Function at 0x40ec2e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov ebx, 0x2000
mov edi, 0x42e590
push ebx
mov esi, ecx
xor eax, eax
push edi
push esi
mov word [0x42e590], ax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40ec64
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x436755], 0
je 0x40ed1d
push 0x402394
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed61
push 0x40239c
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed47
push 0x4023d8
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed7f
push 0x4023c0
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddef
push 0x4023b4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed71
push 0x4023f4
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40ed24
push 0x4024ac
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41ddfa
push 0x402480
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41de06
xor eax, eax
jmp 0x40ec5d
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00409310
add eax, eax
cmp eax, 0x4000
jae 0x40ed83
xor ecx, ecx
mov word [eax + 0x42e590], cx
jmp 0x40ec5b
push dword [0x4365dc]
push 0x402050
push ebx
push edi
call fcn.00409abf
add esp, 0x10
jmp 0x40ec5b
push 0
mov edx, ebx
mov ecx, edi
call fcn.00408e9e
jmp 0x40ec5b
push ebx
xor edx, edx
xor ecx, ecx
push edi
inc edx
call fcn.00406854
jmp 0x40ed30
push 2
jmp 0x40ed4d
call fcn.00416c78
int3
add dword [ebx - 0x30], ebp
sub byte [ebx + 0x4c8bf845], cl
or byte [ebx + ecx*4], dl
inc ebp
clc
mov eax, dword [ebp - 8]
add ecx, dword [eax + edx + 0x10]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x38]
mov dword [ecx + 0x48], eax
push 0x28
or byte [ebx + 0x428bf455], cl
cmp byte [ecx + 0x286a4841], cl
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
imul eax, edx, 0x28
add eax, dword [ebp - 8]
push eax
call fcn.00416d73
add esp, 8
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x29], 0
push 8
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx + 2]
imul ecx, eax, 0x28
add ecx, dword [ebp - 8]
push ecx
call fcn.00417331
add esp, 0xc
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004213b0
add esp, 0xc
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
imul edx, ecx, 0x28
mov ecx, dword [ebp - 8]
mov dword [ecx + edx + 8], eax
mov edx, dword [ebp - 4]
movzx eax, word [edx + 2]
sub eax, 1
imul ecx, eax, 0x28
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
sub ecx, 1
imul edx, ecx, 0x28
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx + 8]
push ecx
call fcn.004213b0
add esp, 0xc
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
imul edx, ecx, 0x28
mov ecx, dword [ebp - 8]
mov dword [ecx + edx + 0xc], eax
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004213b0
add esp, 0xc
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
imul edx, ecx, 0x28
mov ecx, dword [ebp - 8]
mov dword [ecx + edx + 0x10], eax
mov edx, dword [ebp - 4]
movzx eax, word [edx + 2]
sub eax, 1
imul ecx, eax, 0x28
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
sub ecx, 1
imul edx, ecx, 0x28
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx + 0x10]
push ecx
call fcn.004213b0
add esp, 0xc
mov edx, dword [ebp - 4]
movzx ecx, word [edx + 2]
imul edx, ecx, 0x28
mov ecx, dword [ebp - 8]
mov dword [ecx + edx + 0x14], eax
mov edx, dword [ebp - 4]
movzx eax, word [edx + 2]
imul ecx, eax, 0x28
mov edx, dword [ebp - 8]
mov dword [edx + ecx + 0x24], 0xe00000e0
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
imul edx, ecx, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
imul edx, ecx, 0x28
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
imul edx, ecx, 0x28
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
imul eax, ecx, 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx + 0x14]
mov ecx, dword [ebp - 8]
add edx, dword [ecx + eax + 0x10]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
push edx
push 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0xfc]
call eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
imul eax, edx, 0x28
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 2]
imul ecx, edx, 0x28
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax + 0xc]
mov edx, dword [ebp - 8]
add eax, dword [edx + ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 4]
movzx eax, word [edx + 2]
add eax, 1
mov ecx, dword [ebp - 4]
mov word [ecx + 2], ax
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00417331
add esp, 0xc
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov al, 1
mov esp, ebp
pop ebp
ret