Function at 0x100c33df
Capabilities:
Query environment variable

Disassembly:
push 0x188
mov eax, 0x100f8b2b
call fcn.100ccaa2
mov edi, dword [ebp + 8]
mov dword [ebp - 0x190], edi
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebx], esi
call fcn.100c55b1
test eax, eax
jne 0x100c340e
xor eax, eax
jmp 0x100c37dc
mov dword [ebp - 0x164], 0x931e
mov eax, 0x936d
mov word [ebp - 0x160], ax
add eax, 0xfffffffd
mov word [ebp - 0x15e], ax
mov eax, 0x937b
mov word [ebp - 0x15c], ax
lea ecx, [eax + 4]
mov word [ebp - 0x15a], cx
add eax, 0xfffffff8
mov word [ebp - 0x158], ax
lea eax, [ecx - 0x3e]
mov word [ebp - 0x156], ax
mov word [ebp - 0x154], cx
add eax, 0x2d
mov word [ebp - 0x152], ax
lea eax, [ecx - 8]
mov word [ebp - 0x150], ax
add eax, 0xffffffb9
mov word [ebp - 0x14e], ax
lea eax, [ecx - 5]
mov word [ebp - 0x14c], ax
add eax, 0xfffffff8
mov word [ebp - 0x14a], ax
mov word [ebp - 0x148], ax
xor eax, eax
mov word [ebp - 0x146], ax
mov ax, word [ebp - 0x160]
lea ecx, [ebp - 0x164]
call fcn.100110f5
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x180], eax
test eax, eax
je 0x100c3407
mov dword [ebx], 1
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x168], 7
xor ecx, ecx
mov word [ebp - 0x17c], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x184], esi
push 0x1000
push eax
lea eax, [ebp - 0x184]
push eax
mov eax, dword [0x101ef2d0]
call dword [eax + 0x70]
test eax, eax
js 0x100c365f
mov eax, dword [ebp - 0x184]
test eax, eax
je 0x100c365f
cmp dword [eax + 8], 0x585894b1
jne 0x100c365f
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x180]
add eax, 0x38c98
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x138], 0xcb7f
mov eax, dword [ebp - 0x138]
xor eax, 0x25
mov word [ebp - 0x134], ax
mov eax, dword [ebp - 0x138]
inc eax
xor eax, 0x6c
mov word [ebp - 0x132], ax
mov eax, dword [ebp - 0x138]
add eax, 2
xor eax, 0x6c
mov word [ebp - 0x130], ax
mov eax, dword [ebp - 0x138]
add eax, 3
xor eax, 0x75
mov word [ebp - 0x12e], ax
xor eax, eax
mov word [ebp - 0x12c], ax
mov ax, word [ebp - 0x134]
mov eax, dword [ebp - 0x188]
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x138]
call fcn.100494f5
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.10004b9e
lea eax, [ebp - 0x17c]
cmp dword [ebp - 0x168], 8
cmovae eax, dword [ebp - 0x17c]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x194], eax
push eax
call fcn.100ddd9c
add esp, 0x14
cmp eax, 0x11
jne 0x100c3649
mov ebx, esi
mov dword [ebp - 0x18c], ebx
cmp ebx, 0x11
jae 0x100c3620
mov eax, dword [ebp - 0x180]
movzx eax, word [eax + ebx*2]
push eax
call fcn.100de147
pop ecx
test eax, eax
je 0x100c3649
inc ebx
jmp 0x100c35fd
test edi, edi
je 0x100c3632
lea eax, [ebp - 0x17c]
push eax
mov ecx, edi
call fcn.1003fedf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c]
call fcn.1000b2cc
push 4
pop eax
jmp 0x100c37dc
mov dword [ebp - 4], esi
jmp 0x100c365f
mov dword [ebp - 0x128], 0xa52a
mov eax, dword [ebp - 0x128]
xor eax, 0x53
mov word [ebp - 0x124], ax
mov eax, dword [ebp - 0x128]
inc eax
xor eax, 0x54
mov word [ebp - 0x122], ax
mov eax, dword [ebp - 0x128]
add eax, 2
xor eax, 0x45
mov word [ebp - 0x120], ax
mov eax, dword [ebp - 0x128]
add eax, 3
xor eax, 0x41
mov word [ebp - 0x11e], ax
mov eax, dword [ebp - 0x128]
add eax, 4
xor eax, 0x4d
mov word [ebp - 0x11c], ax
mov eax, dword [ebp - 0x128]
push 5
pop ebx
add eax, ebx
xor eax, 0x49
mov word [ebp - 0x11a], ax
mov eax, dword [ebp - 0x128]
add eax, 6
push 0x44
pop ecx
xor eax, ecx
mov word [ebp - 0x118], ax
xor eax, eax
mov word [ebp - 0x116], ax
mov ax, word [ebp - 0x124]
push 0x80
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x128]
call fcn.1000b52b
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x100c3773
cmp eax, 0x80
jae 0x100c3773
lea eax, [ebp - 0x114]
push eax
call fcn.100ddd9c
pop ecx
cmp eax, 0x11
jne 0x100c3773
movzx eax, word [ebp + esi*2 - 0x114]
push eax
call fcn.100de147
pop ecx
test eax, eax
je 0x100c3773
inc esi
cmp esi, 0x11
jb 0x100c3738
test edi, edi
je 0x100c37cb
lea eax, [ebp - 0x114]
push eax
call fcn.100ddd9c
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
mov ecx, edi
call fcn.1000b38e
jmp 0x100c37cb
push 0x3d
pop eax
mov word [ebp - 0x144], ax
push 0x3b
pop eax
mov word [ebp - 0x142], ax
push 0x44
pop eax
mov word [ebp - 0x140], ax
push 0x3e
pop eax
mov word [ebp - 0x13e], ax
xor eax, eax
mov word [ebp - 0x13c], ax
mov ax, word [ebp - 0x144]
lea ecx, [ebp - 0x144]
call fcn.1007db87
mov esi, eax
push esi
call fcn.100ddd9c
pop ecx
push eax
push esi
mov ecx, edi
call fcn.1000b38e
push 7
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c]
call fcn.1000b2cc
mov eax, ebx
call fcn.100cc9ef
ret