Function at 0x10018c90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
xor ebx, ebx
push edi
test cl, cl
je 0x10018e10
mov dword [ebp - 0x18], ebx
xor esi, esi
mov dword [ebp - 0x14], 0xef20fe6e
inc esi
mov dword [ebp - 0xc], ebx
jmp 0x10018cc3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c], 0xbeccce1e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10018cb5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 1], bl
cmp byte [ebp - 1], al
je 0x10018cf3
push ebx
push 0x202f
push ebx
push 0x20ed
push 0x13d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov dword [ebp - 0xc], 0x7862fd41
mov dword [ebp - 0x10], 0xbefcdf1
mov dword [ebp - 0xc], ebx
jmp 0x10018d14
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x34], 0xcfda6c2e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018d06
mov dword [ebp - 0xc], 0xfffffffb
jmp 0x10018df3
mov dword [ebp - 8], 0x70ade21
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], ebx
jmp 0x10018d9b
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x18], 0xe018
mov dword [ebp - 0x18], 0x6be856df
cmp dword [ebp - 0x14], ebx
jne 0x10018d5d
mov dword [ebp - 0x18], 0x714ad38
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10018d5f
mov edx, esi
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x10018d6e
mov edi, esi
cmp dword [ebp - 0x10], ebx
jne 0x10018d70
mov edi, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc]
sete cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, edi
neg edx
sbb edx, edx
add edx, 7
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x18], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x11
jle 0x10018d35
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp eax, 0x7bf7
mov eax, dword [ebp - 8]
setne cl
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp eax, ecx
setg dl
mov dword [ebp - 8], edx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe3
jle 0x10018d26
mov eax, dword [ebp - 0x2c]
push ebx
push ebx
mov dword [ebp - 0x30], eax
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x10018f60
mov dword [ebp - 8], 0xac204e2
mov dword [ebp - 0x10], ebx
jmp 0x10018e2a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10018e1c
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 8], ebx
jmp 0x10018e4f
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018e4c
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff9
jne 0x10018e3b
mov dword [ebp - 8], 2
cmp dword [ebp - 8], ebx
jl 0x10018e7b
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018e76
push 0x184a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec dword [ebp - 8]
jns 0x10018e61
mov dword [ebp - 0xc], 0x5c96dd1e
xor esi, esi
mov dword [ebp - 0x10], 0xf2f4a8b1
inc esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], esi
mov dword [ebp - 8], ebx
jmp 0x10018eac
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20], 0xe149cff2
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10018e9e
mov dword [ebp - 8], ebx
jmp 0x10018ec4
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x28], 0x17b38e51
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018eb6
mov eax, dword [ebp - 0xc]
mov ecx, 0xa729
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
sub ecx, eax
sub ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x18]
jne 0x10018ee5
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
sub edx, 0x5900
cmp eax, edx
setl cl
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x18], ebx
je 0x10018f27
mov edx, esi
cmp dword [ebp - 0x10], ebx
jne 0x10018f29
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x10018f42
cmp dword [ebp - 8], ebx
jne 0x10018f42
mov esi, ebx
push ebx
push 0xd59
push 0x167d
mov dword [ebp - 0x20], esi
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret