Function at 0x402221
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
push ebx
mov esi, 0x72
mov eax, esi
and eax, 0x6596
mov edx, esi
add edx, eax
movzx edi, dl
mov eax, esi
movzx edi, al
mov ebx, dword [ebp + 8]
mov ebx, 0x5d80
mov eax, edi
add eax, 0xbe
movzx esi, al
mov eax, edi
sub eax, 0x2459
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x357e5bc
mov eax, dword [ebp - 8]
mov word [ebp - 0xc], ax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x10a7aea6
mov dword [ebp - 0x18], 0x41235cd1
mov eax, esi
and eax, dword [ebp - 4]
mov edx, esi
imul edx, eax
movzx esi, dl
mov ebx, ebx
mov eax, dword [ebp + 8]
xor eax, 0x6fdd
sub eax, 0x6ab2
mov dword [ebp - 0x1c], eax
cmp edi, 0x72
je 0x4022b0
push 0x4cfb3
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ebp - 4]
shr eax, 3
movzx edi, al
mov eax, edi
mov dword [ebp - 4], eax
imul ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
xor eax, 0x10e7ee9a
mov dword [ebp - 0x14], eax
mov eax, esi
shr eax, 2
movzx edi, al
mov eax, dword [ebp - 4]
sub eax, edi
movzx edi, al
mov dword [ebp - 0x1c], 0x704a
mov eax, ebx
imul eax, eax, 0x1287
mov edx, dword [ebp + 8]
sub edx, eax
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
and eax, 0x49b9
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov word [ebp - 0x28], ax
cmp dword [ebp - 4], 0x83
je 0x402327
push 0xcefe7
push dword [ebp - 4]
push esi
push esi
call dword [sym.imp.MSVCRT.dll_sscanf]
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x24]
movzx edx, word [ebp - 0x28]
sub eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
movzx edi, al
mov eax, esi
and eax, dword [ebp - 4]
and eax, 0x5021
movzx esi, al
mov eax, dword [ebp + 8]
sub eax, 0x26e
add eax, dword [ebp - 0x20]
mov word [ebp - 0xc], ax
mov edx, dword [ebp - 0x2c]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x402389
mov eax, ebx
xor eax, 0x285a
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
sub eax, 0x10000
mov dword [ebp - 0x2c], eax
jmp 0x402362
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
add eax, 0x4e77
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x3c]
mov edx, dword [ebp - 0x14]
add edx, eax
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x78]
mov edx, dword [ebp - 0x2c]
add edx, eax
mov dword [ebp - 0x30], edx
mov ebx, 0x4ab5
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
and eax, 0x523a
imul eax, eax, 0x10ff
mov word [ebp - 0xc], ax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x20]
mov edx, dword [ebp - 0x2c]
add edx, eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4025fa
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, dword [ebp + 0x10]
and eax, dword [ebp + 0x10]
mov word [ebp - 0xc], ax
mov dword [ebp - 0x1c], 0x6e35
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
and eax, dword [ebp + 8]
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x20]
and eax, dword [ebp + 0xc]
and eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
and eax, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0xc]
mov ebx, eax
mov edx, dword [ebp - 0x38]
movzx eax, byte [edx]
test eax, eax
je 0x4024c4
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 8]
sub eax, 0x348d
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 0xc]
and eax, 0x1d13
movzx edx, word [ebp - 0xc]
add edx, eax
mov word [ebp - 0xc], dx
mov eax, dword [ebp - 0x3c]
shl eax, 7
mov edx, dword [ebp - 0x3c]
shr edx, 0x19
or eax, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x38]
movzx eax, byte [edx]
xor eax, 0x2d
mov edx, dword [ebp - 0x3c]
add edx, eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], 0x6d4f
mov eax, dword [ebp - 0x20]
sub eax, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
jmp 0x402453
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3c], eax
jne 0x4025c8
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x18]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
and eax, 0x2b35
movzx edi, al
cmp edi, 1
je 0x40250a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and eax, 0x251c
imul eax, eax, 0x7a30
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0x24], eax
mov eax, edi
or eax, 0xc80
mov edx, edi
add edx, eax
movzx esi, dl
mov dword [ebp - 0x1c], 0x4a2
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 8]
and eax, 0x730f
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x1c]
mov edx, dword [ebp - 0x2c]
add edx, eax
mov dword [ebp - 0x34], edx
mov eax, esi
add eax, dword [ebp - 4]
movzx esi, al
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, ebx
xor eax, 0x42cc
or eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + ecx*4]
mov edx, dword [ebp - 0x2c]
add edx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 0x48]
shl eax, 6
push eax
mov eax, dword [ebp - 0x48]
shl eax, 0xc
push eax
push 0x207a8
mov eax, dword [ebp - 0x48]
sub eax, 1
push eax
mov eax, dword [ebp - 0x48]
sub eax, 2
push eax
call dword [ebp - 0x10]
mov dword [0x426095], eax
mov eax, dword [ebp + 0x10]
xor eax, ebx
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 8]
xor eax, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
jmp 0x4023ed
mov eax, esi
or eax, 0xbdf
imul eax, dword [ebp - 4]
movzx edi, al
mov eax, dword [ebp - 0x20]
mov word [ebp - 0xc], ax
mov eax, esi
sub eax, 1
movzx esi, al
mov eax, edi
mov dword [ebp - 4], eax
mov eax, edi
shr eax, 2
movzx edi, al
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx edx, word [ebp - 0xc]
xor eax, edx
mov ebx, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc