Function at 0x10038108
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071b05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10038145
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 1
call fcn.10038475
pop ecx
pop ecx
jmp 0x10038467
mov dword [ebp - 0x64], 0x258b
cmp dword [ebp - 0x64], 0x1382
jge 0x10038301
xor eax, eax
inc eax
je 0x10038301
lea eax, [ebp - 0x10]
push eax
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
cmp dword [ebp - 0x10], 1
jge 0x1003817d
jmp 0x10038301
lea eax, [ebp - 0x2c]
push eax
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x20], 0
jmp 0x100381a1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jge 0x100381dc
lea eax, [ebp - 0x19]
push eax
push 0x10007ef8
call fcn.10058e8b
pop ecx
pop ecx
movsx eax, byte [ebp - 0x19]
cmp eax, 0x4c
jne 0x100381cf
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0xa8], 1
jmp 0x100381da
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0xa8], 0
jmp 0x1003819a
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x1a]
push eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp + eax - 0xc8]
lea ecx, [ebp - 0xc8]
call fcn.1004acdc
pop ecx
mov eax, dword [ebp - 0x2c]
mov byte [ebp + eax - 0xc8], 1
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x10]
jge 0x100382e7
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0xa8]
test eax, eax
je 0x10038269
mov eax, dword [ebp - 0x34]
dec eax
cdq
idiv dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
mov eax, edx
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jne 0x10038267
mov eax, dword [ebp - 0x14]
dec eax
cdq
idiv dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
mov eax, edx
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
jmp 0x10038287
mov eax, dword [ebp - 0x34]
inc eax
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jne 0x10038287
mov eax, dword [ebp - 0x14]
inc eax
cdq
idiv dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0xa8]
test eax, eax
je 0x100382a3
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0xa8], 0
jmp 0x100382ae
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0xa8], 1
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xc8]
test eax, eax
jne 0x100382cf
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0xc8], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
jmp 0x1003821c
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
inc eax
push eax
push 0x10007efc
call fcn.100597a7
add esp, 0xc
jmp 0x10038159
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x3c], 0x206b
cmp dword [ebp - 0x3c], 0xd0e
jge 0x100383eb
lea ecx, [ebp - 0x80]
call fcn.1001951f
and dword [ebp - 4], 0
lea edx, [ebp - 0x80]
mov ecx, 0x10663d30
call fcn.1001e8bf
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
add ecx, dword [eax + 4]
call fcn.10027c84
movzx eax, al
test eax, eax
je 0x100383df
mov edx, 0x10007f30
lea ecx, [ebp - 0x80]
call fcn.1004ad03
movzx eax, al
test eax, eax
je 0x100383df
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x80]
call fcn.10019604
push dword [eax]
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x80]
call fcn.100195f0
push dword [eax]
call fcn.1004ad26
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100383bf
push fcn.1001ea64
lea edx, [ebp - 0x80]
mov ecx, 0x10663c78
call fcn.1001e8c7
mov ecx, eax
call fcn.10019c5d
jmp 0x100383da
push fcn.1001ea64
mov edx, 0x10007f34
mov ecx, 0x10663c78
call fcn.1001ead8
mov ecx, eax
call fcn.10019c5d
jmp 0x10038339
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.100195a7
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x1003841c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x1003841a
push 0x573
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10038467
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
jmp 0x1003844a
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 2
jge 0x10038467
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1001a1d1
mov dword [eax], 0x62af
jmp 0x1003843f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret