Function at 0x68a09680
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x16
lea eax, [ebp - 0x34]
mov dword [ebp - 0x258], 0
push eax
mov ebx, ecx
mov esi, edx
push str.AswJsFltEnvironmentFlags
mov dword [ebp - 0x254], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x14
ja 0x68a096e5
lea eax, [ebp - 0x34]
push eax
call fcn.68a40efb
add esp, 4
mov ebx, eax
call fcn.68a40217
cmp dword [eax], edi
jne 0x68a096df
mov edi, ebx
and edi, 1
mov ebx, dword [ebp - 0x254]
push 0x10
lea eax, [ebp - 0x28]
mov dword [esi + 0x10], edi
push eax
push str.AswJsFltTestMode
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x68a0970f
mov dword [esi], 1
mov dword [esi + 0x28], 0xffffffff
jmp 0x68a097a9
push str.setupconfig.def
sub esp, 8
lea ecx, [ebp - 0x250]
push str.ProgramFolder
call fcn.68a32690
add esp, 0x10
mov dword [ebp - 0x258], eax
test eax, eax
js 0x68a097a9
lea eax, [ebp - 0x250]
xor edi, edi
push eax
push 0x20
lea eax, [ebp - 0x48]
push eax
push edi
push str.VersionType
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x68a097a7
lea eax, [ebp - 0x48]
push str.Release
push eax
call fcn.68a41038
add esp, 8
test eax, eax
jne 0x68a09772
lea edi, [eax + 3]
jmp 0x68a097a7
lea eax, [ebp - 0x48]
push str.Beta
push eax
call fcn.68a41038
add esp, 8
test eax, eax
jne 0x68a0978c
lea edi, [eax + 2]
jmp 0x68a097a7
lea eax, [ebp - 0x48]
push str.Internal
push eax
call fcn.68a41038
add esp, 8
mov ecx, 1
test eax, eax
cmove edi, ecx
mov dword [esi], edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x68a0982e
lea edx, [esi + 0x48]
mov ecx, edi
call fcn.68a31b00
push 0x208
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.68a3b750
add esp, 0xc
lea eax, [ebp - 0x250]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x68a0982e
lea eax, [ebp - 0x250]
push 0x5c
push eax
call fcn.68a3ae2b
mov edi, eax
add esp, 8
test edi, edi
je 0x68a0982e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [edi + 2]
push eax
push str.A_script_started_by
push str._s_s__i_
lea eax, [esi + 0x2e0]
push 0x104
push eax
call fcn.68a09db0
add esp, 0x18
test ebx, ebx
je 0x68a0983c
lea edx, [esi + 0x50]
mov ecx, ebx
call fcn.68a31b00
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ecx
push 0x68a60718
mov dword [esi + 0x28c], 0x68a09650
lea edi, [esi + 0x64]
mov dword [esi + 0x288], 0x68a09620
mov ecx, 0x68aa764c
cmp word [0x68ab21b0], 0
mov eax, 0x68ab21b0
push 0x104
cmove eax, ecx
push edi
push eax
call fcn.68a23e80
add esp, 0x14
test eax, eax
je 0x68a098f0
lea edx, [esi + 0x60]
test edi, edi
je 0x68a098e6
mov ecx, 0x7ffffffe
cmp word [edi], 0
je 0x68a098bf
add edi, 2
sub ecx, 1
jne 0x68a098b1
test edx, edx
je 0x68a098dd
test ecx, ecx
je 0x68a098d5
mov eax, 0x7ffffffe
sub eax, ecx
mov dword [edx], eax
add dword [edx], 0xfffffff2
jmp 0x68a098f0
mov dword [edx], 0
jmp 0x68a098ea
test ecx, ecx
je 0x68a098e6
add dword [edx], 0xfffffff2
jmp 0x68a098f0
test edx, edx
je 0x68a098f0
mov dword [edx], 0
lea eax, [esi + 0x2c8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
lea eax, [esi + 0x2c0]
mov dword [esi + 0x2b8], 0
push 1
push 0
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [esi + 0x2b4], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x2bc], eax
xor ecx, ebp
mov eax, dword [ebp - 0x258]
pop esi
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret