Function at 0x100091c0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x3f6c
call fcn.10019c40
mov eax, dword [0x10025204]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push ebp
push esi
push edi
push eax
lea ecx, [esp + 0x24]
push 0x1001c5b4
push ecx
call ebx
push 0x10023218
call dword [sym.imp.MSVCRT.dll_time]
push 0x10023218
call dword [sym.imp.MSVCRT.dll_localtime]
mov esi, eax
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
lea edx, [esp + 0x1ff8]
push str._02d_02d_02d
push edx
call ebx
mov eax, dword [esi + 0x10]
add esp, 0x28
inc eax
mov edi, 0x1001cf50
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
mov edx, dword [esi + 0x14]
or ecx, 0xffffffff
xor eax, eax
add edx, 0x76c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x18], edx
lea edx, [esp + 0x34]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x34]
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1001cf4c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x1001cf4c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1fd8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1001cf48
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [0x10025220]
not ecx
dec ecx
cmp eax, ebp
jne 0x10009387
mov esi, dword [0x10025248]
mov edx, dword [0x10025244]
mov eax, dword [0x10025240]
push esi
push edx
push eax
lea eax, [esp + ecx + 0x40]
push str.xid___x__x__x:
push eax
call ebx
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, dword [esp + 0x3f80]
lea edx, [esp + 0x3f84]
push edx
lea ecx, [esp + ecx + 0x38]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov eax, dword [0x1001cbcc]
add esp, 0xc
test eax, eax
jge 0x1000946c
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.ULOGPFX
call esi
add esp, 4
mov dword [0x10023240], eax
test eax, eax
jne 0x100093de
push str.ULOG
call esi
add esp, 4
mov dword [0x10023240], eax
test eax, eax
je 0x100093e9
mov dword [0x1001cbcc], ebp
jmp 0x10009473
mov dword [0x1001cbcc], 0
mov edi, 0x1001c270
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
inc ebp
lea esi, [ebp + 0x60]
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
xor edx, edx
add esp, 4
cmp ebx, edx
jne 0x100095a2
push esi
push str.0003_malloc_error:_size___d
push str.CSC1406
push 2
call fcn.1000da50
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3f6c
ret
jle 0x100093f3
mov eax, dword [0x10023240]
mov ecx, dword [0x1001cbd0]
mov ebx, dword [sym.imp.MSVCRT.dll__close]
test ecx, ecx
jge 0x100094b5
lea edx, [esp + 0x10]
push eax
push edx
call fcn.10008fc0
mov edx, eax
add esp, 8
test edx, edx
mov dword [0x1001cbd0], edx
jge 0x1000950b
pop edi
pop esi
pop ebp
mov dword [0x100251a4], 7
or eax, 0xffffffff
pop ebx
add esp, 0x3f6c
ret
lea ecx, [esp + 0x10]
push 0x10023220
push ecx
call fcn.10008f60
mov edx, dword [0x1001cbd0]
add esp, 8
test eax, eax
je 0x10009527
push edx
call ebx
mov eax, dword [0x10023240]
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.10008fc0
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [0x1001cbd0], edx
jge 0x1000950b
pop edi
pop esi
pop ebp
mov dword [0x100251a4], 7
or eax, 0xffffffff
pop ebx
add esp, 0x3f6c
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0x10023220], eax
mov eax, dword [esp + 0x18]
mov dword [0x10023224], ecx
mov dword [0x10023228], eax
mov edi, 0x1001c270
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x34]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x34]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x34]
push ebp
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__write]
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x1000963e
mov edx, dword [0x1001cbd0]
push edx
call ebx
add esp, 4
mov dword [0x1001cbd0], 0xffffffff
mov dword [0x100251a4], 7
jmp 0x1000962c
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebx + 0x60]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx + 0x44]
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], 0x270f
mov dword [ebx + 8], 3
mov dword [ebx + 0x10], 0x79
mov ecx, dword [0x10025204]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x54], ebp
mov dword [ebx + 0xc], ebp
mov dword [ebx + 0x58], 0x200
mov dword [ebx + 0x5c], edx
mov ecx, dword [str._userlog]
mov dword [eax], ecx
mov ecx, dword [0x1001cef4]
mov dword [eax + 4], ecx
mov cl, byte [0x1001cef8]
mov byte [eax + 8], cl
call fcn.1000b200
push ebx
mov esi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0xc
test esi, esi
jge 0x1000963e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x3f6c
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x3f6c
ret