Function at 0x40fa20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4beb48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x868
push esi
mov esi, ecx
mov dword [ebp - 0x30], esi
call fcn.004ad0f0
test eax, eax
je 0x40fd44
lea eax, [esi + 0x1e6c]
lea ecx, [esi + 0x1c4c]
push eax
push ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40fd44
push ebx
push edi
call fcn.004ad0f0
mov edi, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0x20
add ebx, 0x20
mov dword [ebp - 0x20], ebx
test edi, edi
je 0x40fd14
cmp word [edi], 0
je 0x40fd14
push 0
push edi
call fcn.004acca0
add esp, 8
test eax, eax
jne 0x40face
push eax
lea eax, [ebp - 0x668]
push eax
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], edi
call fcn.004044b0
add esp, 0xc
test eax, eax
jne 0x40face
lea edi, [ebp - 0x668]
push 0x25
push edi
call fcn.004b03ac
add esp, 8
test eax, eax
je 0x40fb01
push 0x105
lea edx, [ebp - 0x874]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40fb01
cmp eax, 0x105
jae 0x40fb01
lea edi, [ebp - 0x874]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x4c9c1c
push edi
call esi
test eax, eax
je 0x40fd14
push str.cmd.exe
push edi
call esi
test eax, eax
je 0x40fd14
push edi
call fcn.004ad2f0
mov esi, eax
add esp, 4
test esi, esi
je 0x40fb5a
push 0x4c0930
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40fb5a
push str..com
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40fd14
lea eax, [ebp - 0x250]
push edi
push eax
call fcn.0040eef0
add esp, 8
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
lea eax, [ebp - 0x250]
push str.SYSNATIVE_
push eax
call fcn.004b138a
add esp, 8
test eax, eax
jne 0x40fd2e
lea ecx, [ebp - 0x250]
push str.SYSWOW64_
push ecx
call fcn.004b138a
add esp, 8
test eax, eax
jne 0x40fd2e
lea ecx, [ebp - 0x44]
call fcn.004048c0
xor ebx, ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.004048a0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.0042fd50
add esp, 0x10
mov byte [ebp + 0xb], al
test al, al
jne 0x40fcfa
push 0x5c
push edi
mov ebx, edi
call fcn.004b135e
add esp, 8
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
test eax, eax
je 0x40fc3b
push edi
call fcn.00441380
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40fc3b
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
add ebx, 2
mov edx, ebx
sub edx, edi
sar edx, 1
xor eax, eax
mov word [ecx + edx*2], ax
mov ecx, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_SearchPathW]
neg esi
lea edx, [ebp - 0x24]
push edx
sbb esi, esi
lea eax, [ebp - 0x250]
push eax
push 0x105
not esi
and esi, 0x4c0930
push esi
push ebx
push ecx
call edi
test eax, eax
jne 0x40fcbd
cmp dword [ebp - 0x10], eax
jne 0x40fce8
mov edx, dword [ebp - 0x30]
add edx, 0x3be
push edx
lea eax, [ebp - 0x45c]
push eax
call fcn.0040eef0
lea ecx, [ebp - 0x45c]
push 0x5c
push ecx
call fcn.004b135e
add esp, 0x10
test eax, eax
je 0x40fc9e
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x250]
push ecx
push 0x105
push esi
push ebx
lea edx, [ebp - 0x45c]
push edx
call edi
test eax, eax
je 0x40fd00
cmp eax, 0x105
jae 0x40fce2
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x250]
push eax
call fcn.0042fd50
add esp, 0x10
mov byte [ebp + 0xb], al
cmp dword [ebp - 0x10], 0
je 0x40fcf4
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00441300
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x40fd00
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.00404910
mov ebx, dword [ebp - 0x20]
jmp 0x40fd26
mov eax, dword [0x50b3a0]
mov eax, dword [eax + 0x34]
cmp eax, 1
je 0x40fd2e
cmp eax, 2
je 0x40fd2e
mov eax, dword [ebp - 0x2c]
cmp ebx, 0x40
je 0x40fd31
mov eax, dword [ebp - 0x34]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0x1c4c]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4