Function at 0x435ceb
Capabilities:
Query environment variable

Disassembly:
push 0x4c
mov eax, 0x45b2fd
call fcn.00438c9e
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x44]
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x54], eax
xor eax, eax
stosd dword es:[edi], eax
push 7
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], esi
mov word [ebp - 0x44], ax
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], esi
mov word [ebp - 0x2c], ax
push 0x4061dc
push ebx
mov byte [ebp - 4], 1
mov byte [ebp - 0x55], cl
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435d55
push 0x1a
pop esi
push 0x4061f8
jmp 0x435df5
push 0x406208
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435d6a
push 0x23
jmp 0x435dd9
push 0x4011f4
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435d85
push 0x2b
pop esi
push 0x406230
jmp 0x435df5
push 0x406264
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435d9a
push 0x1c
jmp 0x435dd9
push 0x40628c
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435db5
push 0x26
pop esi
push 0x4062b4
jmp 0x435df5
push 0x4062d0
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
je 0x435e28
push 0x4062ec
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435ddc
push 0x25
pop esi
jmp 0x435e28
push 0x406308
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435dff
push 0x24
pop esi
push 0x406324
lea ecx, [ebp - 0x44]
call fcn.00414f74
jmp 0x435e28
push 0x404f38
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435f66
push 0x24
pop esi
push 0x406324
lea ecx, [ebp - 0x44]
call fcn.00414f74
mov byte [ebp - 0x55], 1
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.00437ebd
pop ecx
pop ecx
test al, al
je 0x435e68
cmp byte [ebp - 0x55], 0
jne 0x435f2c
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x2c]
cmp eax, ecx
je 0x435e60
cmp dword [ebp - 0x18], 8
jb 0x435e55
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00414f9b
xor ebx, ebx
inc ebx
jmp 0x435f68
cmp dword [ebp - 0x34], 0
jbe 0x435f66
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
jb 0x435e7e
mov eax, dword [ebp - 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push eax
call edi
mov esi, eax
test esi, esi
je 0x435f66
xor eax, eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00415001
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
jb 0x435ec0
mov eax, dword [ebp - 0x44]
push esi
mov esi, dword [ebp - 0x50]
push esi
push eax
call edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.00414f74
cmp byte [ebp - 0x55], 0
jne 0x435f13
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x2c]
cmp eax, ecx
je 0x435ef5
cmp dword [ebp - 0x18], 8
jb 0x435eea
mov ecx, dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00414f9b
test esi, esi
je 0x435e60
mov eax, dword [ebp - 0x48]
sub eax, esi
and eax, 0xfffffffe
push eax
push esi
call fcn.00413839
pop ecx
pop ecx
jmp 0x435e60
mov byte [ebp - 4], 1
test esi, esi
je 0x435f2c
mov eax, dword [ebp - 0x48]
sub eax, esi
and eax, 0xfffffffe
push eax
push esi
call fcn.00413839
pop ecx
pop ecx
push 0x404f38
push ebx
call fcn.0043d4d1
pop ecx
pop ecx
test eax, eax
jne 0x435f66
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
jb 0x435f49
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x54]
xor ecx, ecx
push ecx
push ecx
push ecx
push esi
push eax
call fcn.004370f8
push esi
call fcn.0043489f
add esp, 0x18
jmp 0x435e60
xor bl, bl
mov eax, dword [ebp - 0x18]
mov esi, 0x1000
cmp eax, 8
jb 0x435fa7
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x14], ecx
cmp eax, esi
jb 0x435f9e
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00414eaa
mov eax, dword [ebp - 0x54]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.00438c1d
pop ecx
pop ecx
and dword [ebp - 0x1c], 0
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 7
cmp eax, 8
jb 0x435ff2
mov ecx, dword [ebp - 0x44]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x54], ecx
cmp eax, esi
jb 0x435fe9
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00414eaa
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x54]
push eax
push ecx
call fcn.00438c1d
pop ecx
pop ecx
mov al, bl
call fcn.00438c4d
ret