Function at 0x76b50d7d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
push edi
test eax, eax
jne 0x76b50db6
call sym.msvcrt.dll__errno
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call sym.msvcrt.dll__invalid_parameter
add esp, 0x14
or eax, 0xffffffff
jmp 0x76b5107f
mov ebx, dword [eax]
push esi
test ebx, ebx
je 0x76b51070
push 0x3d
push ebx
call sym.msvcrt.dll_wcschr
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
pop ecx
test esi, esi
je 0x76b51070
cmp ebx, esi
je 0x76b51070
movzx ecx, word [esi + 2]
mov edi, dword [sym.msvcrt.dll__wenviron]
mov edx, ecx
mov eax, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
cmp edi, dword [sym.msvcrt.dll___winitenv]
jne 0x76b50e0e
push edi
call fcn.76b51089
mov edx, dword [ebp - 0x10]
mov edi, eax
pop ecx
mov dword [sym.msvcrt.dll__wenviron], edi
test edi, edi
jne 0x76b50e6f
mov eax, dword [sym.msvcrt.dll__environ]
cmp dword [ebp + 0xc], edi
je 0x76b50ec3
test eax, eax
je 0x76b50ec3
call fcn.76b4df94
mov dword [0x76baaab8], eax
call fcn.76b595ad
push dword [sym.msvcrt.dll__wenviron]
mov esi, eax
call fcn.76b51089
mov edi, eax
mov dword [sym.msvcrt.dll__wenviron], edi
pop ecx
test esi, esi
jns 0x76b50e64
call fcn.76b4de73
test eax, eax
jne 0x76b51070
mov edi, dword [sym.msvcrt.dll__wenviron]
mov esi, dword [ebp - 4]
test edi, edi
je 0x76b5107b
sub esi, ebx
sar esi, 1
push esi
push ebx
mov dword [ebp - 4], esi
call fcn.76b510f1
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x76b50f4f
xor ecx, ecx
cmp dword [edi], ecx
je 0x76b50f4f
mov eax, dword [edi + esi*4]
cmp eax, dword [sym.msvcrt.dll___winitenv]
jb 0x76b50ea6
cmp eax, dword [0x76babc94]
jbe 0x76b50eaf
push eax
call sym.msvcrt.dll_free
pop ecx
xor ecx, ecx
cmp word [ebp - 8], 0
je 0x76b50f23
mov dword [edi + esi*4], ebx
mov edi, dword [ebp + 8]
mov dword [edi], ecx
jmp 0x76b50fa2
test dx, dx
je 0x76b5106c
test eax, eax
jne 0x76b50ef7
push 4
call fcn.76b38776
mov dword [sym.msvcrt.dll__environ], eax
pop ecx
test eax, eax
je 0x76b5107b
xor ecx, ecx
mov dword [eax], ecx
mov edi, dword [sym.msvcrt.dll__wenviron]
test edi, edi
jne 0x76b50e6f
push 4
call fcn.76b38776
mov dword [sym.msvcrt.dll__wenviron], eax
pop ecx
test eax, eax
je 0x76b5107b
xor ecx, ecx
mov dword [eax], ecx
mov edi, dword [sym.msvcrt.dll__wenviron]
jmp 0x76b50e67
mov eax, dword [edi + esi*4 + 4]
mov dword [edi + esi*4], eax
inc esi
cmp dword [edi + esi*4], ecx
jne 0x76b50f1b
cmp esi, 0x3fffffff
jae 0x76b50f9f
push 4
push esi
push dword [sym.msvcrt.dll__wenviron]
call fcn.76b38811
mov edi, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x76b50fa2
mov dword [sym.msvcrt.dll__wenviron], eax
jmp 0x76b50fa2
cmp word [ebp - 8], 0
je 0x76b5105e
test esi, esi
jns 0x76b50f60
neg esi
lea eax, [esi + 2]
cmp eax, esi
jl 0x76b5107b
cmp eax, 0x3fffffff
jae 0x76b5107b
push eax
push 4
push dword [sym.msvcrt.dll__wenviron]
call fcn.76b38811
add esp, 0xc
test eax, eax
je 0x76b5107b
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + esi*4], ebx
mov dword [eax + esi*4 + 4], ecx
mov dword [edi], ecx
jmp 0x76b50f48
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
je 0x76b51047
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x76b50fb3
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 2]
push eax
call fcn.76b38729
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x76b51047
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x76b50fda
sub ecx, edx
sar ecx, 1
push ebx
lea eax, [ecx + 2]
push eax
push esi
call sym.msvcrt.dll_wcscpy_s
add esp, 0xc
test eax, eax
je 0x76b5100b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.76b4977b
add esp, 0x14
mov eax, dword [ebp - 4]
lea ecx, [esi + eax*2]
xor eax, eax
mov word [ecx], ax
add ecx, 2
mov eax, dword [ebp - 8]
movzx eax, ax
neg eax
sbb eax, eax
and eax, ecx
push eax
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x76b51040
or dword [ebp - 0xc], 0xffffffff
call sym.msvcrt.dll__errno
mov dword [eax], 0x2a
push esi
call sym.msvcrt.dll_free
pop ecx
cmp word [ebp - 8], 0
jne 0x76b51059
push ebx
call sym.msvcrt.dll_free
xor eax, eax
pop ecx
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
jmp 0x76b5107e
push ebx
call sym.msvcrt.dll_free
mov edi, dword [ebp + 8]
xor eax, eax
pop ecx
mov dword [edi], eax
xor eax, eax
jmp 0x76b5107e
call sym.msvcrt.dll__errno
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret