Function at 0x40796d
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x2e74]
mov eax, 0x2ef4
call fcn.00414690
mov eax, dword [0x43ec80]
xor eax, ebp
mov dword [ebp + 0x2e70], eax
push ebx
push esi
mov esi, dword [ebp + 0x2e7c]
push edi
mov edi, 0x2ee0
push edi
call fcn.0041375e
push 0
push dword [ebp + 0x2e80]
mov ebx, eax
push 0x434674
push ebx
mov dword [ebp - 0x74], ebx
call fcn.004060c5
push edi
call fcn.0041375e
add esp, 0x18
cmp byte [ebp + 0x2e80], 0
mov dword [ebp - 0x7c], eax
je 0x4079f8
push 0x1770
call fcn.0041375e
mov edi, eax
push edi
call fcn.00405e80
push edi
push 0x433c08
push dword [ebp - 0x7c]
call fcn.00414eb9
push edi
call fcn.00414445
add esp, 0x18
jmp 0x407a02
push 1
push eax
call fcn.00405ecc
pop ecx
pop ecx
push ebx
push 0x435008
push esi
call fcn.00407876
push ebx
push 0x434fe0
push esi
call fcn.00407876
mov edi, 0x44bce0
push edi
push 0x434fc0
push esi
call fcn.004078ef
push edi
push 0x434f98
push esi
call fcn.004078ef
mov ebx, 0x434474
push ebx
push 0x434f60
push esi
call fcn.00407876
push ebx
push 0x434f20
push esi
call fcn.00407876
add esp, 0x48
mov edi, 0x44a4f0
push edi
push 0x434efc
push esi
call fcn.004078ef
push edi
push 0x434ed0
push esi
call fcn.004078ef
push dword [ebp - 0x74]
push 0x434eb0
push esi
call fcn.00407876
push dword [ebp - 0x74]
push 0x434e88
push esi
call fcn.00407876
push 0x44bce0
push 0x434e64
push esi
call fcn.004078ef
push 0x44bce0
push 0x434e38
push esi
call fcn.004078ef
add esp, 0x48
push ebx
push 0x434e00
push esi
call fcn.00407876
push ebx
push 0x434dc0
push esi
call fcn.00407876
push edi
push 0x434d98
push esi
call fcn.004078ef
push edi
push 0x434d6c
push esi
call fcn.004078ef
push dword [ebp - 0x74]
push 0x434d28
push esi
call fcn.00407876
push 0x44bce0
push 0x434cd8
push esi
call fcn.004078ef
add esp, 0x48
push ebx
push 0x434c90
push esi
call fcn.00407876
push edi
push 0x434c60
push esi
call fcn.004078ef
push dword [ebp - 0x7c]
push 0x434c30
push esi
call fcn.00407876
add esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x80], eax
test eax, eax
je 0x407bde
cmp word [eax], 0
mov edi, eax
je 0x407bde
push edi
call fcn.0041492b
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041375e
push edi
push eax
mov dword [ebp - 0x78], eax
call fcn.00414e9a
push 0x3d
push dword [ebp - 0x78]
call fcn.00415aa5
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x407bbd
push dword [ebp - 0x78]
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x70]
push 0x434c24
push eax
call fcn.00414eb9
add ebx, 2
push ebx
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.00407876
lea eax, [ebp - 0x70]
push eax
call fcn.004168d9
push ebx
lea eax, [ebp - 0x70]
push eax
push esi
call fcn.00407876
add esp, 0x28
push edi
call fcn.0041492b
push dword [ebp - 0x78]
lea edi, [edi + eax*2 + 2]
call fcn.00414445
cmp word [edi], 0
pop ecx
pop ecx
jne 0x407b4a
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push dword [ebp - 0x74]
call fcn.00414445
push dword [ebp - 0x7c]
call fcn.00414445
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2e70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414678
add ebp, 0x2e74
leave
ret