Function at 0x416be8
Capabilities:
Query environment variable

Disassembly:
push 8
mov eax, 0x57c6b6
call fcn.0054d3c4
mov ebx, dword [ebp + 8]
push ebx
call fcn.0041784b
mov edi, dword [ebp + 0xc]
mov edx, eax
pop ecx
push 0xc
pop esi
mov ecx, dword [edi]
dec ecx
cmp ecx, esi
ja case.0x416c11.5
jmp dword [ecx*4 + 0x4170b0]
cmp dword [edi + 4], 0xc350
jne 0x416c33
push ebx
call fcn.004171f4
pop ecx
test al, al
je 0x416c33
push 0
jmp 0x417096
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f054
push 0x2710
push ebx
mov dword [ebp - 4], 1
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416c62
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 2
test eax, eax
je case.0x416c11.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp case.0x416c11.5
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f064
push 0x271f
push ebx
mov dword [ebp - 4], 4
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416cab
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 5
jmp 0x416c69
and dword [ebp - 0x10], 0
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x58f054
push 0x2710
push ebx
mov dword [ebp - 4], 8
call dword [eax + 0x38]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x416ce2
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
jmp 0x416d1c
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f074
push 0x2715
push ebx
mov byte [ebp - 4], 0xa
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416d0e
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x416d1c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], esi
jmp 0x416c69
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f074
push 0x2715
push ebx
mov dword [ebp - 4], 0xf
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416d56
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x10
jmp 0x416c69
cmp dword [edi + 4], 0xc368
jne 0x416db0
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f084
push 0x271a
push ebx
mov dword [ebp - 4], 0x13
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416d97
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push 1
push ebx
call fcn.004168f7
pop ecx
pop ecx
mov dword [ebp - 4], 0x14
mov eax, dword [ebp + 0xc]
jmp 0x416c69
cmp dword [edi + 4], 0xc352
mov eax, dword [ebx]
jne 0x416e1c
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x16
push ecx
push 0x58f064
push 0x271f
push ebx
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416e10
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x10], 1
je 0x416e0d
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x416e0d
push 0
push dword [edi + 0x2c]
push dword [edi + 0x28]
push ebx
call fcn.004169ee
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x17
jmp 0x416c69
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x19
push ecx
push 0x58f084
push 0x271a
push ebx
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416e49
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x1a
jmp 0x416c69
cmp dword [edi + 4], 0xc368
jne 0x416ea0
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f084
push 0x271a
push ebx
mov dword [ebp - 4], 0x1c
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416e8a
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push 0
push ebx
call fcn.004168f7
pop ecx
pop ecx
mov dword [ebp - 4], 0x1d
jmp 0x416da8
cmp dword [edi + 4], 0xc352
mov eax, dword [ebx]
jne 0x416f0c
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x1f
push ecx
push 0x58f064
push 0x271f
push ebx
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416f00
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x10], 0
je 0x416efd
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x416efd
push 0
push dword [edi + 0x2c]
push dword [edi + 0x28]
push ebx
call fcn.004169ee
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x20
jmp 0x416c69
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x22
push ecx
push 0x58f084
push 0x271a
push ebx
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416f39
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x23
jmp 0x416c69
cmp dword [edi + 4], 0xc353
mov eax, dword [edi + 0x14]
jne 0x416f65
push eax
push 0
push 0x14d
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x416c11.5
add eax, 0xfffffff0
push eax
call fcn.00403470
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0x24
mov dword [esp], 0x104
call fcn.00405e6c
push 0x104
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00406699
push 0x104
push esi
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040614f
and dword [ebp + 0xc], 0
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push 0x58f094
push 0x2712
push ebx
mov byte [ebp - 4], 0x26
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x417028
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edx, eax
mov dword [ebp - 0x14], edx
test edx, edx
je 0x4170ab
mov eax, dword [ebp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push dword [ebp - 0x14]
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x417025
push ecx
lea eax, [esi - 0x10]
mov edi, esp
push eax
mov dword [ebp - 0x14], edi
call fcn.00403470
pop ecx
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.00417c7c
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x417036
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi - 0x10]
call fcn.00406137
jmp case.0x416c11.5
and dword [ebp - 0x10], 0
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push 0x58f0a4
push 0x2714
push ebx
mov dword [ebp - 4], 0x29
call dword [eax + 0x38]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x417088
movsd xmm0, qword [0x58f0b8]
sub esp, 0x10
mov ecx, dword [eax]
movsd qword [esp + 8], xmm0
xorps xmm0, xmm0
movsd qword [esp], xmm0
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0x2a
jmp 0x416c69
push 1
push dword [edi + 0x2c]
push dword [edi + 0x28]
push ebx
call fcn.004169ee
add esp, 0x10
call fcn.0054d392
ret
call fcn.00406add
sbb byte [ecx + eax*2], ch
sub al, 108
inc ecx
add byte [eax + esi*2 + 0x6f450041], dl
inc ecx
add byte [ebp + 0x62004170], ah
insd dword es:[edi], dx
inc ecx
add byte [ebp + 0x6e], dl
inc ecx
add byte [esp + ebp*2 + 0x41], bh
add byte [esp + ebp*2 + 0x6d270041], dh
inc ecx
add byte [eax + 0x70], al
inc ecx
add byte [ebp - 0x5affbe90], ah
jo 0x417124
add byte [edx + 0x1c], ch
mov eax, dword ss:[esi]