Function at 0x5e1b28
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x44
mov ebx, edx
mov ecx, dword [0x7abe24]
mov edi, eax
test ecx, ecx
je 0x5e1c56
mov eax, dword [0x7abe24]
test eax, eax
je 0x5e1c56
push 0x7f63e0
call fcn.00607e00
add esp, 4
mov eax, dword [0x7f63e4]
test eax, eax
je 0x5e1b6a
xor esi, esi
jmp 0x5e1b93
xor esi, esi
push esi
push esi
push str.FOR_DISABLE_KMP_MALLOC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
ja 0x5e1b7f
je 0x5e1b89
mov dword [0x7abe24], 0
mov dword [0x7f63e4], 1
mov eax, 0x5e2030
mov dword [ebp - 0x20], fcn.005e2020
mov dword [ebp - 0x1c], fcn.005e2040
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], fcn.005e2020
lea edx, [eax + 1]
mov dword [ebp - 0x10], fcn.005e2040
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
je 0x5e1be5
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
cmp eax, edx
je 0x5e1be5
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x50]
cmp eax, edx
je 0x5e1be5
mov dword [0x7f63e8], 1
mov dword [ebp - 0x38], fcn.005e2050
mov dword [ebp - 0x34], fcn.005e2070
mov dword [ebp - 0x30], fcn.005e2090
mov dword [ebp - 0x2c], fcn.005e2050
mov dword [ebp - 0x28], fcn.005e2070
mov dword [ebp - 0x24], fcn.005e2090
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x2c]
cmp eax, edx
je 0x5e1c37
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
cmp eax, edx
je 0x5e1c37
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
cmp eax, edx
je 0x5e1c37
mov dword [0x7f63ec], 1
mov eax, dword [0x7f63ec]
test eax, eax
je 0x5e1c4a
mov dword [0x7f63f0], 1
mov dword [0x7abe24], esi
mov dword [0x7f63e0], esi
movzx edx, byte [ebp + 0xc]
mov eax, edx
mov esi, edx
and eax, 4
shr eax, 2
and esi, 0x20
test byte [ebp + 0xf], 2
je 0x5e1c78
test eax, eax
je 0x5e1ca9
mov eax, 1
jmp 0x5e1c7e
test eax, eax
je 0x5e1cfa
xor eax, eax
test dl, 1
je 0x5e1c90
mov eax, 0xad
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push 0
push 0xad
mov dword [ebp - 0x4c], eax
call fcn.0060b140
mov eax, dword [ebp - 0x4c]
add esp, 8
test eax, eax
je 0x5e1cf6
mov eax, dword [0x7f63f0]
test eax, eax
je 0x5e1cf6
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x4c]
push eax
call 0x22dfb08
mov edx, eax
add esp, 4
movzx eax, word [ebp + 0xe]
and eax, 0x1e0
shr eax, 5
cmp eax, 0xf
je 0x5e1d80
push eax
push edi
push edx
call fcn.005e2090
add esp, 0xc
jmp 0x5e1d76
movzx edx, byte [ebp + 0xc]
test dl, 0x40
jne 0x5e1d8d
test byte [ebp + 0xd], 1
je 0x5e1d1d
mov eax, dword [0x7f63e8]
test eax, eax
je 0x5e1d1d
push edi
call fcn.005e2040
add esp, 4
jmp 0x5e1d76
push 0x7f63f8
call fcn.00607e00
add esp, 4
mov ebx, edi
shr ebx, 0x18
cmp edi, dword [ebx*4 + 0x7f5fe0]
je 0x5e1d5a
mov dword [0x7f63f8], 0
test esi, esi
jne 0x5e1d4f
mov eax, dword [0x7f63e8]
test eax, eax
jne 0x5e1d12
push edi
call fcn.006c6a5d
add esp, 4
jmp 0x5e1d76
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov dword [ebx*4 + 0x7f5fe0], eax
mov dword [0x7f63f8], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
push edi
push edx
call fcn.005e2090
add esp, 0xc
jmp 0x5e1d76
push edi
call fcn.006237a0
add esp, 4
jmp 0x5e1d76