Function at 0x425c8f
Capabilities:
Query environment variable

Disassembly:
push 0x70
mov eax, 0x434366
call fcn.004318dd
mov ebx, ecx
mov dword [ebp - 0x68], ebx
mov edi, dword [ebp + 8]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x70], esp
mov esi, 0x40b018
push esi
call fcn.0041314d
and dword [ebp - 4], 0
sub esp, 0x18
mov ecx, esp
push 0x408d70
call fcn.0041314d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
push 0x306
call fcn.00412723
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 1
and dword [ebp - 0x6c], 0
mov dword [ebx + 0x4c], eax
push 0x40b058
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x74], esp
push 0x403d04
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x70], esp
push esi
call fcn.0041314d
push 0x30c
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
push 0x408d70
call fcn.0041314d
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 2
push eax
call fcn.004125b8
mov eax, dword [edi]
lea ecx, [ebp - 0x6c]
add esp, 0x54
mov esi, dword [eax + 0xc]
push ecx
push edi
mov ecx, esi
call dword [0x43b26c]
call esi
mov esi, eax
test esi, esi
js 0x426228
and dword [ebp - 0x78], 0
push 0x40b098
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x403d04
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x74], esp
push 0x40b018
call fcn.0041314d
push 0x30f
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
push 0x408d70
call fcn.0041314d
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 6
push eax
call fcn.004125b8
mov eax, dword [edi]
lea ecx, [ebp - 0x78]
add esp, 0x54
mov esi, dword [eax + 0x10]
push ecx
push edi
mov ecx, esi
call dword [0x43b26c]
call esi
mov esi, eax
test esi, esi
jns 0x425e4b
push 0x40b098
sub esp, 0x18
mov ecx, esp
push 0x403ccc
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
push esi
sub esp, 0x18
mov ecx, esp
push 0x403c90
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.00412874
mov byte [ebp - 4], 9
mov ecx, eax
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 6
jmp 0x426299
push 0x40b0f0
sub esp, 0x18
mov byte [ebp - 0x61], 0
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x403d04
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x74], esp
push 0x40b018
call fcn.0041314d
push 0x312
sub esp, 0x18
mov byte [ebp - 4], 0xb
mov ecx, esp
push 0x408d70
call fcn.0041314d
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 6
push eax
call fcn.004125b8
mov eax, dword [edi]
lea ecx, [ebp - 0x61]
add esp, 0x54
mov esi, dword [eax + 0x14]
push ecx
push edi
mov ecx, esi
call dword [0x43b26c]
call esi
mov esi, eax
test esi, esi
jns 0x425f0d
push 0x40b0f0
sub esp, 0x18
mov ecx, esp
push 0x403ccc
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
push esi
sub esp, 0x18
mov ecx, esp
push 0x403c90
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.00412874
mov byte [ebp - 4], 0xc
jmp 0x425e1f
and dword [ebp - 0x7c], 0
push 0x40b140
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x403d04
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x74], esp
push 0x40b018
call fcn.0041314d
push 0x315
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
push 0x408d70
call fcn.0041314d
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xd
push eax
call fcn.004125b8
mov eax, dword [edi]
lea ecx, [ebp - 0x7c]
add esp, 0x54
mov esi, dword [eax + 0x18]
push ecx
push edi
mov ecx, esi
call dword [0x43b26c]
call esi
mov esi, eax
test esi, esi
jns 0x425ffa
push 0x40b140
sub esp, 0x18
mov ecx, esp
push 0x403ccc
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
push esi
sub esp, 0x18
mov ecx, esp
push 0x403c90
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.00412874
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 0xd
jmp 0x426299
mov edx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x28]
call fcn.0041a469
push eax
mov ecx, ebx
call fcn.00418e76
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00413b40
mov edx, dword [ebp - 0x78]
lea ecx, [ebp - 0x28]
call fcn.0041a469
push eax
lea ecx, [ebx + 0x18]
call fcn.00418e76
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00413b40
movzx eax, byte [ebp - 0x61]
lea esi, [ebx + 0x50]
push eax
push 1
mov ecx, esi
call fcn.0041a80f
mov edx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x28]
call fcn.0041a469
push eax
mov ecx, ebx
call fcn.00418e76
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00413b40
push 0
push 0x104
mov ecx, esi
call fcn.00413aec
cmp dword [esi + 0x14], 8
jb 0x426081
mov eax, dword [esi]
jmp 0x426083
mov eax, esi
push dword [ebx + 0x60]
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x4261ad
push 0x40b1a8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x60], esp
push 0x404ef0
call fcn.0041314d
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ebp - 0x74], esp
push 0x40b018
call fcn.0041314d
push 0x320
sub esp, 0x18
mov byte [ebp - 4], 0x12
mov ecx, esp
push 0x408d70
call fcn.0041314d
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0xd
push eax
call fcn.004125b8
add esp, 0x54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jg 0x4260fd
mov ebx, edi
jmp 0x426106
movzx ebx, di
or ebx, 0x80070000
test edi, edi
je 0x4261aa
push 0x40b1a8
sub esp, 0x18
mov ecx, esp
push 0x4050c8
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
push edi
sub esp, 0x18
mov ecx, esp
push 0x405104
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x28]
mov edx, ebx
call fcn.00412874
mov ecx, eax
mov byte [ebp - 4], 0x13
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.00413b89
sub esp, 0x18
mov ecx, esp
push 0x403bd8
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x1c
mov dword [ebp - 0x68], ebx
jmp 0x4262bf
mov ebx, dword [ebp - 0x68]
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00412eff
lea ecx, [ebp - 0x28]
call fcn.0041d63e
push eax
mov ecx, esi
call fcn.00418e76
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00413b40
sub esp, 0x18
lea edi, [ebx + 0x68]
mov ecx, esp
push esi
call fcn.00412eff
mov ecx, edi
call fcn.00427dbb
test al, al
jne 0x4261fd
cmp edi, esi
je 0x4261fd
push 0xffffffffffffffff
push 0
push esi
mov ecx, edi
call fcn.00413018
push dword [ebp - 0x7c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x78]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x5c]
call fcn.004127db
call fcn.0043188c
ret 8
push 0x40b058
sub esp, 0x18
mov ecx, esp
push 0x403ccc
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
push esi
sub esp, 0x18
mov ecx, esp
push 0x403c90
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
lea ecx, [ebp - 0x28]
mov edx, esi
call fcn.00412874
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00413833
push eax
sub esp, 0x18
mov ecx, esp
push 0x403c6c
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x20
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00413b89
sub esp, 0x18
mov ecx, esp
push 0x403bd8
call fcn.0041314d
lea eax, [ebp - 0x5c]
push eax
call fcn.004124a5
add esp, 0x1c
mov dword [ebp - 0x68], esi
push 0x4394e4
lea eax, [ebp - 0x68]
push eax
call sub.msvcrt.dll__CxxThrowException
int3