Function at 0x406b20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fc13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a4
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x406db3
push esi
mov esi, eax
push edi
mov edi, eax
cmp byte [eax], bl
je 0x406daa
cmp byte [edi], 0
jne 0x406d9d
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp byte [esi], 0x3d
mov byte [ebp - 4], 1
jne 0x406bb0
push 1
push 0x4865e8
lea ecx, [ebp - 0x5c]
call fcn.00403ef0
inc esi
push 1
push 0
push 0
push 0x4865e8
push esi
lea ecx, [ebp - 0x2b0]
call fcn.00413f10
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x84]
sub eax, edx
mov ecx, dword [ebp - 0x88]
sar eax, 2
mov byte [ebp - 4], 2
cmp ecx, eax
jae 0x406bf1
mov eax, ecx
inc ecx
mov dword [ebp - 0x88], ecx
mov edx, dword [edx + eax*4]
jmp 0x406bf3
xor edx, edx
cmp byte [edx], 0
jne 0x406bfc
xor ecx, ecx
jmp 0x406c0a
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c01
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x5c]
call fcn.00403cb0
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x84]
sub eax, edx
mov ecx, dword [ebp - 0x88]
sar eax, 2
cmp ecx, eax
jae 0x406c73
mov eax, ecx
inc ecx
mov dword [ebp - 0x88], ecx
mov edx, dword [edx + eax*4]
mov dword [ebp - 0x60], 0xf
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x74], 0
cmp byte [edx], 0
jne 0x406c53
xor ecx, ecx
jmp 0x406c61
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c58
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x74]
call fcn.00403ef0
lea esi, [ebp - 0x74]
or ebx, 1
jmp 0x406c9a
push 0
push 0x486490
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call fcn.00403ef0
lea esi, [ebp - 0x44]
or ebx, 2
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x406cd4
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x406cb9
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404120
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00403700
test bl, 2
je 0x406d06
mov eax, dword [ebp - 0x30]
and ebx, 0xfffffffd
mov dword [ebp - 0x10], ebx
cmp eax, 0x10
jb 0x406cf4
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00404120
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
mov dword [ebp - 4], 2
test bl, 1
je 0x406d2d
mov eax, dword [ebp - 0x60]
and ebx, 0xfffffffe
mov dword [ebp - 0x10], ebx
cmp eax, 0x10
jb 0x406d2d
inc eax
lea ecx, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
call fcn.00404120
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x5c]
push eax
call fcn.00405a40
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x406d4c
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.00403de0
lea ecx, [ebp - 0x2b0]
lea esi, [edi + 1]
call fcn.00414000
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x406d6f
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00404120
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x406d9d
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00404120
inc edi
cmp byte [esi], 0
jne 0x406b63
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret