Function at 0x10039140
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10084d0c
call fcn.10083d50
sub esp, 0xbc
push ebx
mov dword [ebp - 0x3c], edx
xor ebx, ebx
mov dword [ebp - 0x1c], 0xbc662a2b
push edi
mov dword [ebp - 0x18], 0x7d50f82b
mov edi, ecx
mov dword [ebp - 0x24], 0x260d
push 4
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1003918e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 0x37400631
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1003917d
mov dword [ebp - 0x14], ebx
jmp 0x100391a2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10039198
cmp dword [ebp - 0xb8], ebx
jne 0x100391bc
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb4]
xor edx, edx
inc dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x1c]
imul ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
setg dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, 0xfe6b87c2
setg dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [edi + 0x10], ebx
jne 0x1003920c
xor al, al
jmp 0x100397c9
push esi
push 3
pop esi
push esi
lea ecx, [ebp - 0x9c]
call fcn.10028d1f
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x24], ebx
push esi
call fcn.10028d1f
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x14], 0x48ae
push ebx
mov dword [ebp - 0x18], 1
push eax
call fcn.1003bf9c
add esp, 0xc
mov dword [ebp - 0x20], ebx
jmp 0x10039270
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10039264
mov dword [ebp - 0x20], ebx
jmp 0x1003928b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb0], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1003927a
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 8], 1
mov eax, dword [ebp - 0x24]
setg cl
sub ecx, eax
cmp dword [ebp - 0x1c], ecx
jl 0x100392b2
cmp dword [ebp - 0x14], ebx
jne 0x100392b2
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x6c]
xor eax, eax
inc eax
push 2
sub eax, dword [esi + 4]
imul eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x9c]
inc dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
sub edx, dword [esi + 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x10039390
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], ebx
jl 0x1003938d
mov dword [ebp - 0x48], 0xab2a44bf
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x10039385
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003933b
push ebx
push 0x2d6b
call fcn.10039c92
pop ecx
pop ecx
mov dword [ebp - 0x14], ebx
jmp 0x1003937b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003935c
push 0x754
push 0x57c2
push ebx
call fcn.10039817
add esp, 0xc
push 0xe23
push ebx
push 0x5de9
lea eax, [ebp - 0x48]
push eax
push 0x752b
call fcn.1003d1c8
add esp, 0x14
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10039340
dec dword [ebp - 0x1c]
jns 0x10039325
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x24]
jns 0x10039316
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1003930a
lea ecx, [ebp - 0x6c]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.10028da1
lea eax, [ebp - 0x3c]
push eax
push 0x6e5e
push ebx
push 0x5098
push 0x5910
call fcn.100436ea
add esp, 0x14
lea ecx, [ebp - 0x78]
push 3
call fcn.10028d1f
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x40], 0xc4e2bf5
mov dword [ebp - 0x18], ebx
push 3
call fcn.10028d1f
push 3
pop edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x14], ebx
jmp 0x10039412
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10039402
mov dword [ebp - 0x14], ebx
jmp 0x1003942f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0xe8af
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003941c
push 0x50c8
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1003c1ad
mov eax, dword [ebp - 0x40]
add esp, 0x10
mov eax, dword [ebp - 0x90]
inc dword [eax]
mov eax, dword [ebp - 0x78]
mov dword [eax], 0x5ab8
imul eax, dword [ebp - 0x40], 0x5ab8
test eax, eax
jle 0x1003946c
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x2370
setg cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x90]
call fcn.10028da1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.10028da1
cmp dword [edi + 0x14], 0x10
jb 0x100394a0
mov ecx, dword [edi]
jmp 0x100394a2
mov ecx, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x38], ecx
jb 0x100394af
mov edx, dword [edi]
jmp 0x100394b1
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x10039715
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x18], ebx
jmp 0x100394db
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100394ca
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.1003b3c6
pop ecx
pop ecx
mov dword [ebp - 0x34], 0xfffffff7
jmp 0x1003952a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003950b
push 0x17ce
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10039527
push 0x5da8
push ebx
push 0x75e5
call fcn.10039d61
add esp, 0xc
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0x29
jge 0x100394f5
mov eax, dword [ebp - 0x38]
mov al, byte [eax]
cmp al, 0x30
jl 0x100395bd
cmp al, 0x39
jg 0x100395bd
mov dword [ebp - 0x18], 0xffffffff
xor eax, eax
mov dword [ebp - 0x1c], 4
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10039594
mov dword [ebp - 0x28], eax
xor edx, edx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2d]
push eax
mov byte [ebp - 0x2d], bl
push ebx
call fcn.10039d19
inc dword [ebp - 0x18]
xor eax, eax
pop ecx
pop ecx
inc eax
cmp dword [ebp - 0x18], eax
jge 0x1003955d
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x35e9
push ebx
push 0x4d61
call fcn.1003bdcd
mov ecx, dword [ebp - 0x38]
add esp, 0x14
inc ecx
jmp 0x100394a2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0x17c92570
mov dword [ebp - 0x18], ebx
jmp 0x100395d6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x100395cc
mov dword [ebp - 0x14], 9
jmp 0x100396c5
push 3
lea ecx, [ebp - 0x84]
call fcn.10028d1f
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x18], 0x74a71a6e
mov dword [ebp - 0x1c], 0xca307758
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x1c], 0x42d63d2c
mov dl, 1
push eax
call fcn.100390f1
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], 0xffffffff
pop ecx
imul ecx, dword [ebp - 0x1c], 0xe9b8
mov eax, dword [ebp - 0x84]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x18]
setle dl
imul eax, edx
test eax, eax
jne 0x10039668
cmp dword [ebp - 0x14], ebx
jne 0x10039668
mov dword [ebp - 0x44], ebx
mov edx, ebx
jmp 0x10039670
xor eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov edx, eax
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax + 8]
mov esi, dword [eax]
xor eax, eax
cmp edx, ecx
setl al
xor edx, edx
cmp eax, 0xffffffff
setne dl
add edx, ecx
xor ecx, ecx
imul edx, dword [ebp - 0x18]
cmp edx, esi
setg cl
xor eax, eax
cmp ecx, esi
setg al
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100396b7
push 0x1cd7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x84]
call fcn.10028da1
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 7
jne 0x100395e8
lea eax, [ebp - 0x3c]
push eax
push ebx
call fcn.1003987e
mov dword [ebp - 0x28], 0xe0cf5720
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
pop ecx
pop ecx
je 0x100396f2
push ebx
call fcn.1003d1a2
pop ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1003970e
push ebx
push 0x2ef9
push 0x49ba
call fcn.1003ce4a
add esp, 0xc
xor al, al
jmp 0x100397c8
mov dword [ebp - 0x2c], 0x324ec2e0
mov dword [ebp - 0x2c], ebx
jmp 0x10039777
push 0x53bc
push 0x5503
push 0x65f2
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0xfffc
push eax
push 0x43
push ebx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x865425a8
push eax
push 0x7186
push 0x79c1
push 0x77a0
push 0x7bcd
push 0x6950
push 0x16b2
push 0x56bc
call fcn.100398f7
add esp, 0x38
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff1
jne 0x10039721
mov eax, dword [ebp - 0x2c]
add eax, 0xb6d0
je 0x100397b6
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0xffffffff
push eax
push ebx
push 0x5b1a
push 0x118e
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x60], 8
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.1003be64
add esp, 0x18
jmp 0x100397c6
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100397c6
push ebx
call fcn.100398ba
pop ecx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret