Function at 0x5a3be8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5a3d12
mov byte [ebp - 0x38], 0x7c
push eax
mov byte [ebp - 0x37], 0
push 0x799014
call fcn.005a2de0
add esp, 8
mov esi, eax
mov eax, esi
xor ebx, ebx
jmp 0x5a3c29
add ebx, 1
add eax, 1
push 0x7c
push eax
call fcn.00745cf0
add esp, 8
test eax, eax
jne 0x5a3c23
lea eax, [ebx*8 + 8]
push eax
call fcn.0074334f
pop ecx
mov ebx, eax
test ebx, ebx
je 0x5a3cb5
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x44]
push eax
push edx
push esi
call fcn.005a2810
add esp, 0xc
test eax, eax
je 0x5a3cb1
xor edi, edi
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
push ecx
push 0x3d
push eax
call fcn.005a2880
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [ebx + edi*8], eax
mov dword [ebx + edi*8 + 4], edx
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x44]
push ecx
add edi, 1
push eax
push 0
call fcn.005a2810
add esp, 0x1c
test eax, eax
jne 0x5a3c63
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor edi, edi
jmp 0x5a3c99
push 0x4006e
lea eax, [ebp - 0x54]
push eax
call fcn.005a509c
add esp, 8
mov dword [esp], 2
mov edi, dword [ebp - 0x54]
lea ecx, [esp + 4]
mov dword [ecx], edi
mov eax, dword [ebp - 0x50]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ecx + 8], eax
lea edx, [esp + 0x14]
mov eax, dword [ebp - 0x48]
mov dword [ecx + 0xc], eax
lea eax, [0x852570]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.005a4194
jmp 0x5a3c4c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
test esi, esi
je 0x5a3f31
mov dword [ebp - 0x48], esi
mov ecx, esi
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x5a3d40
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x5a3d29
add eax, 0xffffffff
test eax, eax
je 0x5a3f28
mov ecx, dword [ebp - 0x48]
xor edx, edx
xor edi, edi
mov ebx, edx
add edi, 1
lea ebx, [ebx + eax + 1]
lea ecx, [eax + ecx + 1]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x5a3d75
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x5a3d5e
add eax, 0xffffffff
test eax, eax
jne 0x5a3d51
mov edx, ebx
add edx, 1
mov dword [ebp - 0x54], edx
push edx
call fcn.0074334f
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
add esp, 4
test eax, eax
je 0x5a3ebf
mov ebx, dword [ebp - 0x4c]
push edx
push esi
push ebx
call fcn.005976b8
shl edi, 3
push edi
call fcn.0074334f
add esp, 0x10
mov edi, eax
test edi, edi
je 0x5a3e62
mov ecx, dword [ebp - 0x4c]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x5a3dd5
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x5a3dbe
add eax, 0xffffffff
mov edx, eax
test edx, edx
je 0x5a3e5e
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], edi
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x50], esi
xor eax, eax
mov ebx, eax
mov esi, edx
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x3d
push edi
call fcn.005a2880
add esp, 0x10
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov dword [eax + ebx*8], ecx
lea edi, [edi + esi + 1]
mov ecx, dword [ebp - 0x10]
mov dword [eax + ebx*8 + 4], ecx
add ebx, 1
mov ecx, edi
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x5a3e36
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x5a3e1f
add eax, 0xffffffff
mov esi, eax
test esi, esi
jne 0x5a3df1
mov edi, dword [ebp - 0x48]
mov esi, dword [ebp - 0x50]
mov eax, ebx
mov ebx, dword [ebp - 0x54]
mov edx, dword [ebp + 8]
push esi
mov dword [edx], ebx
mov dword [edx + 4], edi
mov dword [edx + 8], eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x5a3ca4
xor eax, eax
jmp 0x5a3e47
push 0x4006e
lea eax, [ebp - 0x24]
push eax
call fcn.005a509c
add esp, 8
mov dword [esp], 2
mov eax, dword [ebp - 0x24]
lea ecx, [esp + 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
lea edx, [esp + 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0xc], eax
lea eax, [0x852570]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
call fcn.005a4194
jmp 0x5a3db9
push 0x4006e
lea eax, [ebp - 0x34]
mov dword [ebp - 0x54], edx
push eax
call fcn.005a509c
mov edx, dword [ebp - 0x54]
add esp, 8
mov dword [esp], 2
mov ecx, dword [ebp - 0x34]
lea eax, [esp + 4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xc], ecx
lea eax, [0x852570]
mov ebx, dword [eax]
lea ecx, [esp + 0x14]
mov dword [ecx], ebx
mov ebx, dword [eax + 4]
mov dword [ecx + 4], ebx
mov ebx, dword [eax + 8]
mov dword [ecx + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp - 0x54], edx
call fcn.005a4194
mov edx, dword [ebp - 0x54]
jmp 0x5a3d98
xor edx, edx
xor edi, edi
jmp 0x5a3d7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push 0x40013
lea eax, [ebp - 0x54]
push eax
call fcn.005a509c
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.005a5468
add esp, 0x10
mov dword [esp], 2
mov edx, dword [ebp - 0x54]
lea eax, [esp + 4]
mov dword [eax], edx
mov ecx, dword [ebp - 0x50]
mov dword [eax + 4], ecx
mov ebx, dword [ebp - 0x4c]
lea ecx, [0x852570]
mov dword [eax + 8], ebx
lea edx, [esp + 0x14]
mov edi, dword [ebp - 0x48]
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0x44]
mov dword [edx], eax
mov eax, dword [ebp - 0x40]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [edx + 0xc], eax
mov edx, dword [ecx]
lea eax, [esp + 0x24]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
call fcn.005a4194
xor ebx, ebx
xor edi, edi
xor eax, eax
jmp 0x5a3e47