Function at 0x406108
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x803c
call fcn.004161a4
push edi
push esi
push ebx
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x4000]
push ebx
push 0x79
call fcn.00401aa8
add esp, 0xfffffff8
push ebx
push 0x4060f3
call fcn.00407210
add esp, 0x20
mov dword [ebp - 0x4010], 0
mov dword [ebp - 0x400c], 0
mov dword [ebp - 0x4008], 0
add esp, 0xfffffff8
push 0x4044cb
push ebx
jmp 0x4061dc
add esp, 0xfffffff4
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00415f94
mov dword [ebp - 0x8024], eax
add esp, 0xfffffff8
push ebx
push eax
call sub.msvcrt.dll_strcpy
lea ecx, [ebp - 0x4010]
lea eax, [ebp - 0x8024]
add esp, 0x20
mov edx, dword [ebp - 0x400c]
cmp edx, dword [ebp - 0x4008]
je 0x4061c4
test edx, edx
je 0x4061b8
mov eax, dword [ebp - 0x8024]
mov dword [edx], eax
add dword [ebp - 0x400c], 4
jmp 0x4061d2
add esp, 0xfffffffc
push eax
push edx
push ecx
call fcn.0041b940
add esp, 0x10
add esp, 0xfffffff8
push 0x4044cb
push 0
call sub.msvcrt.dll_strtok
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4061ff
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp ecx, 0xfffffffe
jne 0x406168
mov dword [ebp - 0x8028], 0
jmp 0x406421
mov eax, dword [ebp - 0x8028]
shl eax, 2
add eax, dword [ebp - 0x4010]
mov esi, dword [eax]
add esp, 0xfffffff8
lea eax, [esi + 2]
push eax
lea edi, [ebp - 0x6020]
push edi
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff4
push edi
call fcn.00405b40
add esp, 0x20
cmp byte [esi + 1], 0x31
sete byte [ebp - 0x8029]
mov al, byte [esi]
cmp al, 0x44
je 0x4062d0
jg 0x40625c
cmp al, 0x41
je 0x4062d0
jmp 0x4063e6
cmp al, 0x45
je 0x406318
cmp al, 0x53
jne 0x4063e6
add esp, 0xfffffff8
push edi
lea ebx, [ebp - 0x8020]
push ebx
call fcn.004037e4
add esp, 0xfffffffc
push 0x4044cd
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.004064b0
mov byte [ebp - 0x802a], al
add esp, 0x20
add esp, 0xfffffffc
push 0x4044d1
push ebx
mov edx, dword [ebp + 8]
push edx
call fcn.004064b0
add esp, 0x10
cmp byte [ebp - 0x802a], 0
setne byte [ebp - 0x802a]
test al, al
setne al
movzx eax, al
or byte [ebp - 0x802a], al
jmp 0x4063e6
add esp, 0xfffffff8
push edi
lea ebx, [ebp - 0x8020]
push ebx
call fcn.00402fdc
add esp, 0xfffffff4
push ebx
call fcn.00403304
mov byte [ebp - 0x802a], al
add esp, 0x20
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push 0x4044cb
mov edx, dword [ebp + 8]
push edx
call sub.msvcrt.dll_strcat
add esp, 0x20
jmp 0x4063e6
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x8020]
push ebx
push edi
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 4
test eax, eax
je 0x4063c0
cmp byte [ebp - 0x8020], 0x22
jne 0x406378
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
cmp byte [ebx + ecx - 2], 0x22
jne 0x406378
mov edi, ebx
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov byte [ebx + ecx - 2], al
add esp, 0xfffffff8
lea eax, [ebp - 0x801f]
push eax
mov edx, dword [ebp + 8]
push edx
jmp 0x406380
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_strcat
add esp, 0x10
lea edx, [ebp - 0x8020]
mov edi, edx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
cmp byte [edx + ecx - 2], 0x3b
je 0x4063b7
add esp, 0xfffffff8
push 0x4044cb
mov edx, dword [ebp + 8]
push edx
call sub.msvcrt.dll_strcat
add esp, 0x10
mov byte [ebp - 0x802a], 1
jmp 0x4063e6
cmp byte [ebp - 0x8029], 0
je 0x40640f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xcb
jne 0x4063e6
add esp, 0xfffffff8
push edi
push 0x3f0
call fcn.004029e0
cmp byte [ebp - 0x8029], 0
je 0x40640f
cmp byte [ebp - 0x802a], 0
jne 0x40640f
add esp, 0xfffffff8
lea eax, [ebp - 0x6020]
push eax
push 0x3ee
call fcn.004029e0
add esp, 0xfffffff4
push esi
call fcn.004160b0
add esp, 0x10
inc dword [ebp - 0x8028]
mov eax, dword [ebp - 0x4010]
mov edx, dword [ebp - 0x400c]
sub edx, eax
mov eax, edx
sar eax, 2
cmp dword [ebp - 0x8028], eax
jb 0x406210
mov edi, dword [ebp - 0x4010]
mov eax, dword [ebp - 0x4008]
sub eax, edi
sar eax, 2
je 0x4064a0
shl eax, 2
cmp eax, 0x80
jbe 0x406468
add esp, 0xfffffff4
push edi
call sub.msvcrt.dll_free
jmp 0x4064a0
lea ebx, [eax + 7]
shr ebx, 3
lea ebx, [ebx*4 - 4]
add esp, 0xfffffff4
push 0x42f400
call sub.KERNEL32.dll_EnterCriticalSection
add esp, 0xc
mov eax, dword [ebx + 0x421c0c]
mov dword [edi], eax
mov dword [ebx + 0x421c0c], edi
add esp, 0xfffffff4
push 0x42f400
call sub.KERNEL32.dll_LeaveCriticalSection
lea esp, [ebp - 0x8048]
pop ebx
pop esi
pop edi
leave
ret