Function at 0xf04d1ce
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xf04d1e5
xor eax, eax
jmp 0xf04d32d
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
cmp word [eax], si
jne 0xf04d1fc
cmp word [eax + 2], si
je 0xf04d200
inc eax
inc eax
jmp 0xf04d1f1
sub eax, ebx
sar eax, 1
lea esi, [eax + eax + 4]
push edi
push esi
call fcn.0f0070c9
mov edi, eax
test edi, edi
pop ecx
jne 0xf04d21d
xor eax, eax
jmp 0xf04d32b
push esi
push ebx
push edi
call fcn.0f01cfc0
add esp, 0xc
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateEnvironment]
test eax, eax
jl 0xf04d33b
cmp word [edi], bx
mov dword [ebp - 8], ebx
mov esi, edi
je 0xf04d2e5
cmp word [esi], 0x3d
jne 0xf04d273
lea eax, [esi + 2]
push 0x3d
push eax
call fcn.0f0573a1
cmp eax, ebx
pop ecx
pop ecx
je 0xf04d2d1
mov ecx, eax
sub ecx, esi
sar ecx, 1
shl ecx, 1
mov word [ebp - 0x14], cx
add eax, 2
jmp 0xf04d29b
cmp dword [ebp - 0xc], ebx
jne 0xf04d2d1
push 8
push 0xf003954
push esi
call fcn.0f0572fc
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
je 0xf04d2d1
mov word [ebp - 0x14], 0xe
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
test eax, eax
jl 0xf04d332
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
push esi
call fcn.0f0572dd
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
pop ecx
jne 0xf04d24b
push edi
call fcn.0f0058e2
mov edi, dword [ebp + 8]
mov dword [0xf078498], ebx
cmp byte [edi], 0
pop ecx
jne 0xf04d34a
mov eax, dword [ebp - 8]
add eax, 2
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
push 1
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
pop esi
leave
ret 8
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
push edi
call fcn.0f0058e2
pop ecx
jmp 0xf04d216
mov edi, dword [ebp + 8]
push edi
call sym.ntvdm.exe_cmdCheckTemp
test eax, eax
je 0xf04d36f
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf04d364
sub eax, ecx
jmp 0xf04d37e
push edi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
movzx eax, word [ebp - 0x2c]
test ebx, ebx
mov dword [ebp + 8], eax
jne 0xf04d39e
push 8
push str.COMSPEC
push edi
call fcn.0f0081aa
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0xf04d416
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jl 0xf04d42e
push 0x3d
push dword [ebp - 0x20]
call fcn.0f0573a1
test eax, eax
pop ecx
pop ecx
je 0xf04d416
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
add eax, 2
push eax
sar edx, 1
lea eax, [ebp - 0x1c]
shl edx, 1
push eax
mov dword [ebp - 0x10], ecx
mov word [ebp - 0x14], dx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
jl 0xf04d42e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea eax, [edi + eax + 1]
cmp byte [eax], 0
mov dword [ebp + 8], eax
jne 0xf04d347
jmp 0xf04d2fa
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
jmp 0xf04d216