Function at 0x1000aa00
Capabilities:
Query environment variable
Read file on windows

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x1c]
push esi
test ecx, ecx
push edi
mov dword [esp + 0x24], ecx
jne 0x1000aaea
mov ecx, dword [0x100556d4]
test ecx, ecx
mov dword [esp + 0x24], ecx
jne 0x1000aaea
mov edi, dword [sym.imp.MSVCRT.dll_getenv]
push str.ISC_MSGS
call edi
add esp, 4
test eax, eax
je 0x1000aa4e
push eax
lea eax, [esp + 0x28]
push eax
call sym.fbclient.dll_gds__msg_open
test eax, eax
je 0x1000aae0
push 0x104
call sym.fbclient.dll_gds__alloc
mov esi, eax
test esi, esi
jne 0x1000aa6a
pop edi
mov ax, 0xfffe
pop esi
add esp, 0x18
ret 0x18
push str.LC_MESSAGES
call edi
mov edi, eax
add esp, 4
test edi, edi
je 0x1000aab3
push edi
call fcn.1000c850
add esp, 4
lea ecx, [esp + 8]
push edi
push str.intl__.8s.msg
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 8]
push edx
push esi
call sym.fbclient.dll_gds__prefix_msg
lea eax, [esp + 0x24]
push esi
push eax
call sym.fbclient.dll_gds__msg_open
mov edi, eax
test edi, edi
je 0x1000aacb
push str.firebird.msg
push esi
call sym.fbclient.dll_gds__prefix_msg
lea ecx, [esp + 0x24]
push esi
push ecx
call sym.fbclient.dll_gds__msg_open
mov edi, eax
push esi
call sym.fbclient.dll_gds__free
test edi, edi
je 0x1000aae0
mov ax, di
pop edi
pop esi
add esp, 0x18
ret 0x18
mov ecx, dword [esp + 0x24]
mov dword [0x100556d4], ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
and eax, 0xffff
and edx, 0xffff
push ebx
mov ebx, dword [ecx]
lea eax, [eax + eax*4]
push ebp
mov ebp, 1
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edi, [eax + eax*4]
xor eax, eax
mov ax, word [ecx + 8]
shl edi, 4
add edi, edx
lea edx, [eax + ecx + 0xc]
mov dword [esp + 0x30], edx
xor esi, esi
mov eax, dword [ecx + 4]
push 0
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__lseek]
add esp, 0xc
test eax, eax
jge 0x1000ab46
mov ecx, dword [esp + 0x2c]
mov esi, 0xfffffffa
jmp 0x1000ab9b
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov cx, word [eax + 8]
lea edx, [eax + 0xc]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jge 0x1000ab71
mov ecx, dword [esp + 0x2c]
mov esi, 0xfffffff9
jmp 0x1000ab9b
mov ecx, dword [esp + 0x2c]
cmp bp, word [ecx + 0xa]
je 0x1000abad
test esi, esi
lea eax, [ecx + 0xc]
jne 0x1000ab9b
cmp eax, dword [esp + 0x30]
jae 0x1000ab91
cmp dword [eax], edi
jae 0x1000ab98
add eax, 8
jmp 0x1000ab82
mov esi, 0xfffffff8
jmp 0x1000ab9b
mov ebx, dword [eax + 4]
inc ebp
test esi, esi
je 0x1000ab27
pop ebp
pop ebx
mov ax, si
pop edi
pop esi
add esp, 0x18
ret 0x18
test esi, esi
jne 0x1000ac37
lea eax, [ecx + 0xc]
cmp eax, dword [esp + 0x30]
jae 0x1000ac34
mov ecx, dword [eax]
cmp ecx, edi
ja 0x1000ac34
je 0x1000abd6
xor ecx, ecx
mov cx, word [eax + 4]
add ecx, 0xb
and ecx, 0xfffffffc
add eax, ecx
jmp 0x1000abb8
mov edx, dword [esp + 0x38]
xor ecx, ecx
mov cx, word [eax + 4]
and edx, 0xffff
dec edx
cmp edx, ecx
jge 0x1000abed
mov ecx, edx
mov ebx, dword [esp + 0x3c]
mov edx, ecx
and edx, 0xffff
lea esi, [eax + 8]
mov ecx, edx
mov edi, ebx
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x40]
mov byte [edx + ebx], 0
test ecx, ecx
je 0x1000ac21
mov dx, word [eax + 6]
mov word [ecx], dx
xor esi, esi
pop ebp
mov si, word [eax + 4]
pop ebx
mov ax, si
pop edi
pop esi
add esp, 0x18
ret 0x18
or esi, 0xffffffff
pop ebp
pop ebx
mov ax, si
pop edi
pop esi
add esp, 0x18
ret 0x18