Function at 0x9ecf70
Capabilities:
Link many functions at runtime
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa895ab
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0xab4f30
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0xa9ed20
call fcn.00a466e0
add esp, 4
mov esi, eax
push str.kernel32.dll
call fcn.00a222a0
mov ebp, eax
lea eax, [esp + 0x12]
push 2
push eax
push str.THNOCMDLN
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
test eax, eax
jne 0x9ecff3
push 0xffffffffffffffff
push ebx
push 0x9ec7c0
push str.GetCommandLineA
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009ec8c0
push str.GetCommandLineW
push esi
call fcn.00a468b0
add esp, 0x28
push 0xffffffffffffffff
push ebx
push fcn.009e51f0
push str.GetModuleHandleA
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009e5270
push str.GetModuleHandleW
push esi
call fcn.00a468b0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 0x28
push str.GetModuleHandleExW
push ebp
call edi
push str.GetModuleHandleExA
push ebp
mov dword [0xab4f4c], eax
call edi
mov dword [0xab4f08], eax
mov eax, dword [0xab4f4c]
cmp eax, ebx
je 0x9ed06e
push 0xffffffffffffffff
push ebx
push 0x9ed380
push str.GetModuleHandleExW
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9ed760
push str.GetModuleHandleExA
push esi
call fcn.00a468b0
add esp, 0x28
push 0xffffffffffffffff
push ebx
push 0x9e5510
push str.GetModuleFileNameA
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9e5640
push str.GetModuleFileNameW
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009eb0f0
push str.GetProcAddress
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009ebd00
push str.CreateThread
push esi
call fcn.00a468b0
add esp, 0x50
push 0xffffffffffffffff
push ebx
push fcn.009eba20
push str.ExitThread
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009ec440
push str.ExitProcess
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9ebf40
push str.TerminateProcess
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009e8ea0
push str.SearchPathA
push esi
call fcn.00a468b0
add esp, 0x50
push 0xffffffffffffffff
push ebx
push fcn.009e9040
push str.SearchPathW
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009ea990
push str.LoadLibraryA
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9eac10
push str.LoadLibraryW
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9ea6e0
push str.LoadLibraryExA
push esi
call fcn.00a468b0
add esp, 0x50
push 0xffffffffffffffff
push ebx
push fcn.009eae40
push str.LoadLibraryExW
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009e87d0
push str.FreeLibrary
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9ecb80
push str.FreeLibraryAndExitThread
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9ecc50
push str.DisableThreadLibraryCalls
push esi
call fcn.00a468b0
add esp, 0x50
push 0xffffffffffffffff
push ebx
push 0x9ecf10
push str.DeleteFiber
push esi
call fcn.00a468b0
add esp, 0x14
push str.GetDllDirectoryA
push ebp
call edi
push str.GetDllDirectoryW
push ebp
mov dword [0xab4f18], eax
call edi
push str.SetDllDirectoryA
push ebp
mov dword [0xab4cf0], eax
call edi
push str.SetDllDirectoryW
push ebp
mov dword [0xab4fc4], eax
call edi
mov dword [0xab4fa4], eax
mov eax, dword [0xab4f18]
cmp eax, ebx
je 0x9ed24c
push 0xffffffffffffffff
push ebx
push 0x9eda10
push str.GetDllDirectoryA
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push fcn.009eb420
push str.GetDllDirectoryW
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9edbb0
push str.SetDllDirectoryA
push esi
call fcn.00a468b0
push 0xffffffffffffffff
push ebx
push 0x9eb4d0
push str.SetDllDirectoryW
push esi
call fcn.00a468b0
add esp, 0x50
push 0xa9ecb0
call fcn.00a466e0
add esp, 4
mov ebp, eax
push str.ntdll.dll
call fcn.00a222a0
mov esi, eax
push str.RtlEnterCriticalSection
push esi
call edi
push str.RtlTryEnterCriticalSection
push esi
mov dword [0xab4fc8], eax
call edi
cmp eax, ebx
mov dword [0xab4f6c], eax
je 0x9ed29b
push 0xffffffffffffffff
push ebx
push 0x9ece40
push str.RtlEnterCriticalSection
push ebp
call fcn.00a468b0
add esp, 0x14
push 0x10
call fcn.009ef380
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
cmp esi, ebx
mov dword [esp + 0x24], ebx
je 0x9ed362
mov cl, byte [esp + 0x12]
push 0x18
mov byte [esi], cl
mov dl, byte [esp + 0x16]
mov byte [esi + 1], dl
mov byte [esi + 8], bl
call fcn.009ef380
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], 1
call fcn.00a7d900
cmp dword [0xab5048], ebx
jne 0x9ed302
mov dword [0xab5048], edi
mov dword [edi], ebx
mov eax, dword [0xab5048]
xor ebp, ebp
mov dword [eax + 8], ebx
mov ecx, dword [0xab5050]
inc ecx
mov dword [0xab5050], ecx
lea ecx, [esp + 0x14]
call fcn.00a7d99c
cmp ebp, ebx
je 0x9ed325
push ebp
call fcn.00a7d8f0
add esp, 4
mov edi, dword [0xab5048]
push 0x18
call fcn.009ef380
mov dword [eax + 4], edi
mov dword [eax + 0x14], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [eax], eax
mov eax, dword [esi + 4]
add esp, 4
mov dword [eax + 8], eax
mov dword [0xab5018], esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [0xab5018], ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret