Function at 0x10013d80
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100613e5
call fcn.10060810
sub esp, 0x54
push ebx
push esi
mov byte [ebp - 0x18], dl
xor ebx, ebx
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x30], 0x37df
cmp dword [ebp - 0x30], 0x39f5
push edi
mov dword [ebp - 0x10], esp
jle 0x10013e36
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x6f0b
mov esi, dword [ebp - 0x1c]
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], 0x160f
mov dword [ebp - 0x20], ecx
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x48]
cdq
push edx
push eax
call fcn.10001acf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10013de6
mov eax, dword [eax]
push eax
call fcn.10049e23
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.1000fa8e
mov ecx, dword [ebp - 0x20]
add ecx, edi
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
jne 0x10013dcd
inc edi
cmp edi, 0x6f69
jl 0x10013dc1
mov esi, dword [ebp - 0x2c]
add dword [ebp - 0x1c], esi
dec dword [ebp - 0x28]
jne 0x10013dbc
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x63de
jl 0x10013db2
push 0x24a9
push 0x3f7
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
cmp byte [ebp + 8], 0
je 0x10013eef
cmp byte [ebp - 0x14], 0
je 0x10013e72
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
dec dword [eax]
cmp dword [ebp - 0x30], 0x3688
jge 0x10013e61
push str.utmt_kzqfqogzx_rzxe_ohl
call fcn.10049e23
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 8], 0x2c0f
cmp dword [ebp + 8], 0x2e50
jle 0x10013ea8
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x1007d358
cdq
push edx
push eax
call fcn.1000ef91
inc edi
cmp edi, 0x8009
jl 0x10013e86
inc esi
cmp esi, 0x73e9
jl 0x10013e84
push 0x2580
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], 0x2849
jge 0x10013e4d
mov edx, str.wgaykfx_zumlrv_ubg_okscenv
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10013e4d
cmp byte [ebp - 0x18], 0
je 0x10013f90
mov dword [ebp - 0x2c], 0x1ae
cmp dword [ebp - 0x2c], 0x243
jle 0x10013f60
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp + 8], ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x60]
and eax, esi
cdq
push edx
push eax
call fcn.10001acf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10013f2d
mov eax, dword [eax]
push eax
call fcn.10049e23
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.1000fa8e
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x55f0
jl 0x10013f12
inc edi
cmp edi, 0x30ff
jl 0x10013f0d
inc esi
cmp esi, 0x3390
jl 0x10013f0b
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10013f73
push 0x1fb1
call dword [sym.imp.USER32.dll_GetParent]
cmp dword [ebp - 0x2c], 0xfffffe74
jge 0x10013e4d
push str.lkjd_tvyvi_wszpsck
call fcn.10049e23
pop ecx
jmp 0x10013e4d
mov dword [ebp - 0x2c], 0x752f
cmp dword [ebp - 0x2c], 0x78fa
jle 0x10013fca
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007d358
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000ef91
inc edi
cmp edi, 0x50e7
jl 0x10013fa4
inc esi
cmp esi, 0x4113
jl 0x10013fa2
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x10013fda
push ecx
call fcn.10015051
pop ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x2c], 0x74fe
jge 0x10013e4d
mov edx, str.vbcjwswj_lxgtm_qkgctkbr
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10013e4d