Function at 0x1006daa8
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1014826f
call fcn.1014399c
sub esp, 0xe8
push ebx
push esi
push edi
push 2
pop edi
mov esi, ecx
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x30], edi
push 1
call fcn.100141a5
xor ebx, ebx
mov dword [ebp - 0x24], 0x283bc1b0
push 3
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1006daf9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1006daec
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 1
jge 0x1006db1c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1006db07
push 3
pop ecx
mov dword [ebp - 0x18], ebx
jmp 0x1006db75
mov dword [ebp - 0x14], 0xfd4914d2
mov dword [ebp - 0x14], ebx
jmp 0x1006db3e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0xc7555b7c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1006db2d
mov dword [ebp - 0x14], ebx
jmp 0x1006db6d
mov dword [ebp - 0x20], 0x14173bf3
mov dword [ebp - 0x20], ebx
jmp 0x1006db65
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa0], 0x8872fa4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1006db54
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1006db48
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1006db21
inc dword [ebp - 0x24]
cmp dword [ebp - 0x68], ebx
je 0x1006db94
push dword [ebp - 0x68]
call fcn.10123626
pop ecx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
push 8
pop edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1006dbb9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c], 0x4a8c6a53
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1006dbab
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x3c], ebx
jl 0x1006dc1a
mov dword [ebp - 0x28], 0xbe92e3f9
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x2c], ebx
je 0x1006dbde
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3c], 1
jne 0x1006dc10
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x2c], ebx
je 0x1006dc10
xor eax, eax
inc eax
jmp 0x1006dc12
mov eax, ebx
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x3c]
jns 0x1006dbc7
mov dword [ebp - 0x14], 0xfffffff1
jmp 0x1006dc47
mov dword [ebp - 0x24], 0xbb000e2e
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x1006dc23
push 0x44
pop edi
push edi
lea eax, [ebp - 0xf4]
push ebx
push eax
call fcn.10027c8d
push 0x10
lea eax, [ebp - 0x88]
push ebx
push eax
call fcn.10027c8d
add esp, 0x18
mov dword [ebp - 0xf4], edi
cmp dword [esi + 0x14], 8
jb 0x1006dc7f
mov ecx, dword [esi]
jmp 0x1006dc81
mov ecx, esi
cmp dword [esi + 0x14], 8
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
jb 0x1006dc8f
mov esi, dword [esi]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], ebx
push eax
push esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
call fcn.10039be6
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x68ec0ae9
push 3
mov dword [ebp - 0x28], 0xbf2d3f50
mov dword [ebp - 0x14], 0x1b
pop esi
cmp dword [ebp - 0x14], 0xfffffffa
jle 0x1006dd16
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ebx
jmp 0x1006dcdf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1006dcce
mov dword [ebp - 0x20], ebx
jmp 0x1006dcf1
cmp dword [ebp - 0x20], ebx
jne 0x1006dcf7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1006dce9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1006dd11
push 0x1769
push 0xe14
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [ebp - 0x14]
jmp 0x1006dcc0
lea eax, [ebp - 0x78]
mov dword [ebp - 0x28], 1
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x78], ebx
call fcn.100396e5
push 2
lea ecx, [ebp - 0x50]
call fcn.100141a5
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x1006dd54
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1006dd48
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jl 0x1006de83
push edx
lea ecx, [ebp - 0x74]
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1006dd83
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1006dd77
mov eax, dword [ebp - 0x74]
mov dword [eax], ebx
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1006ddae
push ebx
push ebx
push 0x1cd2
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
inc edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1006de5a
mov dword [ebp - 0x14], 0x5f0ed1ad
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1006de2b
mov dword [ebp - 0x18], 0x498e64e6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1006ddf5
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1006de26
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1006de13
push ebx
push 0x7fa
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
cmp dword [eax + ecx*4], ebx
jne 0x1006de23
dec dword [ebp - 0x18]
jns 0x1006ddfd
xor edx, edx
inc edx
dec dword [ebp - 0x14]
jns 0x1006ddc9
mov dword [ebp - 0x14], ebx
jmp 0x1006de4c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1006de49
push 0x1aad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1006de30
dec dword [ebp - 0x20]
jns 0x1006ddba
mov eax, dword [ebp - 0x74]
inc dword [eax]
cmp dword [eax], edx
jle 0x1006dd8d
push eax
call fcn.10123626
pop ecx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
dec dword [ebp - 0x24]
push 1
pop edx
jns 0x1006dd66
mov byte [ebp - 4], bl
cmp dword [ebp - 0x50], 0
je 0x1006de9e
push dword [ebp - 0x50]
call fcn.10123626
pop ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x88]
mov edi, 0x5c4a9
push eax
lea eax, [ebp - 0xf4]
push eax
push ebx
push ebx
push 0x8000400
push 1
push ebx
push ebx
push dword [ebp - 0x5c]
push ebx
push edi
push 0x4b24e
call fcn.10027b51
pop ecx
pop ecx
call eax
test eax, eax
je 0x1006e007
push 0xffffffffffffffff
push dword [ebp - 0x88]
push edi
push 0x15d4f
call fcn.10027b51
pop ecx
pop ecx
call eax
mov dword [ebp - 0x24], 0x4d2edc75
mov dword [ebp - 0x28], 0x73bf38c0
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x20], 0x4b5c6f8b
mov dword [ebp - 0x30], 0x5b0bb8bf
mov dword [ebp - 0x44], 0xc7104272
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x28], 0x483bbb66
mov dword [ebp - 0x18], ebx
jmp 0x1006df4a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0xd3ecf04b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1006df39
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, 0xfffe
setl cl
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, esi
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x90], eax
je 0x1006dfe0
push dword [ebp + 0xc]
push dword [ebp - 0x88]
push edi
push 0x5f68b
call fcn.10027b51
pop ecx
pop ecx
call eax
push dword [ebp - 0x88]
mov esi, 0x2ec5f
push edi
push esi
call fcn.10027b51
pop ecx
pop ecx
call eax
push dword [ebp - 0x84]
push edi
push esi
call fcn.10027b51
pop ecx
pop ecx
call eax
lea ecx, [ebp - 0x5c]
call fcn.100194af
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret