword [esp], edx
mov dword [esp + 4], 0x428ef8
mov dword [esp + 0x34], edx
call sub.msvcrt.dll_strcmp
test eax, eax
mov edx, dword [esp + 0x34]
jne 0x425992
add ebx, 1
cmp dword [ebp + 8], ebx
jle 0x425992
mov eax, dword [0x4342f0]
add ebx, 1
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x3c]
mov eax, dword [eax + edx + 4]
mov dword [esp], eax
call fcn.00410b30
cmp dword [ebp + 8], ebx
mov dword [0x4342f0], eax
jg 0x425800
cmp dword [esp + 0x38], 2
je 0x425a1d
jbe 0x4259de
mov eax, dword [esp + 0x38]
cmp eax, 3
je 0x425a0c
cmp eax, 4
jne 0x425a2e
call fcn.00410120
mov eax, dword [0x4342f0]
mov dword [esp], eax
call fcn.00416850
xor eax, eax
call fcn.004101c0
lea esi, [esi]
mov dword [esp + 0x38], 4
add ebx, 1
cmp dword [ebp + 8], ebx
jg 0x425800
jmp 0x4258fa
mov dword [esp + 0x38], 1
jmp 0x425948
mov dword [esp + 0x38], 2
jmp 0x425948
mov dword [esp + 0x38], 3
jmp 0x425948
add ebx, 1
cmp dword [ebp + 8], ebx
jg 0x4259c9
mov dword [esp + 4], edx
mov dword [esp], str.unrecognized_option:__s_n
call fcn.004100d0
call fcn.0040cf10
mov eax, 1
call fcn.004101c0
call fcn.0040ced0
xor eax, eax
call fcn.004101c0
call fcn.0040cf10
xor eax, eax
call fcn.004101c0
mov eax, dword [ebp + 0xc]
mov edx, dword [esp + 0x3c]
mov eax, dword [eax + edx + 4]
mov dword [0x434308], eax
jmp 0x425948
cmp dword [esp + 0x38], 1
jne 0x425a2e
mov eax, str._JWM_RESTART
call fcn.004102e0
xor eax, eax
call fcn.004101c0
mov dword [esp], str._.jwmrc
call fcn.00410b30
mov dword [0x4342f0], eax
jmp 0x4257e5
mov eax, str._JWM_RELOAD
call fcn.004102e0
xor eax, eax
call fcn.004101c0
mov eax, str._JWM_EXIT
call fcn.004102e0
xor eax, eax
call fcn.004101c0
mov byte [0x4342fd], 1
lea edi, [esp + 0x54]
call fcn.00410210
mov eax, dword [0x4357fc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.libX11_6.dll_XCreateSimpleWindow
mov dword [0x435814], eax
mov eax, dword [0x435810]
mov dword [esp + 8], str.WM_S_d
mov dword [esp + 4], 0x20
mov dword [esp], edi
mov dword [esp + 0xc], eax
call fcn.00410370
mov eax, dword [0x434304]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.libX11_6.dll_XInternAtom
mov dword [0x4357f0], eax
call fcn.0040c600
mov eax, dword [0x4357f0]
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XGetSelectionOwner
test eax, eax
mov dword [esp + 0x4c], eax
jne 0x425e52
mov eax, dword [0x435814]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [0x4357f0]
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XSetSelectionOwner
call fcn.0040c650
cmp dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x3c], eax
jne 0x425e14
lea ebx, [esp + 0xb0]
mov eax, dword [0x434304]
mov edx, dword [0x4357fc]
lea esi, [esp + 0x74]
mov dword [esp + 8], 0
mov dword [esp + 4], str.MANAGER
mov dword [esp + 0xb0], 0x21
mov dword [esp], eax
mov dword [esp + 0xc0], edx
mov dword [esp + 0xbc], eax
call sub.libX11_6.dll_XInternAtom
mov dword [esp + 0xc4], eax
mov eax, dword [0x4357f0]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x20000
mov dword [esp + 8], 0
mov dword [esp + 0xc8], 0x20
mov dword [esp + 0xd0], eax
mov eax, dword [0x435814]
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd8], 2
mov dword [esp + 0xdc], 0
mov dword [esp + 0xd4], eax
mov eax, dword [0x4357fc]
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XSendEvent
mov eax, dword [0x434304]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.libX11_6.dll_XSync
mov dword [esp], 0x40c1a0
call sub.libX11_6.dll_XSetErrorHandler
call sub.libX11_6.dll_XrmUniqueQuark
mov dword [0x43580c], eax
call sub.libX11_6.dll_XrmUniqueQuark
mov dword [0x4357ec], eax
mov eax, dword [0x4357fc]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x800
mov dword [esp + 0x9c], 0xda00cc
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XChangeWindowAttributes
lea eax, [esp + 0x50]
mov dword [esp + 0x4c], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XGetInputFocus
cmp dword [esp + 0x4c], 0
jne 0x425ca6
mov eax, dword [0x4357fc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XSetInputFocus
movzx eax, byte [0x4342ff]
mov byte [0x4342fd], 0
mov byte [0x4342fe], al
mov byte [0x434300], 0
mov byte [0x4342ff], 0
mov byte [0x4342fc], 0
call fcn.00410120
mov eax, dword [0x4342f0]
mov dword [esp], eax
call fcn.00416850
call fcn.0040c600
call fcn.00419c40
call fcn.004199f0
call fcn.00407af0
call fcn.0040c1f0
call fcn.00401cb0
call fcn.00408390
call fcn.004074c0
call fcn.0041de40
call fcn.00408870
call fcn.0040cf50
call fcn.004095e0
call fcn.0041ca50
call fcn.0040ef00
call fcn.004021c0
call fcn.00416dc0
call fcn.00406ac0
call fcn.00418230
call fcn.004195a0
mov eax, dword [0x4357fc]
mov dword [esp], eax
call fcn.004086a0
call fcn.0040e040
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XFlush
call fcn.0040c020
mov eax, dword [0x434304]
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.libX11_6.dll_XSync
call fcn.0040c650
call fcn.0041a6f0
call fcn.0041d630
call fcn.004042c0
mov eax, dword [0x4342f8]
mov dword [esp], eax
call fcn.00401ef0
call fcn.00408210
jmp 0x425db4
mov dword [esp], ebx
call fcn.0040aad0
test al, al
je 0x425db4
mov dword [esp], ebx
call fcn.00409d60
cmp byte [0x434300], 0
je 0x425da0
mov dword [esp], edi
call fcn.0041c190
mov eax, dword [0x434304]
mov dword [esp], eax
call sub.libX11_6.dll_XPending
test eax, eax
jne 0x425dfe
call fcn.0041aad0
test al, al
je 0x425e70
mov dword [esp], esi
call fcn.0041c190
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0041c1d0
cmp eax, 0x3e8
ja 0x425e70
mov dword [esp], ebx
call fcn.0040aad0
test al, al
je 0x425dc5
mov dword [esp], ebx
call fcn.00409d60
jmp 0x425dc5
mov dword [esp + 0xc], eax
mov eax, dword [0x434304]
lea ebx, [esp + 0xb0]
mov dword [esp + 8], 0x4100b0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.libX11_6.dll_XIfEvent
mov eax, dword [0x434304]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.libX11_6.dll_XSync
jmp 0x425b3d
mov dword [esp + 4], eax
mov eax, dword [0x434304]
mov dword [esp + 8], 0x20000
mov dword [esp], eax
call sub.libX11_6.dll_XSelectInput
jmp 0x425af7
call fcn.00418270
call fcn.0040f060
call fcn.00413190
call fcn.004096f0
call fcn.0041cca0
call fcn.0041b170
call fcn.00405810
call fcn.00401d40
call fcn.00408420
call fcn.0040c2f0
call fcn.004077c0
call fcn.00416e20
call fcn.00419a40
call fcn.00408250
call fcn.00410160
movzx eax, byte [0x4342ff]
test al, al
jne 0x425cb4
call fcn.004100f0
mov eax, dword [0x4342f4]
test eax, eax
je 0x425f27
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x428f14
mov dword [esp + 4], str._bin_sh
mov dword [esp], str._bin_sh
call sub.msvcrt.dll__execl
mov eax, dword [0x4342f4]
mov dword [esp + 4], str._bin_sh
mov dword [esp], str.exec_failed:___s___s
mov dword [esp + 8], eax
call fcn.0040c170
mov eax, 1
call fcn.004101c0
xor eax, eax
call fcn.004101c0
nop
nop
push ebp
mov ebp, esp
pop ebp
jmp fcn.00401500