Function at 0x430025
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x430188
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x430168
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43011e
push 1
lea ecx, [ebp - 0x88]
call fcn.00437959
mov dword [ebp - 0xc], 0x94964a53
mov dword [ebp - 8], 0
jmp 0x4300a4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x4300c0
push dword [ebp - 8]
lea ecx, [ebp - 0x88]
call fcn.00437a47
mov dword [eax], 0xb0f7
jmp 0x43009d
mov dword [ebp - 0xc], 0
jmp 0x4300d0
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x430111
mov dword [ebp - 0x54], 0x80849f84
lea eax, [ebp - 0x54]
push eax
push 1
push 1
push 1
push 0x28cc
push 0x8c5
push 0x7d2c
push 0x6aa4
lea eax, [ebp - 0x88]
push eax
push 0x60ff
call fcn.0042b3cb
add esp, 0x28
jmp 0x4300c9
lea ecx, [ebp - 0x88]
call fcn.00437a2b
jmp 0x430166
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43014c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x430166
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.00437a47
and dword [eax], 0
jmp 0x430141
jmp 0x430183
push 0
push 0x409
push 0x6d4e
push 1
push 0x6a87
call fcn.00417a3e
add esp, 0x14
jmp 0x4302c9
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x7c]
movzx eax, byte [eax]
test eax, eax
je 0x430247
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4301dc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
jmp 0x430242
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x430242
push 0x6642
push 0x3d11
push 0x2c10
push 1
push 0x181c
push 0x67fd
push 0x4313
push 0x47da
push 0
push 0x5f5
push 1
push 0x567
push 0x342f
push 0x6e68
push 1
push 0x54e8
push 1
push 0
call fcn.00414f98
add esp, 0x48
jmp 0x4302c9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x4302a4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x4302a2
push 1
push 0x1a1e
push 0x7c42
push 0x1cb1
push 0x7188
push 1
push 1
push 0
push 0x789e
call fcn.0041b96d
add esp, 0x24
jmp 0x4302c9
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
test eax, eax
je 0x4302c9
push 0x1f6d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esp, ebp
pop ebp
ret