Function at 0x61527260
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x54]
mov edx, dword [eax]
test edx, edx
je 0x615274a2
mov esi, 0xd8f20c5b
mov edi, 0x6589f551
nop
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
add eax, dword [ecx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
add ebp, dword [eax]
mov ecx, eax
mov eax, dword [esp + 0x50]
mov ebx, dword [ebp]
add eax, dword [ecx + 0x10]
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x6152748f
lea esi, [esi]
movzx eax, byte [0x615ef860]
test al, al
je 0x615274ea
mov dword [esp], 0x615f1fe8
mov dword [0x615f1fe8], esi
mov dword [0x615f1fec], edi
mov byte [0x615f1ff0], 0x5b
call fcn.6152b7e0
movzx eax, byte [0x615ef828]
test al, al
je 0x61527650
mov dword [esp], 0x615f1f78
mov dword [0x615f1f78], esi
mov dword [0x615f1f7c], edi
mov byte [0x615f1f80], 0x5b
call fcn.6152b7e0
movzx eax, byte [0x615ef830]
test al, al
je 0x615276e0
mov dword [esp], 0x615f1f88
mov dword [0x615f1f88], esi
mov dword [0x615f1f8c], edi
mov byte [0x615f1f90], 0x5b
call fcn.6152b7e0
mov dword [esp + 0x2c], 0x2d200e06
movzx eax, byte [0x615ef838]
test al, al
je 0x61527698
mov dword [esp], 0x615f1f98
mov dword [0x615f1f98], esi
mov dword [0x615f1f9c], edi
mov byte [0x615f1fa0], 0x5b
call sub.msvcrt.dll_getenv
test eax, eax
je 0x6152738a
lea eax, [esp + 0x2c]
call eax
movzx eax, byte [0x615ef840]
test al, al
je 0x61527608
mov dword [esp], 0x615f1fa8
mov dword [0x615f1fa8], esi
mov dword [0x615f1fac], edi
mov byte [0x615f1fb0], 0x5b
call fcn.6152b7e0
movzx eax, byte [0x615ef848]
test al, al
je 0x615275c0
mov dword [esp], 0x615f1fb8
mov dword [0x615f1fb8], esi
mov dword [0x615f1fbc], edi
mov byte [0x615f1fc0], 0x5b
call fcn.6152b7e0
movzx eax, byte [0x615ef850]
test al, al
je 0x61527578
mov dword [esp], 0x615f1fc8
mov dword [0x615f1fc8], esi
mov dword [0x615f1fcc], edi
mov byte [0x615f1fd0], 0x5b
call fcn.6152b7e0
mov dword [esp + 0x2c], 0x4130160a
movzx eax, byte [0x615ef858]
test al, al
je 0x61527530
mov dword [esp], 0x615f1fd8
mov dword [0x615f1fd8], esi
mov dword [0x615f1fdc], edi
mov byte [0x615f1fe0], 0x5b
call sub.msvcrt.dll_getenv
test eax, eax
je 0x61527454
lea eax, [esp + 0x2c]
call eax
test ebx, ebx
js 0x615274b0
mov eax, dword [esp + 0x50]
add ebp, 4
lea eax, [eax + ebx + 2]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov ebx, dword [ebp]
add edx, 4
mov dword [esp + 0x18], edx
test ebx, ebx
jne 0x615272c0
add dword [esp + 0x54], 0x14
mov eax, dword [esp + 0x54]
mov eax, dword [eax]
test eax, eax
jne 0x61527280
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], ebx
add ebp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov ebx, dword [ebp]
add ecx, 4
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x6152748f
movzx eax, byte [0x615ef860]
test al, al
jne 0x615272cf
mov dword [esp], 0x615ef860
call fcn.615dfad0
test eax, eax
je 0x615272cf
mov dword [esp], 0x615e1010
mov dword [0x615f1fe8], esi
mov dword [0x615f1fec], edi
mov byte [0x615f1ff0], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef860
call fcn.615dfba0
jmp 0x615272cf
mov dword [esp], 0x615ef858
call fcn.615dfad0
test eax, eax
je 0x6152742b
mov dword [esp], 0x615e1080
mov dword [0x615f1fd8], esi
mov dword [0x615f1fdc], edi
mov byte [0x615f1fe0], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef858
call fcn.615dfba0
jmp 0x6152742b
mov dword [esp], 0x615ef850
call fcn.615dfad0
test eax, eax
je 0x615273f5
mov dword [esp], 0x615e1070
mov dword [0x615f1fc8], esi
mov dword [0x615f1fcc], edi
mov byte [0x615f1fd0], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef850
call fcn.615dfba0
jmp 0x615273f5
mov dword [esp], 0x615ef848
call fcn.615dfad0
test eax, eax
je 0x615273c7
mov dword [esp], 0x615e1060
mov dword [0x615f1fb8], esi
mov dword [0x615f1fbc], edi
mov byte [0x615f1fc0], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef848
call fcn.615dfba0
jmp 0x615273c7
mov dword [esp], 0x615ef840
call fcn.615dfad0
test eax, eax
je 0x61527399
mov dword [esp], 0x615e1050
mov dword [0x615f1fa8], esi
mov dword [0x615f1fac], edi
mov byte [0x615f1fb0], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef840
call fcn.615dfba0
jmp 0x61527399
mov dword [esp], 0x615ef828
call fcn.615dfad0
test eax, eax
je 0x615272fd
mov dword [esp], 0x615e1020
mov dword [0x615f1f78], esi
mov dword [0x615f1f7c], edi
mov byte [0x615f1f80], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef828
call fcn.615dfba0
jmp 0x615272fd
mov dword [esp], 0x615ef838
call fcn.615dfad0
test eax, eax
je 0x61527361
mov dword [esp], 0x615e1040
mov dword [0x615f1f98], esi
mov dword [0x615f1f9c], edi
mov byte [0x615f1fa0], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef838
call fcn.615dfba0
jmp 0x61527361
mov dword [esp], 0x615ef830
call fcn.615dfad0
test eax, eax
je 0x6152732b
mov dword [esp], 0x615e1030
mov dword [0x615f1f88], esi
mov dword [0x615f1f8c], edi
mov byte [0x615f1f90], 0x5b
call fcn.615013c0
mov dword [esp], 0x615ef830
call fcn.615dfba0
jmp 0x6152732b