Function at 0xf03a8e1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0xf0ad034]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
push 6
mov dword [ebp - 0x44c], eax
pop ecx
xor eax, eax
mov dword [ebp - 0x46c], edx
lea edi, [ebp - 0x468]
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x444], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x43c], edx
mov dword [ebx], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
mov dword [ebp - 0x440], eax
je 0xf03ab39
mov edi, dword [ebp - 0x44c]
push 0x5c
push edi
call fcn.0f09a7c0
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x434], eax
jne 0xf03a96b
mov dword [ebp - 0x434], edi
jmp 0xf03a972
add dword [ebp - 0x434], 2
push 0xd
push dword [ebp - 0x434]
lea eax, [ebp - 0x20]
push eax
call fcn.0f09a740
and word [ebp - 0x220], 0
and dword [ebp - 0x24c], 0
add esp, 0xc
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x440]
lea eax, [ebp - 0x20]
push eax
push edi
call sub.appHelp.dll_ApphelpGetNTVDMInfo
test eax, eax
je 0xf03ab39
mov ecx, dword [ebp - 0x460]
mov edi, 0x80000000
mov dword [esi], ecx
xor eax, eax
mov edx, edi
test ecx, edx
je 0xf03a9e6
inc eax
shr edx, 1
jne 0xf03a9e1
test eax, eax
je 0xf03aaa3
lea eax, [eax + eax*2]
shl eax, 2
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x448], eax
je 0xf03aaa3
xor ebx, ebx
lea esi, [eax + 8]
mov eax, dword [ebp - 0x450]
mov eax, dword [eax]
test edi, eax
je 0xf03aa4a
push eax
push edi
push dword [ebp - 0x454]
call fcn.0f03a538
test eax, eax
je 0xf03aa4a
mov ecx, dword [eax + 0x10]
mov dword [esi - 8], ecx
mov ecx, dword [eax + 0x14]
push eax
mov dword [esi - 4], ecx
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
add esi, 0xc
shr edi, 1
jne 0xf03aa14
test ebx, ebx
jle 0xf03aa8b
lea esi, [ebx + ebx*2]
shl esi, 2
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x43c], eax
je 0xf03aa8b
mov ecx, esi
mov esi, dword [ebp - 0x448]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x444]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [eax], ebx
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x450]
mov ebx, dword [ebp - 0x444]
mov edi, 0x1000000
test dword [esi], edi
je 0xf03ab0e
mov ecx, dword [ebx]
test ecx, ecx
jle 0xf03ab0e
xor eax, eax
test ecx, ecx
jle 0xf03ab0e
mov edx, dword [ebp - 0x43c]
lea ecx, [edx + 8]
cmp dword [ecx], edi
je 0xf03aacf
inc eax
add ecx, 0xc
cmp eax, dword [ebx]
jl 0xf03aac1
jmp 0xf03ab0e
push dword [ebp - 0x440]
lea ecx, [ebp - 0x430]
push dword [ebp - 0x434]
lea eax, [eax + eax*2]
push dword [ebp - 0x44c]
lea eax, [edx + eax*4]
push ecx
push dword [ebp - 0x438]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf18]
push dword [eax + 0x670]
push 2
call sym.ntvdm.exe_InitTaskDpmSupport
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [ebp - 0x438], 0
je 0xf03ab2e
push dword [ebp - 0x438]
call sub.appHelp.dll_SdbReleaseDatabase
push dword [ebp - 0x454]
call sub.appHelp.dll_SdbFreeFlagInfo
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x43c]
pop edi
pop esi
pop ebx
call fcn.0f01dda0
leave
ret 0xc