Function at 0x49e210
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ebp + 0x24], 0
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
jne 0x49e3d5
push dword [ebp + 0x28]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push 0x83639c
push 0x836390
push eax
mov ecx, dword [esi]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
lea eax, [eax + ecx*4]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, ecx
push eax
call fcn.0049db30
add dword [esi], eax
add esp, 0x1c
mov esi, dword [0x836390]
test esi, esi
jne 0x49e27b
push str.DEFAULT_GROUP_SUFFIX_ENV
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
mov dword [0x836390], esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x49e2b1
cmp byte [0x8363a4], 0
jne 0x49e2b1
push 0x8365a8
push eax
call fcn.0049cc60
add esp, 8
test eax, eax
jne 0x49e4f6
mov esi, dword [0x836390]
mov dword [0x83638c], 0x8365a8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49e2e7
cmp byte [0x8363a4], 0
jne 0x49e2e7
push 0x8363a8
push eax
call fcn.0049cc60
add esp, 8
test eax, eax
jne 0x49e4f6
mov esi, dword [0x836390]
mov dword [0x836394], 0x8363a8
mov byte [0x8363a4], 1
test esi, esi
je 0x49e4c6
cmp dword [ebp + 0x18], 0x49dc50
jne 0x49e4c6
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x49e306
mov ebx, dword [ebp + 0x1c]
sub esi, ecx
mov edi, dword [ebx + 8]
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
lea eax, [eax*8 + 4]
push eax
push dword [ebx]
call fcn.0049b130
mov edx, eax
add esp, 8
mov dword [ebp - 8], edx
test edx, edx
jne 0x49e341
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [edi], ecx
jbe 0x49e3c0
lea eax, [esi + 1]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 8]
mov esi, dword [eax + ecx*4]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x14], eax
mov dword [eax], esi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x49e361
mov eax, dword [ebp - 0xc]
sub esi, ecx
add eax, esi
push eax
push dword [ebx]
call fcn.0049b130
mov edi, eax
add esp, 8
test edi, edi
je 0x49e335
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push esi
mov ecx, dword [ecx]
add ecx, dword [ebp - 4]
mov dword [eax + ecx*4], edi
mov eax, dword [ebp - 0x14]
push dword [eax]
push edi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0xc]
lea eax, [edi + esi]
push dword [0x836390]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0x18
mov edi, dword [ebp - 0x10]
inc ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, dword [edi]
jb 0x49e350
mov eax, dword [edi]
add eax, eax
mov dword [edi + 8], edx
mov dword [edi], eax
mov dword [edx + eax*4], 0
jmp 0x49e4c9
cmp dword [0x83639c], 0
mov ebx, dword [ebp + 0x1c]
je 0x49e4cc
cmp esi, 0x49dc50
jne 0x49e4cc
mov edi, dword [ebx + 8]
mov eax, dword [edi]
lea eax, [eax*4 + 0xc]
push eax
push dword [ebx]
call fcn.0049b130
mov edx, eax
add esp, 8
mov dword [ebp - 0xc], edx
test edx, edx
je 0x49e335
xor ecx, ecx
cmp dword [edi], ecx
jbe 0x49e42e
nop dword [eax + eax]
mov eax, dword [edi + 8]
mov eax, dword [eax + ecx*4]
mov dword [edx + ecx*4], eax
inc ecx
cmp ecx, dword [edi]
jb 0x49e420
mov eax, dword [0x83639c]
lea ecx, [edx + ecx*4]
mov dword [ecx], eax
mov esi, dword [0x836390]
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x49e4b6
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x49e448
mov ebx, dword [0x83639c]
sub esi, ecx
lea ecx, [ebx + 1]
nop word [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x49e460
sub ebx, ecx
lea eax, [esi + 1]
add eax, ebx
push eax
mov eax, dword [ebp + 0x1c]
push dword [eax]
call fcn.0049b130
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je 0x49e335
mov ecx, dword [ebp - 0x14]
push ebx
push dword [ecx]
mov dword [ecx + 4], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esi + 1]
push eax
push dword [0x836390]
mov eax, dword [ebp - 0x10]
add eax, ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp + 0x1c]
add esp, 0x18
inc dword [edi]
mov edx, dword [ebp - 0xc]
inc dword [edi]
mov eax, dword [edi]
mov dword [edi + 8], edx
mov dword [edx + eax*4], 0
jmp 0x49e4c9
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
push edi
call fcn.0049a440
add esp, 4
test eax, eax
je 0x49e4fd
push dword [ebp + 0x24]
push edi
push 0
push ebx
push esi
call fcn.0049d2f0
add esp, 0x14
test eax, eax
js 0x49e5af
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x836394]
test eax, eax
je 0x49e532
push dword [ebp + 0x24]
push 0
push eax
push 0x4fbd0e
push 0x4fbd0e
push ebx
push esi
call fcn.0049d360
add esp, 0x1c
test eax, eax
js 0x49e5af
jle 0x49e4f4
push dword [0x836394]
jmp 0x49e5a0
cmp byte [ebp + 0x28], 0
jne 0x49e4f4
mov esi, dword [ebp + 0x20]
cmp dword [esi], 0
je 0x49e4f4
mov eax, dword [esi]
cmp byte [eax], 0
je 0x49e55e
push dword [ebp + 0x24]
push edi
push eax
push ebx
push dword [ebp + 0x18]
call fcn.0049d2f0
add esp, 0x14
test eax, eax
js 0x49e5af
jmp 0x49e589
mov eax, dword [0x83638c]
test eax, eax
je 0x49e589
push dword [ebp + 0x24]
push 0
push eax
push 0x4fbd0e
push 0x4fbd0e
push ebx
push dword [ebp + 0x18]
call fcn.0049d360
add esp, 0x1c
test eax, eax
js 0x49e5af
jg 0x49e59a
add esi, 4
cmp dword [esi], 0
jne 0x49e540
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x83638c]
push str.Could_not_open_required_defaults_file:__s
push 0
call fcn.0049a1a0
add esp, 0xc
push str.Fatal_error_in_defaults_handling._Program_aborted_
push 0
call fcn.0049a1a0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret