Function at 0xf04c98c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xf04c9a3
xor eax, eax
jmp 0xf04caeb
push ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
cmp word [eax], si
jne 0xf04c9ba
cmp word [eax + 2], si
je 0xf04c9be
inc eax
inc eax
jmp 0xf04c9af
sub eax, ebx
sar eax, 1
lea esi, [eax + eax + 4]
push edi
push esi
call fcn.0f006f83
mov edi, eax
test edi, edi
pop ecx
jne 0xf04c9db
xor eax, eax
jmp 0xf04cae9
push esi
push ebx
push edi
call fcn.0f01ca60
add esp, 0xc
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.ntdll.dll_RtlCreateEnvironment]
test eax, eax
jl 0xf04caf9
cmp word [edi], bx
mov dword [ebp - 8], ebx
mov esi, edi
je 0xf04caa3
cmp word [esi], 0x3d
jne 0xf04ca31
lea eax, [esi + 2]
push 0x3d
push eax
call fcn.0f056ad1
cmp eax, ebx
pop ecx
pop ecx
je 0xf04ca8f
mov ecx, eax
sub ecx, esi
sar ecx, 1
shl ecx, 1
mov word [ebp - 0x14], cx
add eax, 2
jmp 0xf04ca59
cmp dword [ebp - 0xc], ebx
jne 0xf04ca8f
push 8
push 0xf00388c
push esi
call fcn.0f056a2c
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
je 0xf04ca8f
mov word [ebp - 0x14], 0xe
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
test eax, eax
jl 0xf04caf0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
push esi
call fcn.0f056a0d
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
pop ecx
jne 0xf04ca09
push edi
call fcn.0f00579c
mov edi, dword [ebp + 8]
mov dword [0xf0773a0], ebx
cmp byte [edi], 0
pop ecx
jne 0xf04cb08
mov eax, dword [ebp - 8]
add eax, 2
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
push 1
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
pop esi
leave
ret 8
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
push edi
call fcn.0f00579c
pop ecx
jmp 0xf04c9d4
mov edi, dword [ebp + 8]
push edi
call sym.ntvdm.exe_cmdCheckTemp
test eax, eax
je 0xf04cb2d
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xf04cb22
sub eax, ecx
jmp 0xf04cb3c
push edi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
movzx eax, word [ebp - 0x2c]
test ebx, ebx
mov dword [ebp + 8], eax
jne 0xf04cb5c
push 8
push str.COMSPEC
push edi
call fcn.0f008064
add esp, 0xc
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jne 0xf04cbd4
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jl 0xf04cbec
push 0x3d
push dword [ebp - 0x20]
call fcn.0f056ad1
test eax, eax
pop ecx
pop ecx
je 0xf04cbd4
mov ecx, dword [ebp - 0x20]
mov edx, eax
sub edx, ecx
add eax, 2
push eax
sar edx, 1
lea eax, [ebp - 0x1c]
shl edx, 1
push eax
mov dword [ebp - 0x10], ecx
mov word [ebp - 0x14], dx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
jl 0xf04cbec
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea eax, [edi + eax + 1]
cmp byte [eax], 0
mov dword [ebp + 8], eax
jne 0xf04cb05
jmp 0xf04cab8
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
jmp 0xf04c9d4