Function at 0x632540
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x48
mov edx, 0xfffffffc
mov eax, dword [0x7adbc0]
mov esi, 0xfffffffd
xor eax, ebp
mov ebx, 0x7fcea0
mov dword [ebp - 0x10], eax
mov edi, 0x7fd060
movzx eax, byte [0x7fd201]
and eax, 0xffffffe7
mov dword [0x7fcfc4], edx
add eax, 8
mov dword [0x7fcec8], edx
movzx ecx, byte [0x7fd041]
mov byte [0x7fd201], al
and ecx, 0xffffffe7
movzx edx, byte [0x7fd3c1]
add ecx, 8
movzx eax, byte [0x7fd581]
and edx, 0xffffffe7
and eax, 0xffffffe7
add edx, 8
mov dword [0x7fd184], esi
add eax, 8
mov dword [0x7fd088], esi
mov esi, 0xfffffffe
mov byte [0x7fd041], cl
mov ecx, 0x7fd220
mov dword [0x7f6c4c], ebx
mov dword [0x22df8e8], ebx
mov ebx, 0xffffffff
mov dword [0x7f6c74], edi
mov dword [0x22df8ec], edi
mov edi, str.FORT_d
mov byte [0x7fd3c1], dl
mov edx, 0x7fd3e0
mov dword [0x7fd504], esi
mov dword [0x7fd408], esi
xor esi, esi
mov dword [0x7fd344], ebx
mov dword [0x7fd248], ebx
mov dword [0x7f6cc4], ecx
mov dword [0x22df8f4], ecx
mov byte [0x7fd581], al
mov dword [0x7f6c9c], edx
mov dword [0x22df8f0], edx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], esi
call fcn.00692c20
mov edx, eax
lea eax, [ebp - 0x50]
push eax
push esi
push edi
push ebx
mov ecx, dword [edx]
lea ebx, [ebp - 0x30]
push ebx
push dword [edx + 4]
or ecx, 1
push ecx
call fcn.006bd03d
add esp, 0x1c
push esi
push esi
push ebx
mov dword [0x7fd6c4], esi
mov dword [0x7fd5c8], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x632677
jne 0x632677
mov edx, 1
jmp 0x63267c
mov edx, 2
movzx eax, byte [0x7fd741]
shl edx, 3
and eax, 0xffffffe7
or eax, edx
mov edx, 0x7fd5a0
mov byte [0x7fd741], al
mov dword [0x7f6cec], edx
mov dword [0x22df8f8], edx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 5
call fcn.00692c20
mov edx, eax
lea eax, [ebp - 0x44]
push eax
push 0
push edi
push 0xffffffffffffffff
push ebx
mov ecx, dword [edx]
push dword [edx + 4]
or ecx, 1
push ecx
call fcn.006bd03d
add esp, 0x1c
push esi
push esi
mov eax, 5
push ebx
mov dword [0x7fd884], eax
mov dword [0x7fd788], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x6326f2
jne 0x6326f2
mov edx, 1
jmp 0x6326f7
mov edx, 2
movzx eax, byte [0x7fd901]
shl edx, 3
and eax, 0xffffffe7
or eax, edx
mov edx, 0x7fd760
mov byte [0x7fd901], al
mov dword [0x7f6db4], edx
mov dword [0x22df90c], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 6
call fcn.00692c20
mov edx, eax
lea eax, [ebp - 0x38]
push eax
push 0
push edi
push 0xffffffffffffffff
push ebx
mov ecx, dword [edx]
push dword [edx + 4]
or ecx, 1
push ecx
call fcn.006bd03d
add esp, 0x1c
push esi
push esi
mov eax, 6
push ebx
mov dword [0x7fda44], eax
mov dword [0x7fd948], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x63276d
jne 0x63276d
mov eax, 1
jmp 0x632772
mov eax, 2
movzx edx, byte [0x7fdac1]
shl eax, 3
and edx, 0xffffffe7
or edx, eax
mov eax, 0x7fd920
mov byte [0x7fdac1], dl
mov dword [0x7f6ddc], eax
mov dword [0x22df910], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
xor ecx, ebp
cmp ecx, dword [0x7adbc0]
jne 0x6327b2
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
call fcn.00693023
mov esi, esi
lea edi, [edi]