Function at 0x61ef98
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
xor eax, ecx
push dword [0x4e60f8]
mov eax, 0x44072e
mov eax, 0x41c732
pop eax
push ebx
push ebp
push esi
push edi
mov edi, 0x44049a
rcl edi, 9
ror edi, 0x41
rcr edi, 0xbd
sbb edi, 0x63b1764e
lea edi, [eax + ecx + sym.imp.kernel32.dll_GetEnvironmentStringsW]
sub edi, ecx
sub edi, eax
push dword [edi]
ror edi, 0xe5
sub edi, 0x21
pop edi
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x61f12d
call edi
mov esi, 0x480b9e
ror esi, 0x6b
rol esi, 0x63
mov esi, 0x47378a
lea esi, [eax + 0x6f]
lea esi, [esi - 0x6f]
cmp esi, ebx
je 0x61f10c
mov dword [0x4e60f8], 1
cmp esi, ebx
jne 0x61f03f
call edi
mov esi, 0x4756d2
xor esi, dword [esp + 0x28]
sub esi, 0x1d
xor esi, dword [esp + 8]
or esi, ecx
lea esi, [eax + ebp + 8]
sub esi, ebp
lea esi, [esi - 8]
cmp esi, ebx
je 0x61f104
cmp word [esi], bx
mov eax, esi
je 0x61f06d
lea eax, [eax + ebp + 0x35]
sub eax, 0x35
cmp word [eax], bx
jne 0x61f04a
lea eax, [eax + ebp + 0x62]
lea eax, [eax + ecx - 0x62]
sub eax, ecx
cmp word [eax], bx
jne 0x61f04a
lea edi, [edi + eax*2 - 0x23]
add edi, dword [esp + 0x38]
mov edi, 0x427946
lea edi, [eax + sym.imp.kernel32.dll_WideCharToMultiByte]
sub edi, eax
mov edi, dword [edi]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
sub ebp, edi
add ebp, edi
lea ebp, [eax + 0x51]
lea ebp, [ebp + esi - 0x51]
sub ebp, esi
cmp ebp, ebx
je 0x61f0e6
push ebp
call fcn.0061ef84
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x61f0e6
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x61f0e2
push dword [esp + 0x10]
call fcn.00447227
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
and eax, ebp
lea eax, [ebp + esi - 0x4b]
lea eax, [ebx + 0x64]
lea eax, [eax + ebp - 0x64]
sub eax, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
xor eax, eax
jmp 0x61f0fc
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x61f204
or eax, ebx
sbb eax, 0xfea87054
lea eax, [ebp + 0x32]
lea eax, [eax - 0x32]
mov dword [0x4e60f8], eax
cmp eax, 1
jne 0x61f13c
jmp 0x61f012
cmp eax, ebp
je 0x61f154
cmp eax, ebx
je 0x61f154
jmp 0x61f104
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
xor esi, dword [esp + 0x28]
add esi, dword [esp + 0x38]
mov esi, 0x48e8fe
mov esi, dword [esp + 0x10]
and esi, ecx
lea esi, [eax + ebp + 0x62]
sub esi, ebp
lea esi, [ecx + esi - 0x62]
sub esi, ecx
cmp esi, ebx
je 0x61f104
cmp byte [esi], bl
je 0x61f19b
inc eax
cmp byte [eax], bl
jne 0x61f189
inc eax
cmp byte [eax], bl
jne 0x61f189
sub eax, esi
inc eax
sbb ebp, edi
xor ebp, edi
adc ebp, 0xda05ef5e
lea ebp, [eax + ecx + 0x7a]
sub ebp, ecx
lea ebp, [ebp - 0x7a]
push ebp
call fcn.0061ef84
mov edi, 0x40e16a
mov edi, 0x47c9e2
push eax
sbb edi, ecx
pop edi
cmp edi, ebx
pop ecx
jne 0x61f1f0
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
or eax, 0xf
mov eax, 0x411e34
push edi
rcl eax, 9
mov eax, 0x43d00a
pop eax
jmp 0x61f0fc
push ebp
push esi
push edi
call fcn.0044ac00
add esp, 0xc
jmp 0x61f1d0
or eax, ebp
lea eax, [ebp + 0x4293b8]
rcr eax, 0x1b
mov eax, 0x41bc7a
lea eax, [ecx + edx + 0x4e60f8]
sub eax, edx
sub eax, ecx
mov eax, dword [eax]
jmp 0x61f12d