Function at 0x1006fc3b
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1014841f
call fcn.1014399c
sub esp, 0x174
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x54]
push 2
mov byte [ebp - 0x1d], dl
call fcn.100141a5
push 2
xor ebx, ebx
pop esi
mov dword [ebp - 4], ebx
push 1
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1006fc81
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1006fc75
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x1006fdab
push edx
lea ecx, [ebp - 0x78]
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1006fcaf
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1006fca3
mov eax, dword [ebp - 0x78]
mov dword [eax], ebx
mov dword [ebp - 0x2c], 0xffffffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1006fcd9
push ebx
push ebx
push 0x1cd2
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
inc edx
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], ebx
jl 0x1006fd82
mov dword [ebp - 0x14], 0x5f0ed1ad
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1006fd54
mov dword [ebp - 0x18], 0x498e64e6
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1006fd1f
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1006fd4f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1006fd3c
push ebx
push 0x7fa
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
cmp dword [eax + ecx*4], ebx
jne 0x1006fd4c
dec dword [ebp - 0x18]
jns 0x1006fd27
xor edx, edx
inc edx
dec dword [ebp - 0x14]
jns 0x1006fcf4
mov dword [ebp - 0x14], ebx
jmp 0x1006fd74
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1006fd71
push 0x1aad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1006fd59
dec dword [ebp - 0x2c]
jns 0x1006fce5
mov eax, dword [ebp - 0x78]
inc dword [eax]
cmp dword [eax], edx
jle 0x1006fcb9
push eax
call fcn.10123626
pop ecx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
dec dword [ebp - 0x1c]
push 1
pop edx
jns 0x1006fc92
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x54], ebx
je 0x1006fdc6
push dword [ebp - 0x54]
call fcn.10123626
pop ecx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1006fde2
and dword [ebx + 0x10], 0
cmp dword [ebx + 0x14], 8
jb 0x1006fddb
mov eax, dword [ebx]
jmp 0x1006fddd
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
push 3
lea ecx, [ebp - 0x84]
call fcn.100141a5
push 3
pop ecx
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edx
jmp 0x1006fe0d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x94], 0xae35
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1006fdfc
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jge 0x1006fe33
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x84]
mov dword [eax + ecx*4], 0xcd453606
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1006fe1a
mov edi, dword [ebp - 0x84]
mov dword [edi + 8], esi
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x1c], 0x2aa9dade
cmp dword [edi + 8], edx
je 0x1006fe59
cmp dword [ebp - 0x1c], edx
je 0x1006fe59
xor ecx, ecx
inc ecx
jmp 0x1006fe5b
mov ecx, edx
mov eax, dword [ebp - 0x94]
sub ecx, eax
cmp ecx, dword [ebp - 0x90]
jge 0x1006fe75
cmp dword [edi + 8], edx
je 0x1006fe75
xor ecx, ecx
inc ecx
jmp 0x1006fe77
mov ecx, edx
mov eax, dword [edi + 8]
mov esi, 0x693009c
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
dec ecx
add ecx, eax
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
sub esi, ecx
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x94]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
pop edx
setl al
dec dword [edi + 8]
mov dword [ebp - 0x1c], eax
jns 0x1006fe3c
mov edx, dword [ebp - 0x84]
xor ecx, ecx
push edx
mov eax, dword [edx + 4]
add eax, 0xab79
cmp eax, 0x2c02
setle cl
mov dword [ebp - 0x1c], ecx
call fcn.10123626
pop ecx
push dword [ebp - 0x28]
xor eax, eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
call fcn.10014099
cmp byte [ebp - 0x1d], 0
mov dword [ebp - 4], 1
je 0x1006ff2c
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
cmovae edx, dword [ebp - 0x48]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x48]
cmovae ecx, dword [ebp - 0x48]
push eax
push ecx
lea ecx, [ebp - 0xbc]
call fcn.1007a91b
add esp, 0xc
lea eax, [ebp - 0xac]
push 0x55be8
push eax
call fcn.10018a50
pop ecx
pop ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0xfffffff0
jmp 0x1006ff8b
mov dword [ebp - 0x28], 0x8b10
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1006ff82
push 1
push 0x1191
push 0x1e5
push 0x157e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
cmp dword [ebp - 0x28], 0
jne 0x1006ff91
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x1006ff53
mov dword [ebp - 0x28], 0xff18ee85
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x18], 0
jmp 0x1006ffb3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x24], 0x4fd3df75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1006ffa5
mov dword [ebp - 0x24], 0xffffffe3
jmp 0x10070037
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0
je 0x1006ffe8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
je 0x1006ffe8
xor ecx, ecx
inc ecx
jmp 0x1006ffea
xor ecx, ecx
mov eax, dword [ebp - 0x14]
imul eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0xffff
je 0x10070008
cmp dword [ebp - 0x24], 0
je 0x10070008
xor eax, eax
inc eax
jmp 0x1007000a
xor eax, eax
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
cmp eax, 0xfffffffb
jg 0x10070025
cmp dword [ebp - 0x14], 0
je 0x10070025
xor edx, edx
inc edx
jmp 0x10070027
xor edx, edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffed
jne 0x1006ffc2
lea eax, [ebp - 0x30]
push eax
push 0x5c4a9
push 0x48569
call fcn.10027b51
pop ecx
pop ecx
call eax
push eax
push 0x45884
push 0x4e430
call fcn.10027b51
pop ecx
pop ecx
call eax
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x100702f1
xor edi, edi
cmp dword [ebp - 0x30], edi
jle 0x100702dd
cmp byte [ebp - 0xd], 0
jne 0x100702dd
push dword [esi + edi*4]
lea ecx, [ebp - 0x6c]
call fcn.100140d4
cmp byte [ebp - 0x1d], 0
lea edx, [ebp - 0x6c]
mov byte [ebp - 4], 3
je 0x100701b0
cmp dword [ebp - 0x58], 8
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
cmovae ecx, dword [ebp - 0x6c]
cmovae edx, dword [ebp - 0x6c]
push edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xc0]
call fcn.1007a91b
add esp, 0xc
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x48]
push dword [ebp - 0x38]
push 0
push eax
call fcn.10045097
cmp eax, 0xffffffff
je 0x100702c3
mov byte [ebp - 0xd], 1
test ebx, ebx
je 0x100702c3
push dword [ebp - 0x9c]
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
push 0
cmovae eax, dword [ebp - 0xac]
lea ecx, [ebp - 0x6c]
push eax
call fcn.10045097
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x10070185
push dword [esi + edi*4]
lea ecx, [ebp - 0x108]
call fcn.100140d4
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x9c]
add ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push ecx
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, eax
call fcn.10034786
push eax
mov ecx, ebx
call fcn.10018f5a
push 0
push 1
lea ecx, [ebp - 0xd8]
call fcn.10014706
lea ecx, [ebp - 0x108]
push 0
push 1
call fcn.10014706
jmp 0x100702c3
mov eax, dword [ebp - 0x30]
dec eax
cmp edi, eax
jge 0x100702c3
push dword [esi + edi*4 + 4]
lea ecx, [ebp - 0x168]
call fcn.100140d4
push eax
mov ecx, ebx
call fcn.10018f5a
lea ecx, [ebp - 0x168]
jmp 0x10070177
lea ecx, [ebp - 0x48]
call fcn.10028006
test al, al
je 0x100701f3
mov byte [ebp - 0xd], 1
test ebx, ebx
je 0x100702c3
mov eax, dword [ebp - 0x30]
dec eax
cmp edi, eax
jge 0x100702c3
push dword [esi + edi*4 + 4]
lea ecx, [ebp - 0x138]
call fcn.100140d4
push eax
mov ecx, ebx
call fcn.10018f5a
lea ecx, [ebp - 0x138]
jmp 0x10070177
lea eax, [ebp - 0xac]
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0xf0]
call fcn.10036a62
pop ecx
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x10070214
mov eax, dword [eax]
push ecx
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.10045097
mov ebx, eax
lea ecx, [ebp - 0xf0]
push 0
neg ebx
push 1
sbb bl, bl
call fcn.10014706
inc bl
mov ebx, dword [ebp + 8]
je 0x100702c3
mov byte [ebp - 0xd], 1
test ebx, ebx
je 0x100702c3
lea eax, [ebp - 0xac]
push eax
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x180]
call fcn.10036a62
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 4
push dword [eax + edi*4]
call fcn.100140d4
push 0xffffffffffffffff
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
push dword [esi + 0x10]
push ecx
mov ecx, eax
call fcn.10034786
push eax
mov ecx, ebx
call fcn.10018f5a
xor esi, esi
lea ecx, [ebp - 0x120]
push esi
push 1
call fcn.10014706
push esi
push 1
lea ecx, [ebp - 0x150]
call fcn.10014706
push esi
push 1
lea ecx, [ebp - 0x180]
call fcn.10014706
mov esi, dword [ebp - 0x1c]
push 0
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.10014706
inc edi
cmp edi, dword [ebp - 0x30]
jl 0x10070080
push esi
push 0x5c4a9
push 0x1445e
call fcn.10027b51
pop ecx
pop ecx
call eax
mov dword [ebp - 0x18], 0x8e5c
lea ecx, [ebp - 0xb8]
push 4
call fcn.100141a5
mov dword [ebp + 8], 0xd711e7bf
xor ebx, ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp + 8], 9
mov dword [ebp + 8], ebx
jmp 0x10070334
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x10070321
mov dword [ebp + 8], ebx
jmp 0x10070350
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x88], 0xc60edac7
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1007033f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xb8]
mov dword [ecx + 8], eax
test eax, eax
je 0x1007039c
mov dword [ebp + 8], 0x7308f472
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ecx + 8], edx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x88], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
je 0x1007039c
xor eax, eax
inc eax
jmp 0x1007039e
mov eax, ebx
push dword [ebp - 0xb8]
mov dword [ebp + 8], eax
call fcn.10123626
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xac]
call fcn.10014706
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10014706
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret