Function at 0x424f70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590df5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5fb1a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push edi
call fcn.00426330
mov esi, dword [ebp + 0xc]
add esp, 4
mov ecx, dword [esi]
dec ecx
cmp ecx, 0xc
ja case.0x424fb3.5
jmp dword [ecx*4 + 0x4255ec]
cmp dword [esi + 4], 0xc350
jne 0x424fe4
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push edi
mov dword [ebp + 0xc], 0
call dword [eax + 0x90]
cmp dword [ebp + 0xc], 0
je 0x424fe4
push 0
jmp 0x4255ba
mov dword [ebp + 0xc], 0
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4034
push 0x2710
push edi
mov dword [ebp - 4], 1
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425016
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 2
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], 0
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4044
push 0x271f
push edi
mov dword [ebp - 4], 4
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42506f
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 5
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], 0
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
push 0x5a4034
push 0x2710
push edi
mov dword [ebp - 4], 8
call dword [eax + 0x38]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4250c7
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
jmp 0x425104
mov dword [ebp + 0xc], 0
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4054
push 0x2715
push edi
mov byte [ebp - 4], 0xa
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4250f6
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x425104
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0xc
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], 0
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4054
push 0x2715
push edi
mov dword [ebp - 4], 0xf
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425160
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x10
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
cmp ecx, 0xc368
jne 0x4251f6
mov dword [ebp + 0xc], 0
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4064
push 0x271a
push edi
mov dword [ebp - 4], 0x13
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4251c1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push 1
push edi
call fcn.00424c30
add esp, 8
mov dword [ebp - 4], 0x14
mov eax, dword [ebp + 0xc]
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
cmp ecx, 0xc352
jne 0x42527f
mov dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x16
push ecx
push 0x5a4044
push 0x271f
push edi
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425258
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x14], 1
je 0x425255
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x425255
push 0
push dword [esi + 0x2c]
push dword [esi + 0x28]
push edi
call fcn.00424d30
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x17
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x19
push ecx
push 0x5a4064
push 0x271a
push edi
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4252af
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x1a
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
cmp ecx, 0xc368
jne 0x425327
mov dword [ebp + 0xc], 0
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4064
push 0x271a
push edi
mov dword [ebp - 4], 0x1c
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425310
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
push 0
push edi
call fcn.00424c30
add esp, 8
mov dword [ebp - 4], 0x1d
jmp 0x4251d3
mov eax, dword [edi]
cmp ecx, 0xc352
jne 0x4253b0
mov dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x1f
push ecx
push 0x5a4044
push 0x271f
push edi
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425389
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x10]
cmp dword [ebp - 0x14], 0
je 0x425386
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x425386
push 0
push dword [esi + 0x2c]
push dword [esi + 0x28]
push edi
call fcn.00424d30
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x20
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0x22
push ecx
push 0x5a4064
push 0x271a
push edi
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4253e0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0x23
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 4], 0xc353
lea ebx, [esi + 0x14]
jne 0x425435
push dword [ebx]
push 0
push 0x14d
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x10]
call fcn.004020a0
mov esi, dword [ebp - 0x10]
mov ecx, 1
mov dword [ebp - 4], 0x24
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x42546c
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00408b50
mov esi, dword [ebp - 0x10]
cmp dword [esi - 8], 0x104
jl 0x4255e0
push 0x104
mov dword [esi - 0xc], 0x104
xor eax, eax
push esi
mov word [esi + 0x208], ax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esi - 8]
push esi
call fcn.0056712f
add esp, 8
test eax, eax
js 0x4255e0
cmp eax, dword [esi - 8]
jg 0x4255e0
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov dword [ebp + 0xc], ecx
mov eax, dword [edi]
lea ecx, [ebp + 0xc]
push ecx
push 0x5a4074
push 0x2712
push edi
mov byte [ebp - 4], 0x26
call dword [eax + 0x38]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x425522
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
test ebx, ebx
je 0x4255db
mov eax, dword [ebp + 0xc]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
push ebx
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
je 0x42551f
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
push eax
call fcn.004020a0
push edi
call fcn.00426900
add esp, 8
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x27
test eax, eax
je 0x425530
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.00402410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0
mov eax, dword [edi]
lea ecx, [ebp - 0x14]
push ecx
push 0x5a4084
push 0x2714
push edi
mov dword [ebp - 4], 0x29
call dword [eax + 0x38]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x425595
movsd xmm0, qword [0x5a4098]
sub esp, 0x10
mov ecx, dword [eax]
movsd qword [esp + 8], xmm0
xorps xmm0, xmm0
movsd qword [esp], xmm0
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0x2a
test eax, eax
je case.0x424fb3.5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push dword [esi + 0x2c]
push dword [esi + 0x28]
push edi
call fcn.00424d30
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0040a040
push 0x80070057
call fcn.00403cc0
nop
mov edx, 0xdd00424f
dec edi
inc edx
add byte [eax + 0x7004255], bh
push esp
inc edx
add cl, cl
push ebp
inc edx
add byte [edi - 0x29ffbdaf], al
push edx
inc edx
add byte [0x96004250], bh
push eax
inc edx
add byte [esi], ch
push ecx
inc edx
add byte [edx + 0x55], cl
inc edx
add cl, cl
push ebp
inc edx
add cl, cl
push ebp
inc edx
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp