Function at 0x407c9c
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2ef8
call fcn.00413d20
mov eax, dword [0x455834]
xor eax, esp
mov dword [esp + 0x2ef4], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2f0c]
mov esi, 0x2ee0
push esi
call fcn.004137f4
mov ebx, eax
xor eax, eax
push eax
push dword [esp + 0x2f18]
mov dword [esp + 0x28], ebx
push 0x441a18
push ebx
call fcn.00404329
push esi
call fcn.004137f4
add esp, 0x18
mov ebp, eax
cmp byte [esp + 0x2f10], 0
mov dword [esp + 0x10], ebp
je 0x407d29
push 0x1770
call fcn.004137f4
mov esi, eax
push esi
call fcn.00404b95
push esi
push 0x44076c
push ebp
call fcn.00403b2b
push 1
push esi
call fcn.004137e6
add esp, 0x1c
jmp 0x407d33
push 1
push ebp
call fcn.00404bd4
pop ecx
pop ecx
push ebx
push 0x4428e0
push edi
call fcn.004076da
push ebx
push 0x442900
push edi
call fcn.004076da
mov esi, 0x4623a0
push esi
push 0x442928
push edi
call fcn.00407759
push esi
push 0x442948
push edi
call fcn.00407759
mov esi, 0x4412fc
push esi
push 0x442970
push edi
call fcn.004076da
push esi
push 0x4429a8
push edi
call fcn.004076da
add esp, 0x48
mov esi, 0x460bb8
push esi
push 0x4429e8
push edi
call fcn.00407759
push esi
push 0x442a0c
push edi
call fcn.00407759
push ebx
push 0x442a38
push edi
call fcn.004076da
push ebx
push 0x442a58
push edi
call fcn.004076da
push 0x4623a0
push 0x442a80
push edi
call fcn.00407759
push 0x4623a0
push 0x442aa4
push edi
call fcn.00407759
add esp, 0x48
push 0x4412fc
push 0x442ad0
push edi
call fcn.004076da
push 0x4412fc
push 0x442b08
push edi
call fcn.004076da
push esi
push 0x442b48
push edi
call fcn.00407759
push esi
push 0x442b6c
push edi
call fcn.00407759
push ebx
push 0x442b98
push edi
call fcn.004076da
push 0x4623a0
push 0x442be0
push edi
call fcn.00407759
add esp, 0x48
push 0x4412fc
push 0x442c30
push edi
call fcn.004076da
push esi
push 0x442c74
push edi
call fcn.00407759
push ebp
push 0x442ca4
push edi
call fcn.004076da
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [esp + 0x20], eax
push 2
pop esi
test eax, eax
je 0x407f35
xor ecx, ecx
mov ebp, eax
cmp word [eax], cx
je 0x407f31
push esi
pop ebx
push ebp
call fcn.0041f337
xor ecx, ecx
inc eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004137f4
mov esi, eax
push ebp
push esi
mov dword [esp + 0x28], esi
call fcn.0041f1f3
push 0x3d
push esi
call fcn.0041592b
add esp, 0x18
mov dword [esp + 0x14], eax
test eax, eax
je 0x407f03
xor ecx, ecx
push esi
mov word [eax], cx
lea eax, [esp + 0x28]
push 0x442cd4
push eax
call fcn.00403b2b
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x30]
add esi, 2
push esi
push eax
push edi
call fcn.004076da
lea eax, [esp + 0x3c]
push eax
call fcn.00425a9a
push esi
lea eax, [esp + 0x44]
push eax
push edi
call fcn.004076da
mov esi, dword [esp + 0x40]
add esp, 0x28
push ebp
call fcn.0041f337
push ebx
push esi
lea ebp, [ebp + eax*2]
add ebp, 2
call fcn.004137e6
xor eax, eax
add esp, 0xc
cmp word [ebp], ax
jne 0x407e86
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push 2
pop esi
mov ebp, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
push ebx
call fcn.004137e6
push esi
push ebp
call fcn.004137e6
mov ecx, dword [esp + 0x2f14]
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00413c4b
add esp, 0x2ef8
ret