Function at 0x40b710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40b719
mov eax, dword [ebp - 4]
add esp, 0xffffff90
push ebx
push esi
push edi
mov byte [ebp - 0xc6d], cl
mov dword [ebp - 0xc6c], edx
mov ebx, eax
mov eax, 0x4abffc
call fcn.004a0204
cmp byte [ebp - 0xc6d], 0
je 0x40b75e
lea edx, [ebp - 0x1074]
mov cl, 1
mov eax, ebx
call fcn.0040cc78
jmp 0x40b76e
push ebx
lea edx, [ebp - 0x1074]
push edx
call fcn.0049fdd4
add esp, 8
mov word [ebp - 0xc58], 8
lea eax, [ebp - 0xc20]
call fcn.00409724
inc dword [ebp - 0xc4c]
mov word [ebp - 0xc58], 0x14
cmp byte [ebp - 0x1074], 0
je 0x40b813
cmp byte [ebp + 0x18], 0
je 0x40b7b5
lea edx, [ebp - 0x1074]
lea eax, [ebp - 0xc20]
xor ecx, ecx
call fcn.0040996c
jmp 0x40b7cc
push 0
push 0
lea edx, [ebp - 0x1074]
lea eax, [ebp - 0xc20]
xor ecx, ecx
call fcn.00409818
test al, al
jne 0x40b823
cmp byte [ebp + 0x18], 0
je 0x40b7e5
mov eax, 0x4bb2e4
mov edx, 6
call fcn.0042ecd4
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0xc20]
dec dword [ebp - 0xc4c]
call fcn.004097d4
pop eax
mov edx, dword [ebp - 0xc68]
mov dword fs:[0], edx
jmp 0x40bcf3
lea eax, [ebp - 0xc20]
mov edx, 1
call fcn.0040a2c4
mov word [ebp - 0xc58], 0x20
xor esi, esi
lea eax, [ebp - 0xc2c]
mov edx, 0x405
call fcn.00401c0c
inc dword [ebp - 0xc4c]
mov word [ebp - 0xc58], 0x14
jmp 0x40b85e
add esi, ebx
lea eax, [ebp - 0xc2c]
mov edx, ebx
call fcn.0040bcfc
mov edx, dword [ebp - 0xc2c]
add edx, esi
lea eax, [ebp - 0xc20]
mov ecx, 0x400
call fcn.00409e1c
mov ebx, eax
test eax, eax
jne 0x40b84f
push 5
push 0
mov edx, dword [ebp - 0xc2c]
add edx, esi
push edx
call fcn.0049fc54
add esp, 0xc
cmp dword [ebp + 0x14], 3
je 0x40b8b6
cmp dword [ebp + 0x14], 0
jne 0x40bb5f
mov edx, esi
mov eax, dword [ebp - 0xc2c]
call fcn.0040b6d4
test al, al
je 0x40bb5f
mov word [ebp - 0xc58], 0x2c
mov edx, dword [ebp - 0xc28]
sar edx, 1
jns 0x40b8cc
adc edx, 0
inc edx
lea eax, [ebp - 0xc38]
call fcn.00401ac0
inc dword [ebp - 0xc4c]
mov word [ebp - 0xc58], 0x38
mov eax, 2
jmp 0x40b921
mov edx, dword [ebp - 0xc2c]
xor ecx, ecx
mov cl, byte [edx + eax]
mov edx, dword [ebp - 0xc2c]
movzx edx, byte [edx + eax + 1]
shl edx, 8
add cx, dx
lea edx, [eax - 2]
sar edx, 1
jns 0x40b914
adc edx, 0
mov ebx, dword [ebp - 0xc38]
mov word [ebx + edx*2], cx
add eax, 2
mov edx, dword [ebp - 0xc28]
dec edx
cmp eax, edx
jl 0x40b8ee
mov esi, dword [ebp - 0xc38]
mov word [ebp - 0xc58], 0x38
mov word [ebp - 0xc58], 0x44
lea eax, [ebp - 0xc44]
call fcn.0040bd4c
inc dword [ebp - 0xc4c]
mov word [ebp - 0xc58], 0x38
jmp 0x40bb1b
mov edi, esi
mov word [ebp - 0xc58], 0x38
xor eax, eax
jmp 0x40b98f
cmp byte [ebp + 0xc], 0
je 0x40b98c
cmp word [edi], 0x2f
jne 0x40b98c
cmp word [edi + 2], 0x2f
jne 0x40b98c
mov word [edi], 0
mov eax, edi
add edi, 2
cmp word [edi], 0xd
je 0x40b9a1
cmp word [edi], 0xa
je 0x40b9a1
cmp word [edi], 0
jne 0x40b972
mov word [edi], 0
test eax, eax
jne 0x40b9ac
mov eax, edi
add eax, 0xfffffffe
mov word [ebp - 0xc58], 0x38
cmp esi, eax
ja 0x40b9d4
cmp word [eax], 0x20
je 0x40b9c8
cmp word [eax], 9
jne 0x40b9d4
mov word [eax], 0
sub eax, 2
cmp esi, eax
jbe 0x40b9bc
cmp word [esi], 0
je 0x40bb07
mov eax, esi
call fcn.00411474
mov ebx, eax
mov word [ebp - 0xc58], 0x38
mov eax, ebx
sub eax, dword [ebp - 0xc40]
inc eax
shl eax, 2
test eax, eax
jle 0x40ba11
lea edx, [ebp - 0xc44]
mov ecx, edx
mov edx, eax
mov eax, ecx
call fcn.0040bcfc
cmp byte [ebp + 0x10], 0
je 0x40ba2f
cmp word [esi], 0x22
jne 0x40ba2f
cmp word [esi + ebx*2 - 2], 0x22
jne 0x40ba2f
mov word [esi + ebx*2 - 2], 0
add esi, 2
mov ecx, dword [ebp - 0xc40]
mov edx, dword [ebp - 0xc44]
mov eax, esi
call fcn.004111a0
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x40baf0
cmp word [esi], 0x25
jne 0x40baf0
mov word [ebp - 0x1c74], 0
mov dword [ebp - 0xc74], 1
push 0x400
lea eax, [ebp - 0x1474]
push eax
push dword [ebp - 0xc44]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ebx, eax
test ebx, ebx
je 0x40baa9
call fcn.0041113c
test eax, eax
je 0x40baa9
push 0x400
lea eax, [ebp - 0x1c74]
push eax
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsW
mov dword [ebp - 0xc74], eax
test ebx, ebx
je 0x40baca
cmp ebx, 0x400
jge 0x40baca
cmp dword [ebp - 0xc74], 0
je 0x40baca
cmp dword [ebp - 0xc74], 0x400
jl 0x40bace
xor edx, edx
jmp 0x40bad3
mov edx, 1
mov ebx, edx
test bl, bl
je 0x40baf0
lea ecx, [ebp - 0x1c74]
lea edx, [ebp - 0x1474]
mov eax, dword [ebp - 0xc6c]
call fcn.004107c0
test bl, bl
jne 0x40bb07
mov ecx, esi
mov edx, dword [ebp - 0xc44]
mov eax, dword [ebp - 0xc6c]
call fcn.004107c0
lea esi, [edi + 2]
jmp 0x40bb0f
add esi, 2
cmp word [esi], 0xd
je 0x40bb0c
cmp word [esi], 0xa
je 0x40bb0c
cmp word [esi], 0
jne 0x40b963
dec dword [ebp - 0xc4c]
lea eax, [ebp - 0xc44]
mov edx, 2
call fcn.00401c84
dec dword [ebp - 0xc4c]
lea eax, [ebp - 0xc38]
mov edx, 2
call fcn.00401b40
mov word [ebp - 0xc58], 0x14
jmp 0x40bcb6
mov esi, dword [ebp - 0xc2c]
mov word [ebp - 0xc58], 0x14
jmp 0x40bcad
mov edi, esi
mov word [ebp - 0xc58], 0x14
xor eax, eax
jmp 0x40bba1
cmp byte [ebp + 0xc], 0
je 0x40bba0
xor edx, edx
mov dl, byte [edi]
cmp edx, 0x2f
jne 0x40bba0
xor ecx, ecx
mov cl, byte [edi + 1]
cmp ecx, 0x2f
jne 0x40bba0
mov byte [edi], 0
mov eax, edi
inc edi
xor edx, edx
mov dl, byte [edi]
cmp edx, 0xd
je 0x40bbb8
xor ecx, ecx
mov cl, byte [edi]
cmp ecx, 0xa
je 0x40bbb8
cmp byte [edi], 0
jne 0x40bb82
mov byte [edi], 0
test eax, eax
jne 0x40bbc1
mov eax, edi
dec eax
mov word [ebp - 0xc58], 0x14
cmp esi, eax
ja 0x40bbe9
xor edx, edx
mov dl, byte [eax]
cmp edx, 0x20
je 0x40bbe1
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 9
jne 0x40bbe9
mov byte [eax], 0
dec eax
cmp esi, eax
jbe 0x40bbcf
cmp byte [esi], 0
je 0x40bc95
cmp byte [ebp + 0x10], 0
je 0x40bc22
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x40bc22
push esi
call fcn.0049fe04
pop ecx
xor edx, edx
mov word [ebp - 0xc58], 0x14
mov dl, byte [esi + eax - 1]
cmp edx, 0x22
jne 0x40bc22
mov byte [esi + eax - 1], 0
inc esi
cmp dword [ebp + 0x14], 2
jne 0x40bc2f
push esi
push esi
call sub.USER32.DLL_OemToCharA
xor ebx, ebx
mov word [ebp - 0xc58], 0x14
cmp byte [ebp + 8], 0
je 0x40bc84
xor eax, eax
mov al, byte [esi]
cmp eax, 0x25
jne 0x40bc84
push 0x400
lea edx, [ebp - 0x2074]
push edx
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x40bc66
cmp eax, 0x400
jl 0x40bc6a
xor ebx, ebx
jmp 0x40bc6f
mov ebx, 1
test bl, bl
je 0x40bc84
lea edx, [ebp - 0x2074]
mov eax, dword [ebp - 0xc6c]
call fcn.004107b8
test bl, bl
jne 0x40bc95
mov edx, esi
mov eax, dword [ebp - 0xc6c]
call fcn.004107b8
lea esi, [edi + 1]
jmp 0x40bc9b
inc esi
xor eax, eax
mov al, byte [esi]
cmp eax, 0xd
je 0x40bc9a
xor edx, edx
mov dl, byte [esi]
cmp edx, 0xa
je 0x40bc9a
cmp byte [esi], 0
jne 0x40bb73
mov al, 1
mov edx, 2
push eax
lea eax, [ebp - 0xc2c]
dec dword [ebp - 0xc4c]
call fcn.00401c84
dec dword [ebp - 0xc4c]
lea eax, [ebp - 0xc20]
mov edx, 2
call fcn.004097d4
pop eax
mov edx, dword [ebp - 0xc68]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14