Function at 0x10048288
Capabilities:
Get process heap force flags
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10110164]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101ef04c]
test eax, eax
jne 0x1004842c
mov dword [ebp - 0x158], 0x6d
mov ecx, 0xfed0
mov eax, dword [ebp - 0x158]
xor eax, 0x4e
mov byte [ebp - 0x154], al
mov eax, dword [ebp - 0x158]
lea edx, [ecx + 8]
inc al
xor eax, 0x74
mov byte [ebp - 0x153], al
mov eax, dword [ebp - 0x158]
add al, 2
xor eax, 0x43
mov byte [ebp - 0x152], al
mov eax, dword [ebp - 0x158]
add al, 3
xor eax, 0x75
mov byte [ebp - 0x151], al
mov eax, dword [ebp - 0x158]
add al, 4
xor eax, 0x72
mov byte [ebp - 0x150], al
mov eax, dword [ebp - 0x158]
add al, 5
xor eax, 0x72
mov byte [ebp - 0x14f], al
mov eax, dword [ebp - 0x158]
add al, 6
xor eax, 0x65
mov byte [ebp - 0x14e], al
mov eax, dword [ebp - 0x158]
add al, 7
xor eax, 0x6e
mov byte [ebp - 0x14d], al
mov eax, dword [ebp - 0x158]
add al, 8
xor eax, 0x74
mov byte [ebp - 0x14c], al
mov eax, dword [ebp - 0x158]
add al, 9
xor eax, 0x54
mov byte [ebp - 0x14b], al
mov eax, dword [ebp - 0x158]
add al, 0xa
xor eax, 0x65
mov byte [ebp - 0x14a], al
mov eax, dword [ebp - 0x158]
add al, 0xb
mov byte [ebp - 0x148], 0
xor eax, 0x62
mov byte [ebp - 0x149], al
mov al, byte [ebp - 0x154]
mov dword [ebp - 0x1c4], 0xfeb4
mov eax, 0xfeda
mov word [ebp - 0x1c0], ax
add eax, 0xffffffe6
mov word [ebp - 0x1be], ax
lea eax, [ecx - 0x36]
mov word [ebp - 0x1bc], cx
mov word [ebp - 0x1ba], dx
mov word [ebp - 0x1b8], dx
mov word [ebp - 0x1b6], ax
xor eax, eax
mov word [ebp - 0x1b4], cx
lea ecx, [ebp - 0x158]
mov word [ebp - 0x1b2], dx
mov word [ebp - 0x1b0], dx
mov word [ebp - 0x1ae], ax
mov ax, word [ebp - 0x1c0]
call fcn.10010e10
push eax
lea ecx, [ebp - 0x1c4]
call fcn.100498b1
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ef04c], eax
test eax, eax
jne 0x1004842c
mov ecx, dword fs:[0x30]
jmp 0x10048431
call eax
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0x900]
mov dword [ebp - 0x228], eax
mov eax, dword [ecx + 0x904]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
call fcn.10047048
cmp dword [ebp - 0x228], 0x31281a19
pop ecx
jne 0x1004847a
mov eax, dword [ebp - 0x224]
cmp dword [eax], 0x20170907
jne 0x1004847a
cmp dword [eax + 4], 2
je 0x100489aa
mov dword [ebp - 0x220], 0xde65
mov eax, 0xde1e
mov word [ebp - 0x21c], ax
push ebx
push esi
lea ecx, [eax + 0x33]
add eax, 0x3e
mov word [ebp - 0x21a], cx
lea esi, [ecx + 0xc]
mov word [ebp - 0x218], ax
lea edx, [ecx + 4]
lea eax, [ecx - 1]
mov word [ebp - 0x216], ax
lea ebx, [ecx - 0x2d]
mov word [ebp - 0x214], si
mov word [ebp - 0x212], dx
add edx, 0xfffffff3
push edi
lea edi, [ecx + 2]
mov word [ebp - 0x210], di
mov word [ebp - 0x20e], ax
add eax, 0xffffffed
mov word [ebp - 0x20c], cx
mov word [ebp - 0x20a], ax
lea eax, [ecx + 5]
mov word [ebp - 0x208], dx
mov word [ebp - 0x206], ax
add eax, 0xffffffd6
mov word [ebp - 0x204], bx
mov word [ebp - 0x202], cx
mov word [ebp - 0x200], bx
mov word [ebp - 0x1fe], ax
lea eax, [ecx - 0x30]
mov word [ebp - 0x1fc], dx
mov word [ebp - 0x1fa], cx
mov word [ebp - 0x1f8], ax
add eax, 5
mov word [ebp - 0x1f6], si
add esi, 0xfffffff7
mov word [ebp - 0x1f4], si
inc ecx
mov word [ebp - 0x1f2], ax
lea eax, [edi + 9]
mov word [ebp - 0x1f0], dx
mov word [ebp - 0x1ee], bx
mov word [ebp - 0x1ec], cx
mov word [ebp - 0x1ea], di
add edi, 3
mov word [ebp - 0x1e8], ax
mov word [ebp - 0x1e6], di
mov word [ebp - 0x1e4], dx
lea edx, [ebx + 0x31]
mov word [ebp - 0x1e2], si
mov word [ebp - 0x1e0], ax
add eax, 0xffffffcb
mov word [ebp - 0x1de], si
mov word [ebp - 0x1dc], dx
mov word [ebp - 0x1da], ax
lea eax, [ebx - 1]
mov word [ebp - 0x1d8], bx
mov word [ebp - 0x1d6], ax
add eax, 0x3a
mov word [ebp - 0x1d4], ax
lea eax, [ebx - 0xc]
mov word [ebp - 0x1d2], di
mov word [ebp - 0x1d0], dx
mov word [ebp - 0x1ce], cx
lea ecx, [ebp - 0x220]
mov word [ebp - 0x1cc], si
mov word [ebp - 0x1ca], ax
xor eax, eax
mov word [ebp - 0x1c8], ax
mov ax, word [ebp - 0x21c]
call fcn.10049883
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0xa4]
push 0x50
push ecx
push eax
call ebx
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
je 0x10048667
lea eax, [ebp - 0xa4]
push eax
call fcn.10047bfb
pop ecx
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
shr edx, 0x10
add edx, dword [ecx + 0x30]
movzx esi, dx
not esi
xor esi, eax
je 0x10048667
push 0x2f0
push esi
call edi
test eax, eax
jne 0x10048667
cmp dword [esi], 0x20170907
je 0x100489a1
mov dword [ebp - 0x1ac], 0xa288
mov eax, dword [ebp - 0x1ac]
xor eax, 0x7b
mov word [ebp - 0x1a8], ax
mov eax, dword [ebp - 0x1ac]
inc eax
push 0x44
pop edx
xor eax, edx
mov word [ebp - 0x1a6], ax
mov eax, dword [ebp - 0x1ac]
add eax, 2
xor eax, 0x43
mov word [ebp - 0x1a4], ax
mov eax, dword [ebp - 0x1ac]
add eax, 3
xor eax, 0x45
mov word [ebp - 0x1a2], ax
mov eax, dword [ebp - 0x1ac]
add eax, 4
xor eax, 0x33
mov word [ebp - 0x1a0], ax
mov eax, dword [ebp - 0x1ac]
add eax, 5
xor eax, 0x38
mov word [ebp - 0x19e], ax
mov eax, dword [ebp - 0x1ac]
add eax, 6
xor eax, 0x37
mov word [ebp - 0x19c], ax
mov eax, dword [ebp - 0x1ac]
add eax, 7
xor eax, 0x35
mov word [ebp - 0x19a], ax
mov eax, dword [ebp - 0x1ac]
add eax, 8
xor eax, edx
mov word [ebp - 0x198], ax
mov eax, dword [ebp - 0x1ac]
add eax, 9
push 0x2d
pop ecx
xor eax, ecx
mov word [ebp - 0x196], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0xa
xor eax, 0x31
mov word [ebp - 0x194], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0xb
xor eax, edx
mov word [ebp - 0x192], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0xc
xor eax, 0x33
mov word [ebp - 0x190], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0xd
xor eax, 0x39
mov word [ebp - 0x18e], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0xe
xor eax, ecx
mov word [ebp - 0x18c], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0xf
xor eax, 0x34
mov word [ebp - 0x18a], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x10
xor eax, 0x37
mov word [ebp - 0x188], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x11
xor eax, 0x43
mov word [ebp - 0x186], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x12
xor eax, 0x31
mov word [ebp - 0x184], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x13
xor eax, ecx
mov word [ebp - 0x182], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x14
xor eax, 0x41
mov word [ebp - 0x180], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x15
xor eax, 0x32
mov word [ebp - 0x17e], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x16
xor eax, 0x30
mov word [ebp - 0x17c], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x17
xor eax, 0x38
mov word [ebp - 0x17a], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x18
xor eax, ecx
lea ecx, [ebp - 0x1ac]
mov word [ebp - 0x178], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x19
xor eax, 0x45
mov word [ebp - 0x176], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x1a
xor eax, 0x42
mov word [ebp - 0x174], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x1b
xor eax, 0x32
mov word [ebp - 0x172], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x1c
xor eax, 0x33
mov word [ebp - 0x170], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x1d
xor eax, 0x42
mov word [ebp - 0x16e], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x1e
xor eax, 0x46
mov word [ebp - 0x16c], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x1f
xor eax, 0x46
mov word [ebp - 0x16a], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x20
xor eax, 0x38
mov word [ebp - 0x168], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x21
xor eax, 0x30
mov word [ebp - 0x166], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x22
xor eax, 0x30
mov word [ebp - 0x164], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x23
xor eax, edx
mov word [ebp - 0x162], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x24
xor eax, 0x31
mov word [ebp - 0x160], ax
mov eax, dword [ebp - 0x1ac]
add eax, 0x25
xor eax, 0x7d
mov word [ebp - 0x15e], ax
xor eax, eax
mov word [ebp - 0x15c], ax
mov ax, word [ebp - 0x1a8]
call fcn.1000b49e
push 0x50
lea ecx, [ebp - 0x144]
push ecx
push eax
call ebx
test eax, eax
je 0x100489a5
lea eax, [ebp - 0x144]
push eax
call fcn.10047bfb
pop ecx
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
shr edx, 0x10
add edx, dword [ecx + 0x30]
movzx esi, dx
not esi
xor esi, eax
je 0x100489a5
push 0x2f0
push esi
call edi
test eax, eax
jne 0x100489a5
cmp dword [esi], 0x20170907
jne 0x100489a5
mov eax, esi
jmp 0x100489a7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cc9b8
leave
ret