Function at 0x492010
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x3044]
mov eax, 0x3044
call fcn.0052f720
push 0xffffffffffffffff
push 0x55066d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp + 0x3040], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x3050]
mov eax, dword [ebp + 0x304c]
mov dword [ebp - 0x48], ecx
xor ecx, ecx
mov word [ebp + 0x2040], cx
test eax, eax
je 0x49209a
cmp byte [ebp + 0x3054], cl
je 0x492088
push ecx
push 1
push 0x800
lea ecx, [ebp + 0x2040]
push ecx
push eax
call fcn.004a1cb0
jmp 0x49209a
push 0x800
push eax
lea eax, [ebp + 0x2040]
push eax
call fcn.004bd090
lea ecx, [ebp]
call fcn.0048ea10
mov dword [ebp - 4], 0
cmp word [ebp + 0x2040], 0
je 0x492100
mov bl, byte [ebp + 0x3058]
lea eax, [ebp + 0x2040]
lea ecx, [ebp]
test bl, bl
je 0x4920ce
push eax
call fcn.0048fcc0
jmp 0x4920d6
push 0
push eax
call fcn.0048f200
test al, al
jne 0x492107
test bl, bl
je 0x4920ea
push 6
mov ecx, 0x5d281c
call fcn.00487440
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0048ea60
xor al, al
jmp 0x492683
mov dword [ebp + 0x10], 1
xor esi, esi
xor eax, eax
push 0x1000
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0x1000
call fcn.00537b8a
mov ebx, eax
add esp, 8
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x49213f
mov ecx, 0x5d281c
call fcn.004875a0
mov eax, 0x1000
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
lea ecx, [ebp]
push eax
push ebx
call fcn.0048f640
test eax, eax
je 0x49220a
push eax
lea ecx, [ebp - 0x30]
add esi, eax
call fcn.00408290
mov eax, dword [ebp - 0x30]
lea ecx, [ebp]
mov dword [ebp - 0x10], eax
add eax, esi
push 0x1000
push eax
call fcn.0048f640
test eax, eax
jne 0x492163
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ebx
cmp esi, ebx
jbe 0x49220a
mov eax, dword [ebp - 0x2c]
mov edi, esi
sub edi, eax
add edi, eax
mov dword [ebp - 0x2c], edi
cmp edi, ebx
jbe 0x49220f
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4921ca
cmp edi, eax
jbe 0x4921ca
push eax
push str.Maximum_allowed_array_size___u__is_exceeded
push 0x5d281c
call fcn.00487480
add esp, 0xc
mov ecx, 0x5d281c
call fcn.004875a0
mov eax, ebx
add ebx, 0x20
shr eax, 2
add ebx, eax
mov dword [ebp - 0x20], ebx
cmp edi, ebx
jbe 0x4921e0
mov ebx, edi
mov dword [ebp - 0x20], ebx
push ebx
push dword [ebp - 0x10]
call fcn.00537b8a
mov ecx, eax
add esp, 8
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x492202
mov ecx, 0x5d281c
call fcn.004875a0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ebx
jmp 0x492212
mov edi, esi
mov dword [ebp - 0x2c], edi
mov ecx, dword [ebp - 0x10]
cmp esi, 2
jb 0x49228d
cmp byte [ecx], 0xff
jne 0x49228d
cmp byte [ecx + 1], 0xfe
jne 0x49228d
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x34], 0
cmp esi, 3
jb 0x49224a
cmp byte [ecx], 0xef
jne 0x49224a
cmp byte [ecx + 1], 0xbb
jne 0x49224a
cmp byte [ecx + 2], 0xbf
mov byte [ebp - 0x11], 1
je 0x49224e
mov byte [ebp - 0x11], 0
mov ebx, dword [ebp + 0x305c]
test ebx, ebx
jne 0x492327
cmp esi, 3
jbe 0x4922c9
cmp byte [ecx], 0xef
jne 0x4922e5
cmp byte [ecx + 1], 0xbb
jne 0x4922e5
cmp byte [ecx + 2], 0xbf
jne 0x4922e5
lea eax, [esi - 3]
push eax
lea eax, [ecx + 3]
push eax
call fcn.004c0af0
test al, al
je 0x4922e2
mov ebx, 4
jmp 0x492327
mov dword [ebp - 0x18], 0
cmp esi, 2
jb 0x492229
cmp byte [ecx], 0xfe
mov dword [ebp - 0x18], 0
jne 0x492229
cmp byte [ecx + 1], 0xff
mov dword [ebp - 0x18], 0
jne 0x492229
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x18], 0
jmp 0x492230
cmp esi, 2
ja 0x4922e5
xor al, al
cmp esi, 2
jbe 0x4922f2
cmp byte [ecx], 0xfe
jne 0x4922f2
cmp byte [ecx + 1], 0xff
jne 0x4922f2
jmp 0x4922f6
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0xff
jne 0x4922ce
cmp byte [ecx + 1], 0xfe
jne 0x4922ce
mov al, 1
test al, al
je 0x492325
movzx eax, al
add eax, 2
cmp eax, esi
jae 0x492325
mov cl, byte [ecx + eax]
cmp cl, 0x20
jae 0x492312
cmp cl, 0xd
je 0x492312
cmp cl, 0xa
jne 0x49231e
add eax, 2
cmp eax, esi
jae 0x492325
mov ecx, dword [ebp - 0x10]
jmp 0x492300
mov ebx, 3
jmp 0x492327
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 2
test ebx, ebx
je 0x49234e
cmp ebx, 2
je 0x49234e
cmp ebx, 1
jne 0x492421
inc edi
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp - 0x20]
cmp edi, esi
jbe 0x4923b9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x492381
cmp edi, eax
jbe 0x492381
push eax
push str.Maximum_allowed_array_size___u__is_exceeded
push 0x5d281c
call fcn.00487480
add esp, 0xc
mov ecx, 0x5d281c
call fcn.004875a0
mov eax, esi
add esi, 0x20
shr eax, 2
add esi, eax
cmp edi, esi
jbe 0x492391
mov esi, edi
push esi
push dword [ebp - 0x10]
call fcn.00537b8a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4923b1
mov ecx, 0x5d281c
call fcn.004875a0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], esi
jmp 0x4923bc
mov eax, dword [ebp - 0x10]
mov byte [edi + eax - 1], 0
cmp ebx, 2
jne 0x4923ce
push eax
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov esi, edi
mov dword [ebp - 0x40], esi
test edi, edi
je 0x492415
cmp edi, 0x20
jbe 0x4923e3
mov eax, edi
mov dword [ebp - 0x20], edi
jmp 0x4923eb
mov eax, 0x20
mov dword [ebp - 0x20], eax
add eax, eax
push eax
push 0
call fcn.00537b8a
add esp, 8
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x49240c
mov ecx, 0x5d281c
call fcn.004875a0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.004c0a40
cmp ebx, 3
jne 0x4924c2
cmp dword [ebp - 0x18], 0
lea esi, [ebx - 1]
jne 0x492442
cmp dword [ebp - 0x34], 0
jne 0x492442
xor esi, esi
mov dword [ebp - 0x18], 1
mov eax, edi
lea ecx, [ebp - 0x44]
shr eax, 1
inc eax
push eax
call fcn.0040d6f0
mov ebx, dword [ebp - 0x44]
and edi, 0xfffffffe
mov edx, edi
mov dword [ebp - 0x1c], ebx
sub edx, esi
mov dword [ebp - 0x20], edx
cmp esi, edi
jae 0x4924b8
mov eax, dword [ebp - 0x34]
lea edi, [edx - 1]
add esi, dword [ebp - 0x10]
xor ebx, ebx
sub dword [ebp - 0x18], eax
add esi, eax
mov edx, dword [ebp - 0x18]
mov eax, 0x100
shr edi, 1
inc edi
nop
movzx ecx, byte [edx + esi]
lea esi, [esi + 2]
mov edx, dword [ebp - 0x1c]
movzx eax, ax
imul ecx, eax
movzx eax, byte [esi - 2]
add cx, ax
mov eax, ebx
shr eax, 1
add ebx, 2
movzx ecx, cx
mov word [edx + eax*2], cx
mov eax, 0x100
mov edx, dword [ebp - 0x18]
sub edi, 1
jne 0x492480
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
shr edx, 1
xor eax, eax
mov word [ebx + edx*2], ax
jmp 0x49250a
cmp ebx, 4
jne 0x492507
push 1
lea ecx, [ebp - 0x30]
call fcn.00408290
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
mov ebx, dword [ebp - 0x30]
push eax
mov dword [ebp - 0x10], ebx
mov byte [eax + ebx - 1], 0
call fcn.0040d6f0
movzx eax, byte [ebp - 0x11]
push dword [ebp - 0x40]
neg eax
sbb eax, eax
and eax, 3
add eax, ebx
mov ebx, dword [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.004c0bb0
jmp 0x49250a
mov ebx, dword [ebp - 0x1c]
cmp word [ebx], 0
mov esi, ebx
je 0x492651
movzx ecx, word [esi]
lea esp, [esp]
movzx eax, cx
xor edx, edx
mov edi, esi
mov ebx, eax
cmp eax, 0xd
je 0x49256d
mov ecx, eax
movzx ebx, cx
cmp cx, 0xa
je 0x49256d
movzx ebx, cx
test cx, cx
je 0x49256d
cmp byte [ebp + 0x3064], 0
je 0x49255d
cmp cx, 0x2f
jne 0x49255d
cmp word [edi + 2], cx
jne 0x49255d
xor eax, eax
mov edx, edi
mov word [edi], ax
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
mov ebx, eax
cmp eax, 0xd
jne 0x492530
xor eax, eax
mov word [edi], ax
test edx, edx
jne 0x492578
mov edx, edi
lea eax, [edx - 2]
cmp eax, esi
jb 0x492599
nop
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x49258d
cmp ecx, 9
jne 0x492599
xor ecx, ecx
mov word [eax], cx
sub eax, 2
cmp eax, esi
jae 0x492580
cmp byte [ebp + 0x3060], 0
je 0x4925d1
cmp word [esi], 0x22
jne 0x4925d1
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4925b0
sub ecx, edx
sar ecx, 1
cmp word [esi + ecx*2 - 2], 0x22
jne 0x4925d1
xor eax, eax
mov word [esi + ecx*2 - 2], ax
add esi, 2
cmp byte [ebp + 0x3068], 0
je 0x49261a
cmp word [esi], 0x25
jne 0x49261a
xor eax, eax
mov word [ebp + 0x1040], ax
lea eax, [ebp + 0x1040]
push 0x800
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x49261a
cmp eax, 0x800
jae 0x49261a
cmp word [ebp + 0x1040], 0
je 0x492629
lea eax, [ebp + 0x1040]
push eax
jmp 0x492621
cmp word [esi], 0
je 0x492629
push esi
mov ecx, dword [ebp - 0x48]
call fcn.004bd180
test bx, bx
je 0x49264e
lea esi, [edi + 2]
movzx eax, word [esi]
mov ecx, eax
cmp eax, 0xd
je 0x492640
cmp eax, 0xa
jne 0x492645
add esi, 2
jmp 0x492631
test ax, ax
jne 0x492520
mov ebx, dword [ebp - 0x1c]
mov byte [ebp - 4], 1
push ebx
call fcn.00537b6f
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x492672
push eax
call fcn.00537b6f
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0048ea60
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3040]
xor ecx, ebp
call fcn.0052f708
lea esp, [ebp + 0x3044]
pop ebp
ret 0x20