Function at 0x9fa5d0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0xa89f86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
mov al, byte [esp + 7]
push ebx
push ebp
xor ebp, ebp
xor ecx, ecx
xor edx, edx
push esi
mov byte [esp + 0x14], al
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x24c]
mov dword [esp + 0x240], ebp
cmp esi, ebp
mov byte [esp + 0x27], dl
mov byte [esp + 0x13], dl
mov ebx, 1
jne 0x9fa67f
call fcn.00a44480
test al, al
je 0x9fa651
mov byte [esp + 0x13], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [esp + 0x24c], eax
mov eax, dword [esp + 0x248]
mov ecx, dword [eax]
or ch, 4
mov dword [eax], ecx
jmp 0x9fa670
mov eax, dword [esp + 0x248]
mov ecx, dword [eax]
and ch, 0xfb
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [esp + 0x24c], eax
mov byte [esp + 0x27], bl
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x24c]
mov eax, dword [esp + 0x248]
push edi
test dword [eax], 0x400
jne 0x9fa7ac
xor edi, edi
cmp esi, ebp
jne 0x9fa726
cmp ecx, ebp
mov dword [esp + 0x10], ebp
je 0x9fa6b2
mov eax, edx
sub eax, ecx
sar eax, 1
cmp eax, 2
jae 0x9fa6cd
jmp 0x9fa6b4
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 2
sub ecx, eax
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.009fd870
jmp 0x9fa6f1
lea ecx, [esp + 0x18]
call fcn.009fd430
cmp eax, 2
jbe 0x9fa6f1
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add eax, 4
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.009fd660
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push ebx
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebp
call fcn.009fd870
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x20]
push eax
push ebx
push ecx
lea ecx, [esp + 0x24]
call fcn.009fd870
jmp 0x9fa8b3
cmp byte [edi + esi], 0
jne 0x9fa734
mov al, byte [edi + esi + 1]
test al, al
je 0x9fa737
inc edi
jmp 0x9fa726
add edi, 2
cmp ecx, ebp
mov dword [esp + 0x10], ebp
jne 0x9fa746
xor eax, eax
jmp 0x9fa74c
mov eax, edx
sub eax, ecx
sar eax, 1
cmp eax, edi
jae 0x9fa774
cmp ecx, ebp
jne 0x9fa758
xor eax, eax
jmp 0x9fa75e
mov eax, edx
sub eax, ecx
sar eax, 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
sub ecx, eax
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.009fd870
jmp 0x9fa797
lea ecx, [esp + 0x18]
call fcn.009fd430
cmp edi, eax
jae 0x9fa797
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push edx
lea ecx, [eax + edi*2]
push ecx
lea ecx, [esp + 0x20]
call fcn.009fd660
mov edx, dword [esp + 0x1c]
push edi
push edx
push edi
push esi
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x9fa8b3
xor edi, edi
cmp esi, ebp
jne 0x9fa82b
cmp ecx, ebp
mov dword [esp + 0x10], ebp
je 0x9fa7c7
mov eax, edx
sub eax, ecx
sar eax, 1
cmp eax, 2
jae 0x9fa7e2
jmp 0x9fa7c9
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 2
sub ecx, eax
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.009fd870
jmp 0x9fa806
lea ecx, [esp + 0x18]
call fcn.009fd430
cmp eax, 2
jbe 0x9fa806
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add eax, 4
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.009fd660
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push ebx
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebp
call fcn.009fd870
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
jmp 0x9fa711
mov eax, esi
cmp word [eax], bp
jne 0x9fa838
cmp word [eax + 2], bp
je 0x9fa83e
inc edi
add eax, 2
jmp 0x9fa82d
add edi, 2
cmp ecx, ebp
mov dword [esp + 0x10], ebp
jne 0x9fa84d
xor eax, eax
jmp 0x9fa853
mov eax, edx
sub eax, ecx
sar eax, 1
cmp eax, edi
jae 0x9fa87b
cmp ecx, ebp
jne 0x9fa85f
xor eax, eax
jmp 0x9fa865
mov eax, edx
sub eax, ecx
sar eax, 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
sub ecx, eax
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.009fd870
jmp 0x9fa89e
lea ecx, [esp + 0x18]
call fcn.009fd430
cmp edi, eax
jae 0x9fa89e
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push edx
lea ecx, [eax + edi*2]
push ecx
lea ecx, [esp + 0x20]
call fcn.009fd660
lea ecx, [edi + edi]
mov edi, dword [esp + 0x1c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
call fcn.00a155c0
mov esi, dword [esp + 0x254]
lea eax, [esp + 0x2c]
push eax
push esi
mov byte [esp + 0x24c], bl
call fcn.009fa0f0
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.009f9ee0
mov ebx, dword [esp + 0x26c]
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.009f9ee0
add esp, 0x18
xor edi, edi
mov eax, dword [0xab539c]
cmp eax, ebp
je 0x9fa927
mov ecx, dword [0xab53a0]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x9fa927
mov eax, dword [eax + edi*4]
lea edx, [esp + 0x18]
push edx
push eax
call fcn.009f9ee0
add esp, 8
inc edi
jmp 0x9fa8fb
push esi
lea ecx, [esp + 0x1c]
push str.TS_MOD0
push ecx
call fcn.009f9bd0
mov edi, dword [esp + 0x264]
lea edx, [esp + 0x24]
push edi
push 0xa9e534
push edx
call fcn.009f9bd0
push edi
lea eax, [esp + 0x34]
push str.TS_ORIGIN
push eax
call fcn.009f9bd0
push ebx
lea ecx, [esp + 0x40]
push str.TS_CWD
push ecx
call fcn.009f9bd0
push 0xaa1460
lea edx, [esp + 0x4c]
push str.TS_SUBPROC
push edx
call fcn.009f9bd0
call fcn.009f9580
push eax
lea eax, [esp + 0x58]
push str.TS_OPTIONS
push eax
call fcn.009f9bd0
mov ebp, dword [esp + 0x2a8]
add esp, 0x48
lea ecx, [esp + 0x18]
push ebp
push str.TS_USER_SID
push ecx
call fcn.009f9bd0
mov edx, dword [esp + 0x258]
add esp, 0xc
test byte [edx], 3
je 0x9fa9d7
push 0xaa1460
lea eax, [esp + 0x1c]
push str.TS_DEBUGGED
push eax
call fcn.009f9bd0
add esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.TS_MOD0
call esi
push edi
push 0xa9e534
call esi
push edi
push str.TS_ORIGIN
call esi
push ebx
push str.TS_CWD
call esi
push 0xaa1460
push str.TS_SUBPROC
call esi
call fcn.009f9580
push eax
push str.TS_OPTIONS
call esi
push ebp
push str.TS_USER_SID
call esi
mov edi, dword [esp + 0x24c]
test byte [edi], 3
je 0x9faa36
push 0xaa1460
push str.TS_DEBUGGED
call esi
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
test ah, 4
jne 0x9faa87
test ecx, ecx
jne 0x9faa49
xor eax, eax
jmp 0x9faa51
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 1
lea esi, [eax + 1]
push esi
call fcn.009ef3b0
mov ecx, dword [esp + 0x20]
add esp, 4
test ecx, ecx
mov ebx, eax
jne 0x9faa6b
xor eax, eax
jmp 0x9faa73
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 1
push 0
push 0
push esi
push ebx
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x9faabc
test ecx, ecx
jne 0x9faa8f
xor eax, eax
jmp 0x9faa97
mov eax, dword [esp + 0x20]
sub eax, ecx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.009ef3b0
mov ecx, esi
mov esi, dword [esp + 0x20]
mov ebx, eax
mov edx, ecx
mov edi, ebx
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0x2b]
pop edi
test al, al
je 0x9faad5
mov eax, dword [esp + 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x9faaeb
mov al, byte [esp + 0x13]
test al, al
je 0x9faaeb
mov ecx, dword [esp + 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea ecx, [esp + 0x28]
mov byte [esp + 0x240], 0
call fcn.00a155e0
mov edx, dword [esp + 0x18]
push edx
call fcn.00a7d8f0
mov ecx, dword [esp + 0x23c]
add esp, 4
mov eax, ebx
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0x238
ret