Function at 0x4256bb
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x460a98
call fcn.0042c2e0
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
call fcn.0043c566
xor edi, edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.0043c566
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043c566
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0043c566
mov ecx, dword [esi + 4]
push dword [ebp + 8]
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, eax
call fcn.0041e947
mov ebx, eax
mov eax, dword [ebp + 0xc]
sub eax, 0x803
je 0x4258d6
dec eax
jne 0x425aa2
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.00403825
mov ecx, dword [esi + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.00427438
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.0043c7aa
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0043c6b1
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], edi
je 0x425aa2
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.004271ae
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 7
call fcn.0043c7aa
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0043c6b1
mov eax, dword [ebp - 0x10]
mov edi, 0xa00
mov esi, 0xe00
cmp dword [eax - 8], 0
je 0x4258b3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
call fcn.004274b6
cmp eax, 2
push 0xffffffffffffffff
jne 0x42586a
push 3
mov ecx, ebx
call fcn.00403825
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp + 8], eax
inc eax
push eax
lea ecx, [ebp - 0x14]
call fcn.0043caa1
push dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0043caf0
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x14]
add ecx, 0x18
push eax
mov dword [ebp + 8], ecx
call fcn.0041e076
mov ecx, dword [ebp + 8]
push 0x805
call fcn.0041e106
mov ecx, dword [ebp + 8]
push 0x903
call fcn.0041e117
mov ecx, dword [ebp + 8]
push edi
call fcn.0041e139
mov ecx, dword [ebp + 8]
push esi
call fcn.0041e128
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x10]
add ecx, 0x30
push eax
mov dword [ebp + 8], ecx
call fcn.0041e076
mov ecx, dword [ebp + 8]
push 0x805
call fcn.0041e106
mov ecx, dword [ebp + 8]
push 0x902
call fcn.0041e117
mov ecx, dword [ebp + 8]
push edi
call fcn.0041e139
mov ecx, dword [ebp + 8]
push esi
jmp 0x4258ac
push 2
mov ecx, ebx
call fcn.00403825
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x10]
add ecx, 0x18
push eax
mov dword [ebp + 8], ecx
call fcn.0041e076
mov ecx, dword [ebp + 8]
push 0x805
call fcn.0041e106
mov ecx, dword [ebp + 8]
push 0x903
call fcn.0041e117
mov ecx, dword [ebp + 8]
push edi
call fcn.0041e139
mov ecx, dword [ebp + 8]
push esi
call fcn.0041e128
jmp 0x4258be
push 0xffffffffffffffff
push 1
mov ecx, ebx
call fcn.00403825
mov ebx, dword [ebx + 4]
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.0041e076
push 0x804
jmp 0x425a7f
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.00403825
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.00427189
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.0043c7aa
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.0043c6b1
mov eax, dword [ebp - 0x1c]
lea ecx, [esi + 1]
cmp eax, ecx
mov edi, 0xa00
mov esi, 0xe00
je 0x425a6c
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [eax + 0xc]
call fcn.004271ae
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.0043c7aa
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0043c6b1
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x425a61
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
call fcn.004274b6
cmp eax, 2
push 0xffffffffffffffff
jne 0x425a18
push 3
mov ecx, ebx
call fcn.00403825
push 0
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp + 8], eax
inc eax
push eax
lea ecx, [ebp - 0x14]
call fcn.0043caa1
push dword [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0043caf0
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x14]
add ecx, 0x18
push eax
mov dword [ebp + 8], ecx
call fcn.0041e076
mov ecx, dword [ebp + 8]
push 0x805
call fcn.0041e106
mov ecx, dword [ebp + 8]
push 0x903
call fcn.0041e117
mov ecx, dword [ebp + 8]
push edi
call fcn.0041e139
mov ecx, dword [ebp + 8]
push esi
call fcn.0041e128
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x10]
add ecx, 0x30
push eax
mov dword [ebp + 8], ecx
call fcn.0041e076
mov ecx, dword [ebp + 8]
push 0x805
call fcn.0041e106
mov ecx, dword [ebp + 8]
push 0x902
call fcn.0041e117
mov ecx, dword [ebp + 8]
push edi
call fcn.0041e139
mov ecx, dword [ebp + 8]
push esi
jmp 0x425a5a
push 2
mov ecx, ebx
call fcn.00403825
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x10]
add ecx, 0x18
push eax
mov dword [ebp + 8], ecx
call fcn.0041e076
mov ecx, dword [ebp + 8]
push 0x805
call fcn.0041e106
mov ecx, dword [ebp + 8]
push 0x903
call fcn.0041e117
mov ecx, dword [ebp + 8]
push edi
call fcn.0041e139
mov ecx, dword [ebp + 8]
push esi
call fcn.0041e128
jmp 0x425a6c
push 0xffffffffffffffff
push 1
mov ecx, ebx
call fcn.00403825
mov ebx, dword [ebx + 4]
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.0041e076
push 0x803
mov ecx, ebx
call fcn.0041e106
push 0x100
mov ecx, ebx
call fcn.0041e117
push edi
mov ecx, ebx
call fcn.0041e139
push esi
mov ecx, ebx
call fcn.0041e128
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0043c6b1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043c6b1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0043c6b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043c6b1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 8