Function at 0x1000df47
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100450f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x210]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push eax
xor eax, eax
mov dword [ebp - 0x21c], ecx
cmp byte [ecx + 0x7c], al
setne al
dec eax
and eax, 0xfffffe00
add eax, 0x20219
push eax
push ebx
push edx
push esi
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e162
push edi
push 0x38
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10025fe6
mov ecx, eax
call fcn.1000e53a
mov edi, eax
test edi, edi
je 0x1002602e
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x24], eax
lea eax, [edi + 0x20]
push eax
lea eax, [edi + 0x1c]
push eax
lea eax, [edi + 0x18]
push eax
push dword [ebp - 0x210]
call fcn.1000d5e5
mov esi, eax
test esi, esi
jne 0x1000e14d
lea eax, [edi + 4]
push eax
push 0x10005b20
push dword [ebp - 0x210]
call fcn.1000e333
mov esi, eax
test esi, esi
jne 0x1000e176
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], ebx
push eax
push 0x10005b30
push dword [ebp - 0x210]
call fcn.1000e333
mov esi, eax
test esi, esi
jne 0x1000e0e3
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10025fed
cmp eax, 0x104
ja 0x10025ff7
lea ecx, [ebp - 0x20c]
lea eax, [ecx + 2]
push 2
mov dword [ebp - 0x218], eax
pop edx
mov ax, word [ecx]
add ecx, edx
cmp ax, bx
jne 0x1000e06c
sub ecx, dword [ebp - 0x218]
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x218], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [edi], eax
test eax, eax
je 0x10026007
mov edx, dword [ebp - 0x218]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, eax
call fcn.1000e4a6
test eax, eax
js 0x1002600f
mov eax, dword [ebp - 0x218]
cmp eax, 1
jbe 0x1000e0e3
mov ecx, dword [edi]
push 0x5c
pop edx
cmp dx, word [ecx + eax*2 - 4]
je 0x1000e19a
cmp dword [ebp - 0x214], ebx
je 0x1000e0f7
push dword [ebp - 0x214]
call fcn.1000e5bb
pop ecx
test esi, esi
jne 0x1000e14d
lea eax, [edi + 0xc]
push eax
push 0x10005b18
push dword [ebp - 0x210]
call fcn.1000e333
lea esi, [eax - 2]
neg esi
sbb esi, esi
and esi, eax
jne 0x1000e14d
lea eax, [edi + 0x10]
push eax
push 0x10005b00
push dword [ebp - 0x210]
call fcn.1000e333
mov esi, eax
cmp esi, 2
jne 0x1000e137
mov esi, ebx
test esi, esi
jne 0x1000e14d
mov eax, dword [ebp - 0x21c]
push edi
add eax, 4
push eax
call fcn.1000e2f0
mov ebx, eax
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x1000e1a6
test ebx, ebx
je 0x1000e1a6
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10023280
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 2
jne 0x1000e0f7
lea eax, [edi + 8]
push eax
push 0x10005b40
push dword [ebp - 0x210]
call fcn.1000e333
mov esi, eax
jmp 0x1000e0f7
xor edx, edx
mov word [ecx + eax*2 - 4], dx
jmp 0x1000e0e3
test edi, edi
je 0x1000e161
mov ecx, edi
call fcn.1000e569
mov ecx, edi
call fcn.1000e569
push edi
call fcn.1000e5bb
pop ecx
jmp 0x1000e161
mov edi, ebx
jmp 0x1000dfbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10025ffa
push 8
pop esi
test esi, esi
jne 0x1000e0e3
jmp 0x1000e05a
push 8
pop esi
jmp 0x1000e0e3
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x10026027
movzx esi, ax
jmp 0x1000e0e3
mov esi, eax
jmp 0x1000e0e3
push 8
pop esi
jmp 0x1000e137