Function at 0x115e075
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x128549c
call fcn.01160458
sub esp, 0x54
push ebx
mov dword [ebp - 0x30], ecx
add ecx, 0x18
push esi
mov dword [ebp - 0x40], ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x3c], bl
call fcn.0105d927
mov dword [ebp - 4], ebx
push ebx
push 4
lea eax, [ebp - 0x18]
push eax
call fcn.0117abad
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0107c805
mov esi, eax
cmp esi, ebx
jl 0x115e14e
push dword [ebp - 0x18]
push 0x100fb60
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp eax, ebx
je 0x115e7e0
push ebx
push 1
lea eax, [ebp - 0x2c]
push eax
call fcn.0117abad
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x1c]
call fcn.01045da0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.01045295
push 0x100fb44
lea ecx, [ebp - 0x1c]
call fcn.01052ada
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 5
mov ecx, dword [0x12d28f8]
lea eax, [ebp - 0x14]
push eax
push 0x100fe14
push 0x17
push ebx
push 0x100fe04
call fcn.0116ba80
mov esi, eax
cmp esi, ebx
jge 0x115e171
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e142
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e16a
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, esi
jmp 0x115e6d9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
call fcn.0114139d
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
lea esi, [ebp - 0x10]
push esi
sub esp, 0x10
mov edi, esp
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
call dword [edx + pe_nt_image_headers32]
mov edi, eax
mov byte [ebp - 4], 5
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x60]
push eax
call esi
cmp edi, ebx
jl 0x115e1eb
movsx eax, word [ebp - 0x10]
cmp eax, ebx
je 0x115e7c3
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push eax
call dword [ecx + 0xb4]
mov edi, eax
cmp edi, ebx
jge 0x115e22b
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e1eb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e1fc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e224
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, edi
jmp 0x115e6d9
mov word [ebp - 0x50], bx
mov byte [ebp - 4], 8
push 0x100fb34
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x50]
push edx
push dword [ebp - 0x2c]
push eax
call dword [ecx + 0xb0]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x2c]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
cmp dword [ebp - 0x28], ebx
jge 0x115e2cb
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e28a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e29b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e2c3
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, dword [ebp - 0x28]
jmp 0x115e6d9
push 3
push ebx
lea eax, [ebp - 0x50]
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
cmp eax, ebx
mov dword [ebp - 0x2c], eax
jl 0x115e33b
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp + 8]
jbe 0x115e4d2
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 0xa
push 0x100fb1c
lea ecx, [ebp - 0x28]
call fcn.01061a86
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp - 0x14]
call dword [ecx + 0x90]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x28]
call edi
cmp dword [ebp - 0x2c], ebx
jge 0x115e397
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x115e33b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e356
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e367
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e38f
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, dword [ebp - 0x2c]
jmp 0x115e6d9
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x30]
push dword [ebp + 8]
call fcn.0115dd46
cmp eax, ebx
mov dword [ebp + 0xc], eax
jge 0x115e419
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x115e3bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e3d8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e411
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, dword [ebp + 0xc]
jmp 0x115e6d9
mov ecx, 0x12d2398
call fcn.0107cca6
push eax
lea ecx, [ebp - 0x28]
call fcn.01039a07
mov byte [ebp - 4], 0xc
push dword [0x12cf8a4]
lea ecx, [ebp - 0x28]
call fcn.01052ada
mov dword [ebp + 0xc], ebx
mov byte [ebp - 4], 0xd
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push dword [ebp - 0x28]
lea ecx, [ebp + 0xc]
push SysReAllocString
call fcn.01061aa6
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
jne 0x115e471
mov byte [ebp - 4], 0xc
lea ecx, [ebp + 0xc]
jmp 0x115e493
push dword [0x12cf8bc]
lea ecx, [ebp + 0xc]
push dword [ebp - 0x48]
call fcn.01061afb
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp + 0xc]
jne 0x115e4b0
call fcn.01044c64
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
call fcn.010328fe
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
jmp 0x115e79e
call fcn.01044c64
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
call fcn.010328fe
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x115e4d2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 0xe
push 0x100fb04
lea ecx, [ebp + 0xc]
call fcn.01061a86
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
lea edx, [ebp - 0x24]
push edx
push eax
push dword [ebp - 0x14]
call dword [ecx + 0x90]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0xe
push dword [ebp + 0xc]
call edi
cmp dword [ebp + 8], ebx
jl 0x115e532
mov ecx, dword [ebp - 0x30]
add ecx, 0xc
mov dword [ebp - 0x38], ecx
call fcn.01066e23
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0x20]
cmp eax, ebx
mov dword [ebp + 8], eax
jge 0x115e59f
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x115e543
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e55e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e56f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e597
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, dword [ebp + 8]
jmp 0x115e6d9
cmp dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
jle 0x115e672
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push dword [ebp - 0x2c]
push eax
call dword [ecx + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x30], eax
jl 0x115e6f3
mov dword [ebp - 0x28], ebx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push eax
call dword [ecx + 0x68]
cmp eax, ebx
mov dword [ebp - 0x30], eax
jl 0x115e6ea
mov eax, dword [0x12ce0a0]
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, 0x104
push eax
push eax
lea ecx, [ebp + 0xc]
call fcn.0103297b
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x115e771
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
call fcn.010329e8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp + 0xc]
push eax
call fcn.01091f5f
cmp eax, ebx
je 0x115e771
mov byte [ebp - 4], 0x11
lea ecx, [ebp + 0xc]
call fcn.010328fe
mov byte [ebp - 4], 0x10
push dword [ebp - 0x28]
call edi
mov byte [ebp - 4], 0xe
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x115e663
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x34]
jl 0x115e5ab
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x115e683
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e69e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e6af
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e6d7
lea ecx, [ebp - 0x40]
call fcn.0105d95a
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
mov byte [ebp - 4], 0x10
push dword [ebp - 0x28]
call edi
mov byte [ebp - 4], 0xe
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x115e704
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x115e715
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e730
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e741
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e769
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, dword [ebp - 0x30]
jmp 0x115e6d9
mov byte [ebp - 4], 0x11
lea ecx, [ebp + 0xc]
call fcn.010328fe
mov byte [ebp - 4], 0x10
push dword [ebp - 0x28]
call edi
mov byte [ebp - 4], 0xe
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x115e797
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x115e7a8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x50]
push eax
call esi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x115e7c3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x115e7d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.010328fe
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x3c], bl
je 0x115e7fc
lea ecx, [ebp - 0x40]
call fcn.0105d95a
mov eax, 0x80004005
jmp 0x115e6d9