Function at 0x409510
Capabilities:
Query environment variable
Write file on windows

Disassembly:
xor eax, eax
movsx edx, word [eax + eax + 0x40ff60]
mov word [edx + edx + 0x412da0], ax
movsx edx, word [eax + eax + 0x40ff40]
mov word [edx + edx + 0x414620], ax
add eax, 1
cmp eax, 0x10
jne 0x409512
push edi
push esi
xor ecx, ecx
push ebx
mov edx, 0xffffffff
mov eax, 0xffffffff
sub esp, 0x40
mov word [0x412dc4], dx
mov word [0x412d80], cx
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov word [0x412dc0], ax
mov dword [esp], 0xfffffff5
call ebx
sub esp, 4
mov dword [0x40e384], eax
mov dword [0x40e388], eax
mov dword [esp], 0xfffffff6
call ebx
sub esp, 4
mov dword [0x40e380], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
cmp eax, 2
jne 0x40981e
call dword [sym.imp.KERNEL32.dll_GetVersion]
not eax
mov dword [esp], str.WT_SESSION
shr eax, 0x1f
mov byte [0x412340], al
call sym._getenv
test eax, eax
setne dl
test dl, dl
mov byte [0x412dc2], dl
je 0x4097f0
xor ecx, ecx
xor ebx, ebx
xor eax, eax
test dl, dl
mov byte [0x414604], cl
jne 0x4097c0
test bl, bl
jne 0x4097d0
lea eax, [esp + 0x2a]
mov byte [0x414605], dl
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 4], eax
mov eax, dword [0x40e384]
mov dword [esp], eax
call ebx
mov eax, dword [0x40e384]
sub esp, 8
mov dword [esp + 4], 0x4123e0
mov dword [esp], eax
call ebx
mov eax, dword [0x40e380]
sub esp, 8
mov dword [esp + 4], 0x412344
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x412344]
sub esp, 8
and eax, 0x40
cmp byte [0x414605], 0
mov dword [0x414600], eax
mov eax, dword [0x412040]
mov dword [eax + 0x2c], 0x96
mov byte [eax + 6], 1
mov dword [eax + 0x6c], 0xff200000
je 0x409670
mov dword [eax + 0x6c], 0xff380000
movzx edx, word [esp + 0x32]
mov dword [eax + 0x48], 0
mov byte [eax + 9], 1
mov ecx, edx
and edx, 0xf0
and ecx, 0xf
sar edx, 4
mov word [eax + 0xa], cx
mov word [eax + 0xc], dx
mov dword [esp], str.PDC_RESTORE_SCREEN
call sym._getenv
test eax, eax
je 0x4096ab
cmp byte [eax], 0x30
je 0x4096f5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov dword [esp], 0xc0000000
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
sub esp, 0x14
cmp eax, 0xffffffff
mov dword [0x40e384], eax
je 0x40980f
mov eax, dword [0x412040]
mov dword [eax + 0x48], 1
mov dword [esp], sym.__restore_console_4
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
sub esp, 4
mov dword [0x412348], eax
mov dword [esp + 4], 1
mov dword [esp], sym.__ctrl_break_4
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
mov ebx, dword [0x412040]
mov dword [esp], str.PDC_PRESERVE_SCREEN
call sym._getenv
test eax, eax
mov eax, dword [0x40e384]
setne byte [ebx + 0x44]
mov dword [esp + 4], 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
sub esp, 8
test eax, eax
je 0x409763
mov eax, dword [0x412040]
or dword [eax + 0x6c], 0x160000
call sym._PDC_reset_prog_mode
mov eax, dword [0x412040]
mov byte [eax + 7], 0
mov dword [esp], str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.GetConsoleScreenBufferInfoEx
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4123f8], eax
mov dword [esp], esi
mov dword [esp + 4], str.SetConsoleScreenBufferInfoEx
call ebx
sub esp, 8
mov dword [0x4123fc], eax
xor eax, eax
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov edx, 1
jmp 0x4095ed
mov edi, 0x40fec6
mov ecx, 3
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
sete dl
jmp 0x4095ed
mov dword [esp], str.ConEmuANSI
call sym._getenv
test eax, eax
movzx edx, byte [0x412dc2]
setne bl
mov ecx, ebx
jmp 0x4095d7
mov eax, dword [0x40e388]
mov dword [0x40e384], eax
jmp 0x4096f5
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str._nRedirection_is_not_supported._n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov dword [esp], 1
call sym._exit
lea esi, [esi]
lea edi, [edi]