Function at 0x1000a8ee
Capabilities:
Create pipe
Query environment variable

Disassembly:
mov eax, 0x1005dcdd
call fcn.1005d360
sub esp, 0x5c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
inc esi
mov dword [ebp - 0x3c], ecx
xor ebx, ebx
mov dword [ebp - 0x38], edx
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x40], ebx
call fcn.1000580e
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0x453606de
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], ebx
jmp 0x1000a93e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000a92e
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1000abc3
mov dword [ebp - 0x28], 0x83111738
mov dword [ebp - 0x1c], 0x15e82aa9
mov dword [ebp - 0x34], 0x2cfb6473
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a976
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jl 0x1000abbb
mov dword [ebp - 0x20], 0x3933
cmp dword [ebp - 0x20], 0x3b1c
jle 0x1000a9ee
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
and eax, edi
xor eax, ecx
lea ecx, [ebp - 0x64]
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a9b7
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x64]
call fcn.10005d35
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x7f70
jl 0x1000a99e
inc edi
cmp edi, 0x4869
jl 0x1000a999
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x3920
jl 0x1000a997
mov dword [ebp - 0x2c], 9
cmp dword [ebp - 0x20], 0x36d6
jge 0x1000aa09
push str.dmejakndn_ydqze_bxlyaonn_bcz_bhuwtazuf_popt_vrdtkayv_jiz_iewqtolxv
call fcn.1004699c
pop ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
jge 0x1000aad4
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x1000aac9
mov dword [ebp - 0x2c], 5
xor edx, edx
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + ecx*4]
mov dword [esi + edi*4], eax
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
mov ecx, 0xa04f
setne dl
sub ecx, eax
mov eax, dword [ebp - 0x20]
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
imul ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
add eax, dword [esi + edi*4]
imul edx, eax, 0xd09e
mov eax, dword [ebp - 0x1c]
cmp edx, eax
sete cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1000aa48
xor esi, esi
inc esi
mov dword [ebp - 0x34], esi
dec dword [ebp - 0x28]
jmp 0x1000a979
mov dword [ebp - 0x20], 0x17
cmp dword [ebp - 0x20], 0xfffffffc
jge 0x1000aac9
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1000abb3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000abab
mov dword [ebp - 0x34], 0x3e05
cmp dword [ebp - 0x34], 0x3f0d
jle 0x1000ab5d
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x30], ebx
add eax, edi
or eax, ecx
mov ecx, 0x10078bb8
or eax, esi
cdq
push edx
push eax
call fcn.100055e4
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x30], eax
cmp eax, 0x402c
jl 0x1000ab18
inc edi
cmp edi, 0x54f1
jl 0x1000ab13
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x7e39
jl 0x1000ab11
inc esi
cmp esi, 0x1735
jl 0x1000ab0c
xor esi, esi
inc esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov byte [ebp - 4], 3
cmp dword [ebp - 0x34], 0x3c87
jge 0x1000aba8
mov edx, str.duw_klbfvgtzj_mowi_mjjogj_qlf_ngi_mxqadz_fvfn_juqd_egvu_zqgb_qrnzu_yakhbiv
mov ecx, 0x10078bb8
call fcn.10009472
jmp 0x1000aba8
mov dword [ebp - 4], ebx
dec dword [ebp - 0x24]
jmp 0x1000aae4
dec dword [ebp - 0x20]
jmp 0x1000aadb
dec dword [ebp - 0x18]
jmp 0x1000a946
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x4c]
or dword [ebp - 4], 0xffffffff
call fcn.1000586b
mov edx, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x3c]
call fcn.10025356
mov eax, dword [ebp - 0x3c]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret