Function at 0x10022af0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [0x1007f004]
add eax, 1
sub eax, dword [section..data]
mov dword [0x1007f01c], eax
imul ecx, dword [0x1007f024], 0x24
mov edx, dword [0x1007f01c]
sub edx, ecx
mov dword [0x1007f020], edx
movzx eax, word [0x1007f008]
imul ecx, eax, 0x25
add ecx, dword [0x1007f01c]
movzx edx, byte [0x1007f004]
sub edx, ecx
mov byte [0x1007f004], dl
movzx eax, word [0x1007f008]
push eax
call fcn.100217a0
add esp, 4
mov dword [section..data], eax
push 0
lea ecx, [ebp - 0x28]
call fcn.10025240
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.8962
call fcn.100230c0
push str.Kill_Fu
lea ecx, [ebp - 0x28]
call fcn.10023520
mov ecx, eax
call fcn.100262f0
mov ecx, 4
shl ecx, 4
cmp dword [ecx + 0x1007f028], 0x1c72
jne 0x10022bc4
mov edx, 4
shl edx, 1
mov eax, dword [0x1007f020]
add eax, dword [edx + 0x1007f028]
mov dword [0x1007f020], eax
imul ecx, dword [0x1007f020], 0x24
mov edx, dword [0x1007f020]
sub edx, ecx
mov dword [0x1007f024], edx
movzx eax, word [0x1007f008]
push eax
call fcn.10021a60
add esp, 4
mov dword [section..data], eax
mov ecx, dword [0x1007f024]
cmp ecx, dword [0x1007f020]
jb 0x10022c39
mov edx, dword [0x1007f024]
sub edx, 0x45
movzx eax, word [0x1007f008]
sub edx, eax
mov dword [0x1007f020], edx
mov ecx, 4
imul edx, ecx, 7
movzx eax, word [0x1007f008]
imul eax, dword [edx + 0x1007f028]
mov ecx, 4
imul edx, ecx, 7
mov dword [edx + 0x1007f028], eax
mov eax, dword [0x1007f024]
sub eax, 9
movzx ecx, word [0x1007f008]
sub eax, ecx
mov dword [0x1007f020], eax
mov edx, dword [section..data]
sub edx, 0x15c65
sub edx, dword [0x1007f024]
add edx, dword [0x1007f020]
add edx, dword [0x1007f020]
mov dword [0x1007f020], edx
movzx eax, word [0x1007f008]
push eax
call fcn.100215c0
add esp, 4
mov dword [section..data], eax
mov dword [0x100806cc], 3
jmp 0x10022c8d
mov ecx, dword [0x100806cc]
add ecx, 2
mov dword [0x100806cc], ecx
cmp dword [0x100806cc], 0x1a
jge 0x10022d02
mov edx, 4
shl edx, 1
mov eax, dword [0x1007f024]
cmp eax, dword [edx + 0x1007f028]
jne 0x10022cac
jmp 0x10022d02
movzx ecx, word [0x1007f008]
mov edx, dword [0x100806cc]
sub ecx, dword [edx*4 + 0x1007f028]
mov word [0x1007f008], cx
mov eax, dword [0x1007f024]
sub eax, 0x43
sub eax, dword [section..data]
movzx ecx, word [0x1007f008]
add ecx, eax
mov word [0x1007f008], cx
mov edx, 4
imul eax, edx, 9
mov ecx, dword [0x1007f024]
cmp ecx, dword [eax + 0x1007f028]
jne 0x10022cfd
jmp 0x10022d02
jmp 0x10022c7e
mov dword [0x100806cc], 0x27
jmp 0x10022d1d
mov edx, dword [0x100806cc]
sub edx, 1
mov dword [0x100806cc], edx
cmp dword [0x100806cc], 2
jle 0x10022d87
mov eax, 4
imul ecx, eax, 5
mov edx, dword [0x1007f024]
cmp edx, dword [ecx + 0x1007f028]
jne 0x10022d3e
jmp 0x10022d87
mov eax, dword [0x1007f024]
sub eax, 9
sub eax, dword [0x1007f024]
mov dword [0x1007f020], eax
mov ecx, dword [0x100806cc]
mov edx, dword [ecx*4 + 0x1007f028]
add edx, dword [0x1007f024]
mov eax, dword [0x100806cc]
mov dword [eax*4 + 0x1007f028], edx
mov ecx, dword [0x1007f024]
sub ecx, 9
sub ecx, dword [0x1007f024]
mov dword [0x1007f020], ecx
jmp 0x10022d0e
mov dword [ebp - 4], 0x272
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
lea edx, [ebp - 4]
push edx
call fcn.100232c0
push str.hope_w
lea ecx, [ebp - 0x28]
call fcn.10023520
mov ecx, eax
call fcn.100262f0
mov eax, 1
shl eax, 4
movzx ecx, byte [eax + 0x1007f00c]
cmp ecx, 0x1c72
jne 0x10022e01
mov edx, 1
shl edx, 1
movzx eax, byte [edx + 0x1007f00c]
movzx ecx, word [0x1007f008]
add ecx, eax
mov word [0x1007f008], cx
movzx edx, word [0x1007f008]
movzx eax, word [0x1007f008]
imul ecx, eax, 0x24
sub edx, ecx
mov dword [section..data], edx
movzx edx, word [0x1007f008]
push edx
call fcn.100215c0
add esp, 4
mov dword [section..data], eax
mov dword [ebp - 8], 0xe3f
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
call fcn.100232c0
push str.Solution
lea ecx, [ebp - 0x28]
call fcn.10023520
mov ecx, eax
call fcn.100262f0
movzx ecx, word [0x1007f008]
push ecx
call fcn.100217a0
add esp, 4
mov dword [section..data], eax
mov edx, 1
shl edx, 1
movzx eax, byte [edx + 0x1007f00c]
cmp eax, dword [0x1007f01c]
ja 0x10022ed9
mov ecx, 1
imul edx, ecx, 6
mov al, byte [0x1007f008]
mov byte [edx + 0x1007f00c], al
mov ecx, dword [section..data]
sub ecx, 9
sub ecx, dword [0x1007f01c]
mov word [0x1007f008], cx
mov edx, dword [0x1007f01c]
sub edx, 0x15c65
movzx eax, word [0x1007f008]
sub edx, eax
add edx, dword [section..data]
add edx, dword [section..data]
mov dword [section..data], edx
movzx ecx, word [0x1007f008]
imul edx, ecx, 0x25
add edx, dword [0x1007f01c]
mov eax, dword [section..data]
sub eax, edx
mov dword [section..data], eax
push 0x57a
push 0x1007fc18
push str.Since
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movzx ecx, word [0x1007f008]
imul edx, ecx, 0x28fd
mov eax, dword [0x1007f020]
sub eax, edx
mov word [0x1007f008], ax
movzx ecx, word [0x1007f008]
imul edx, ecx, 0x24
mov eax, dword [0x1007f01c]
sub eax, edx
mov byte [0x1007f004], al
movzx ecx, word [0x1007f008]
push ecx
call fcn.100217a0
add esp, 4
mov dword [section..data], eax
mov edx, dword [0x1007f020]
sub edx, 0x45
sub edx, dword [section..data]
mov dword [0x1007f024], edx
mov eax, 4
shl eax, 4
cmp dword [eax + 0x1007f028], 0x1c72
jne 0x10022f8a
mov ecx, 4
shl ecx, 1
mov edx, dword [0x1007f020]
add edx, dword [ecx + 0x1007f028]
mov dword [0x1007f020], edx
imul eax, dword [0x1007f020], 0x24
mov ecx, dword [0x1007f020]
sub ecx, eax
mov dword [0x1007f024], ecx
mov edx, 4
shl edx, 4
cmp dword [edx + 0x1007f028], 0x1c72
jne 0x10022fca
mov eax, 4
shl eax, 1
mov ecx, dword [0x1007f020]
add ecx, dword [eax + 0x1007f028]
mov dword [0x1007f020], ecx
imul edx, dword [0x1007f020], 0x24
mov eax, dword [0x1007f020]
sub eax, edx
mov dword [0x1007f024], eax
mov ecx, dword [0x1007f024]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x28]
call fcn.10025f80
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret