Function at 0x10019ed8
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
push 2
lea ecx, [ebp - 0x64]
call fcn.10016c36
xor edi, edi
mov dword [ebp - 0xc], 0x7730f94f
mov dword [ebp - 0x18], edi
jmp 0x10019f0a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x64]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019efd
mov dword [ebp - 0xc], edi
jmp 0x10019f2b
mov dword [ebp - 0x2c], 0xfffffff9
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x64]
mov dword [eax + edx*4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jle 0x10019f15
lea ecx, [ebp - 0x64]
call fcn.10017508
cmp byte [ebp + 8], 0
je 0x1001a48a
mov dword [ebp - 4], 0xe60f951
xor esi, esi
mov dword [ebp - 0x18], edi
inc esi
mov dword [ebp - 0x20], 0x43cc9f19
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x14], 0xb7c39c9d
mov dword [ebp - 8], 0x6920
mov dword [ebp + 8], edi
jmp 0x10019f7f
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x1c], 0x302aff63
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x10019f71
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe80031aa
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 4]
imul edx, eax
mov eax, dword [ebp - 4]
cmp edx, eax
mov eax, dword [ebp - 4]
setne cl
xor edx, edx
imul ecx, ecx, 0x7d26
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jg 0x10019fd0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], 0xfffd
cmp dword [ebp - 8], edi
je 0x10019fe3
mov edx, esi
cmp dword [ebp - 0x24], edi
jne 0x10019fe5
mov edx, edi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, dword [ebp - 4]
je 0x1001a00f
mov eax, dword [ebp - 8]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor ecx, ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x28], 0x97151158
mov dword [ebp + 8], 0x94784533
mov dword [ebp + 8], esi
mov dword [ebp - 0x2c], 0x4a48c552
mov dword [ebp - 0x14], 0xf
cmp dword [ebp - 0x14], ecx
je 0x1001a085
mov dword [ebp - 8], ecx
jmp 0x1001a07a
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x1001a065
push 0x130d
push 0xdde
call edi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor ecx, ecx
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x1001a077
push ecx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
xor ecx, ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
je 0x1001a047
dec dword [ebp - 0x14]
jne 0x1001a042
cmp dword [ebp - 0xc], ecx
je 0x1001a0e5
mov dword [ebp + 8], ecx
mov dword [ebp - 0x2c], 0xf3aa798d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], 0xa5dbdfdd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
jmp 0x1001a13c
mov dword [ebp + 8], 0xfffffffd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x28], ecx
je 0x1001a0fc
cmp dword [ebp - 0x2c], ecx
jne 0x1001a0fe
mov esi, ecx
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setle dl
cmp edx, 0xc99cc0f7
ja 0x1001a116
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor esi, esi
neg ecx
inc esi
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x18], eax
push 2
call fcn.10016c36
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp + 8], 0
jmp 0x1001a16c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 6
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001a15c
mov dword [ebp - 0xc], 0
jmp 0x1001a1cb
mov dword [ebp + 8], 0xa4d073ff
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x58]
cmp dword [eax + ecx*4], 0xffffffff
setge dl
mov dword [ebp + 8], edx
mov dword [ebp + 8], 0
jmp 0x1001a1c3
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x2c], 0x704f3d4e
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jle 0x1001a19d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x1001a17b
lea ecx, [ebp - 0x58]
call fcn.10017508
xor ecx, ecx
mov dword [ebp - 0xc], 0x5b9b55bb
mov dword [ebp + 8], ecx
jmp 0x1001a1f4
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10], 0x689351f2
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001a1e6
mov dword [ebp - 0xc], ecx
jmp 0x1001a40e
mov dword [ebp + 8], 0xfffffffb
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 0x2c], 0xfffffffa
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x1001a229
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp dword [ebp + 8], ecx
jl 0x1001a40b
mov dword [ebp - 4], 9
mov dword [ebp - 0x18], ecx
jmp 0x1001a24f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001a241
mov dword [ebp - 0x40], ecx
jmp 0x1001a3f9
push esi
lea ecx, [ebp - 0x4c]
call fcn.10016c36
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], edx
jmp 0x1001a284
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 0x492a4153
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001a274
mov eax, dword [ebp + 8]
cmp dword [ebp + eax*4 - 0x10], edx
jne 0x1001a2f0
mov eax, dword [ebp - 0x40]
mov ecx, esi
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setl dl
cmp edx, dword [ebp + 8]
jle 0x1001a2b8
cmp dword [ebp + 8], 0
jne 0x1001a2b8
xor edx, edx
jmp 0x1001a2ba
mov edx, esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + eax*4 - 0x10]
lea eax, [edx - 0x26b17019]
xor edx, edx
cmp ecx, eax
setge dl
imul eax, edx, 0x5d17
test eax, eax
jne 0x1001a2db
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x10]
cmp dword [ebp - 0xc], edx
je 0x1001a387
mov eax, dword [ebp + 8]
cmp dword [ebp + eax*4 - 0x10], edx
je 0x1001a387
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], edx
cmp dword [eax], edx
jne 0x1001a322
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x4c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, edx
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], 0xc588
jne 0x1001a324
mov ecx, esi
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
xor eax, eax
cmp ecx, 9
setge al
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x24]
je 0x1001a366
cmp dword [ebp - 0x24], 0
je 0x1001a366
mov eax, esi
jmp 0x1001a368
xor eax, eax
xor ecx, ecx
test eax, eax
setg cl
xor eax, eax
cmp ecx, 0x94be
setne al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x1001a3ec
mov dword [ebp - 0x28], 2
mov dword [ebp - 4], edx
jmp 0x1001a3b1
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 8], edx
jmp 0x1001a3a9
mov dword [ebp - 0x24], 0xc9e433c5
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1001a39f
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x1001a393
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp eax, 0x62a08d8d
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10], ecx
lea ecx, [ebp - 0x4c]
call fcn.10017508
inc dword [ebp - 0x40]
xor ecx, ecx
cmp dword [ebp - 0x40], ecx
jle 0x1001a25d
dec dword [ebp + 8]
jns 0x1001a235
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xa
je 0x1001a201
mov dword [ebp - 0x18], esi
mov dword [ebp + 8], ecx
jmp 0x1001a42e
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x34], 0x5464b5f5
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001a420
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x1001a44a
push ecx
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
jmp 0x1001a46a
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x1001a467
push 0x2345
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001a44f
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x1001a483
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [edx]
cmp dword [edx], 3
jl 0x1001a476
jmp 0x1001a4a7
cmp byte [esi], 0
je 0x1001a4a7
push 0x2415
push 0x11e9
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret