Function at 0xacf890
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x45c
test eax, eax
mov dword [esp + 0x2c], ecx
je 0xacf7c4
mov ebp, dword [eax]
lea edi, [esp + 0x3a]
mov byte [esp + 0x3a], 0
test ebp, ebp
je 0xacf5a3
mov edx, dword [0x10ee748]
test edx, edx
je 0xacf5a3
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0xacf716
mov dword [esp], ebx
call dword [ebp + 4]
mov dword [esp], edi
mov ebp, eax
call sub.msvcrt.dll_strlen
mov edx, 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.__s____p_
sub edx, eax
add eax, edi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.01088520
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov edx, dword [esp + 0x470]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], edx
mov edx, 0x400
sub edx, eax
add eax, edi
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
xor eax, eax
cmp byte [esp + 0x3a], 0
je 0xacf5f0
mov dword [esp], edi
call sub.msvcrt.dll_strlen
cmp byte [esp + eax + 0x39], 0xa
sete al
movzx eax, al
mov ebx, dword [0x1a49f60]
mov dword [0x10ee748], eax
test ebx, ebx
je 0xacf760
test eax, eax
je 0xacf650
test byte [0x1a49f64], 1
je 0xacf650
mov dword [esp + 4], 0x1a49f80
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0xacf650
mov eax, dword [0x1a4a380]
add eax, 1
cmp ebx, 1
mov dword [0x1a4a380], eax
je 0xacf80b
lea esi, [esi]
add esp, 0x45c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x1a4a380]
test eax, eax
jle 0xacf67f
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.____Last_message_repeated__d_times_n
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [0x1a4a380], 0
mov dword [esp + 4], edi
mov dword [esp], 0x1a49f80
call sub.msvcrt.dll_strcpy
movzx eax, byte [esp + 0x3a]
test al, al
je 0xacf6b9
mov edx, edi
lea esi, [esi]
lea ecx, [eax - 0xe]
cmp cl, 0x11
jbe 0xacf6ac
cmp al, 7
ja 0xacf6af
mov byte [edx], 0x3f
add edx, 1
movzx eax, byte [edx]
test al, al
jne 0xacf6a0
mov eax, dword [0x10ee74c]
test eax, eax
js 0xacf7d2
test eax, eax
jne 0xacf784
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], edi
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov eax, dword [0x10ee74c]
test eax, eax
je 0xacf640
movzx eax, word [0x1a4a388]
mov dword [esp + 4], eax
mov eax, dword [0x1a4a384]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
add esp, 0x45c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + eax]
test edx, edx
je 0xacf56e
mov eax, dword [edx]
test eax, eax
je 0xacf56e
mov dword [esp], edx
mov dword [esp + 0x28], edx
call dword [eax + 4]
mov edx, dword [esp + 0x28]
mov dword [esp + 8], str.__s____p_
mov dword [esp + 4], 0x400
mov dword [esp], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
call fcn.01088520
jmp 0xacf56e
mov dword [esp], 2
call sub.msvcrt.dll__isatty
cmp eax, 1
mov eax, dword [0x10ee748]
sbb ebx, ebx
or ebx, 1
mov dword [0x1a49f60], ebx
jmp 0xacf603
sar esi, 3
mov eax, 6
cmp esi, 6
cmovle eax, esi
xor edx, edx
test eax, eax
cmovns edx, eax
movzx eax, byte [edx + 0x1256052]
or ax, word [0x1a4a38a]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [0x1a4a384]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
jmp 0xacf6ce
mov byte [esp + 0x3a], 0
lea edi, [esp + 0x3a]
jmp 0xacf5a3
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
cmp eax, 0xffffffff
mov dword [0x1a4a384], eax
je 0xacf7fc
mov dword [esp], str.NO_COLOR
call sub.msvcrt.dll_getenv
test eax, eax
je 0xacf82c
mov dword [0x10ee74c], 0
jmp 0xacf6ce
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.____Last_message_repeated__d_times_r
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0xacf640
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
test eax, eax
jne 0xacf7fc
lea eax, [esp + 0x43a]
mov dword [esp + 4], eax
mov eax, dword [0x1a4a384]
mov dword [0x10ee74c], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
movzx eax, word [esp + 0x442]
mov word [0x1a4a388], ax
and ax, 0xf0
mov word [0x1a4a38a], ax
mov eax, dword [0x10ee74c]
jmp 0xacf6c6
push ebx
mov edx, dword [esp + 0xc]
cmp dword [0x10ee744], edx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
jge 0xacf8b0
pop ebx
ret
mov dword [esp + 8], ebx
pop ebx
jmp 0xacf530