Function at 0x10026aa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b243
mov eax, dword fs:[0]
push eax
sub esp, 0xf1c
mov eax, dword [0x10036138]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf20], ecx
mov eax, dword [ebp - 0xf20]
add eax, 8
push eax
lea ecx, [ebp - 0xabc]
call fcn.10004cd0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xf20]
add ecx, 0x68
push ecx
lea ecx, [ebp - 0xabc]
call fcn.10004d70
mov word [ebp - 0x43c], 0
push 0x206
push 0
lea edx, [ebp - 0x43a]
push edx
call fcn.1000f020
add esp, 0xc
mov word [ebp - 0x86c], 0
push 0x206
push 0
lea eax, [ebp - 0x86a]
push eax
call fcn.1000f020
add esp, 0xc
lea ecx, [ebp - 0xa98]
call fcn.10004c60
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xf20]
add ecx, 0x24
push ecx
lea ecx, [ebp - 0xa98]
call fcn.10004d30
mov byte [ebp - 0x86d], 0
lea ecx, [ebp - 0xa98]
call fcn.10004eb0
movzx edx, al
test edx, edx
je 0x10026c6e
lea ecx, [ebp - 0xcc8]
call fcn.10004690
mov byte [ebp - 4], 2
lea eax, [ebp - 0xcc8]
push eax
mov ecx, dword [ebp - 0xf20]
call fcn.100262a0
test eax, eax
je 0x10026bc9
lea ecx, [ebp - 0xcc8]
call fcn.10004c30
push eax
lea ecx, [ebp - 0xa98]
call fcn.10004d50
mov byte [ebp - 0x86d], 1
jmp 0x10026c5f
mov word [ebp - 0xedc], 0
push 0x208
push 0
lea ecx, [ebp - 0xeda]
push ecx
call fcn.1000f020
add esp, 0xc
push 0x104
lea edx, [ebp - 0xedc]
push edx
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0xee0]
call fcn.10004690
mov byte [ebp - 4], 3
lea eax, [ebp - 0xedc]
push eax
push 0x1003043c
lea ecx, [ebp - 0xee0]
push ecx
call fcn.10006320
add esp, 0xc
push str.BaiduBaiduSd
lea ecx, [ebp - 0xee0]
call fcn.10007ae0
lea ecx, [ebp - 0xee0]
call fcn.10004c30
push eax
lea ecx, [ebp - 0xa98]
call fcn.10004d50
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xee0]
call fcn.10004750
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcc8]
call fcn.10004750
mov edx, dword [0x100326bc]
push edx
push str.Baidu_
lea ecx, [ebp - 0xa98]
call fcn.10007c60
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xaa0]
cmp eax, dword [0x100326bc]
je 0x10026cfb
mov ecx, dword [ebp - 0xaa0]
push ecx
push 0
lea edx, [ebp - 0xf1c]
push edx
lea ecx, [ebp - 0xa98]
call fcn.10004f40
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0xf24]
mov dword [ebp - 0xf28], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xf28]
push ecx
lea ecx, [ebp - 0xa98]
call fcn.10004d30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf1c]
call fcn.10004d10
push str.BaiduSd1.8BaiduSd
lea ecx, [ebp - 0xa98]
call fcn.10004d90
lea ecx, [ebp - 0xa9c]
call fcn.10004690
mov byte [ebp - 4], 5
mov dword [0x10038b18], 3
movzx edx, byte [ebp - 0x86d]
neg edx
sbb edx, edx
neg edx
mov dword [0x10038b1c], edx
mov ecx, 0x10038b10
call fcn.1002a5e0
test eax, eax
je 0x10026d3f
mov ecx, 0x10038b10
call fcn.1002a410
lea ecx, [ebp - 0xa98]
call fcn.10004e70
push eax
mov eax, dword [ebp - 0xf20]
mov ecx, dword [eax + 0x58]
push ecx
push 0x100304a0
lea edx, [ebp - 0x43c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0xa98]
call fcn.10004e70
push eax
mov eax, dword [ebp - 0xf20]
mov ecx, dword [eax + 0x58]
push ecx
push str._supplyid_d__installmode2__startmain1__S___D_s
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov word [ebp - 0xcc4], 0
push 0x206
push 0
lea eax, [ebp - 0xcc2]
push eax
call fcn.1000f020
add esp, 0xc
mov ecx, dword [ebp - 0xf20]
add ecx, 0xec8
call fcn.10004e70
push eax
push 0x104
lea ecx, [ebp - 0xcc4]
push ecx
call fcn.10011194
add esp, 0xc
mov edx, dword [str.1.8.0.1255]
mov dword [ebp - 0x664], edx
mov eax, dword [0x10030584]
mov dword [ebp - 0x660], eax
mov ecx, dword [0x10030588]
mov dword [ebp - 0x65c], ecx
mov edx, dword [0x1003058c]
mov dword [ebp - 0x658], edx
mov eax, dword [0x10030590]
mov dword [ebp - 0x654], eax
mov cx, word [0x10030594]
mov word [ebp - 0x650], cx
push 0x1f2
push 0
lea edx, [ebp - 0x64e]
push edx
call fcn.1000f020
add esp, 0xc
mov word [ebp - 0xa7c], 0
push 0x206
push 0
lea eax, [ebp - 0xa7a]
push eax
call fcn.1000f020
add esp, 0xc
push str.Pizmdb.7z
mov ecx, dword [ebp - 0xf20]
add ecx, 8
push ecx
lea edx, [ebp - 0x458]
push edx
call fcn.10007df0
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x458]
call fcn.10004e70
push eax
push 0x104
lea eax, [ebp - 0xa7c]
push eax
call fcn.10011194
add esp, 0xc
lea ecx, [ebp - 0xa98]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10004cd0
mov byte [ebp - 4], 7
push 0x1003049c
lea ecx, [ebp - 0x2c]
call fcn.10004d90
mov word [ebp - 0x234], 0
push 0x206
push 0
lea edx, [ebp - 0x232]
push edx
call fcn.1000f020
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.10004e70
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.10011194
add esp, 0xc
mov dword [ebp - 0x874], 0
lea ecx, [ebp - 0xabc]
call fcn.10004e70
push eax
mov ecx, dword [ebp - 0xf20]
call fcn.10026190
push 0
mov ecx, dword [ebp - 0xf20]
add ecx, 0x84
call fcn.100077d0
movzx ecx, al
test ecx, ecx
je 0x10026fd9
lea edx, [ebp - 0x43c]
push edx
mov ecx, dword [ebp - 0xf20]
add ecx, 0x84
call fcn.10007810
movzx eax, al
test eax, eax
je 0x10026f8b
lea ecx, [ebp - 0xa7c]
push ecx
lea edx, [ebp - 0xcc4]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x664]
push ecx
lea ecx, [ebp - 0xabc]
call fcn.10004e70
push eax
call fcn.100283b0
add esp, 0x14
mov dword [ebp - 0x874], eax
jmp 0x10026fc1
lea edx, [ebp - 0xa7c]
push edx
lea eax, [ebp - 0xcc4]
push eax
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x664]
push edx
lea ecx, [ebp - 0xabc]
call fcn.10004e70
push eax
call fcn.100283b0
add esp, 0x14
mov dword [ebp - 0x874], eax
push 0x2710
mov ecx, dword [ebp - 0xf20]
add ecx, 0x84
call fcn.100078c0
jmp 0x1002700f
lea eax, [ebp - 0xa7c]
push eax
lea ecx, [ebp - 0xcc4]
push ecx
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0xabc]
call fcn.10004e70
push eax
call fcn.100283b0
add esp, 0x14
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
jne 0x10027049
mov dword [0x10038b18], 4
mov dword [0x10038b1c], 2
mov ecx, 0x10038b10
call fcn.1002a5e0
test eax, eax
je 0x10027044
mov ecx, 0x10038b10
call fcn.1002a410
jmp 0x10027115
lea ecx, [ebp - 0xa9c]
push ecx
call fcn.10028fa0
add esp, 4
lea ecx, [ebp - 0xf00]
call fcn.10004690
mov byte [ebp - 4], 8
lea edx, [ebp - 0xf00]
push edx
mov ecx, dword [ebp - 0xf20]
call fcn.100262a0
lea ecx, [ebp - 0xa9c]
call fcn.10007c20
push eax
lea ecx, [ebp - 0xefc]
call fcn.10004c90
mov byte [ebp - 4], 9
mov dword [0x10038b18], 4
mov eax, dword [ebp - 0xf20]
add eax, 0xec8
push eax
lea ecx, [ebp - 0xefc]
push ecx
call fcn.10007e80
add esp, 8
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov dword [0x10038b1c], edx
lea ecx, [ebp - 0xf00]
call fcn.10007c20
push eax
mov ecx, 0x10038b40
call fcn.10004d50
mov ecx, 0x10038b10
call fcn.1002a5e0
test eax, eax
je 0x100270f7
mov ecx, 0x10038b10
call fcn.1002a410
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xefc]
call fcn.10004d10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf00]
call fcn.10004750
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2c]
call fcn.10004d10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x458]
call fcn.10004d10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa9c]
call fcn.10004750
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa98]
call fcn.10004d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xabc]
call fcn.10004d10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e688
mov esp, ebp
pop ebp
ret