Function at 0x1001add5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005c4c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x2c], edi
cmp byte [ebp + 0xc], bl
je 0x1001b56b
mov dword [esp + 0x1c], 0xe7d8a870
mov dword [esp + 0x94], 0x7b568be1
mov dword [esp + 0x1c], ebx
jmp 0x1001ae2f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x70], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001ae23
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 1
jg 0x1001b1d5
mov dword [esp + 0x14], 0x5b3b9da4
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x1001b1a3
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 0x19fe
cmp dword [esp + 0x18], 0xef4
jge 0x1001b16a
call fcn.10044348
push eax
push 0x10066e88
push str.in.txt
call fcn.100444f7
add esp, 0xc
call fcn.10044348
add eax, 0x20
push eax
push 0x10066e94
push str.out.txt
call fcn.100444f7
add esp, 0xc
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x14c], ebx
mov edi, ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 0x6d
lea eax, [esp + 0xd4]
mov byte [esp + 0x150], 1
push 1
push eax
call fcn.10017197
add esp, 0xc
mov byte [esp + 0xd0], bl
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], 1
lea ecx, [esp + 0x40]
push eax
call fcn.1001f5b8
push 2
pop eax
mov dword [esp + 0x38], eax
cmp byte [esp + eax + 0xd0], 0
je 0x1001af43
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x44]
call fcn.1001f5b8
mov eax, dword [esp + 0x38]
push 2
pop edx
lea ecx, [eax + eax]
jmp 0x1001af3e
inc edx
mov byte [esp + ecx + 0xd0], bl
mov ecx, edx
imul ecx, eax
cmp ecx, 0x6d
jl 0x1001af31
inc eax
mov dword [esp + 0x38], eax
cmp eax, 0x6d
jl 0x1001af0d
lea eax, [esp + 0x58]
push eax
push ecx
lea eax, [esp + 0x38]
mov ecx, 0x10076c98
push eax
call fcn.1001ef50
pop ecx
mov ecx, eax
call fcn.1001ef50
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1001b147
mov edx, dword [esp + 0x40]
mov esi, edi
mov ecx, dword [esp + 0x30]
mov eax, ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x18], eax
cmp dword [edx], ecx
jg 0x1001afcf
mov esi, dword [esp + 0x44]
mov edi, edx
sub esi, edx
sar esi, 2
cmp eax, esi
jae 0x1001afc3
push edi
lea ecx, [esp + 0x50]
call fcn.1001f5b8
mov eax, dword [esp + 0x18]
add edi, 4
mov ecx, dword [esp + 0x30]
inc eax
mov dword [esp + 0x18], eax
cmp dword [edi], ecx
jle 0x1001afa1
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x58]
push esi
push ecx
push ecx
mov ecx, 0x10076b78
call fcn.1001f0d8
mov edx, 0x10066ea4
mov ecx, eax
call fcn.10003a53
pop ecx
mov ecx, eax
call fcn.1001f0d8
mov edx, 0x10066ea0
mov ecx, eax
call fcn.10003a53
mov ecx, dword [esp + 0x10]
sub ecx, edi
sar ecx, 2
mov dword [esp + 0x10], ecx
test cl, 1
jne 0x1001b083
lea eax, [esi + esi]
cmp eax, ecx
jbe 0x1001b04c
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x1001b0f1
mov esi, ecx
push dword [edi + ebx*4]
mov edx, 0x10066ea4
push ecx
mov ecx, 0x10076b78
call fcn.10003a53
pop ecx
mov ecx, eax
call fcn.1001f0d8
inc ebx
cmp ebx, esi
jb 0x1001b027
jmp 0x1001b0ef
sub ecx, eax
shr ecx, 1
mov dword [esp + 0x10], ecx
lea esi, [ecx + eax]
cmp ecx, esi
jae 0x1001b0f1
mov ebx, ecx
push dword [edi + ebx*4]
mov edx, 0x10066ea4
push ecx
mov ecx, 0x10076b78
call fcn.10003a53
pop ecx
mov ecx, eax
call fcn.1001f0d8
inc ebx
cmp ebx, esi
jb 0x1001b061
jmp 0x1001b0ef
lea edx, [esi + esi]
lea eax, [edx - 1]
cmp eax, ecx
jbe 0x1001b0bb
mov dword [esp + 0x18], ebx
test ecx, ecx
je 0x1001b0f1
mov esi, dword [esp + 0x10]
push dword [edi + ebx*4]
mov edx, 0x10066ea4
push ecx
mov ecx, 0x10076b78
call fcn.10003a53
pop ecx
mov ecx, eax
call fcn.1001f0d8
inc ebx
cmp ebx, esi
jb 0x1001b099
jmp 0x1001b0ef
sub ecx, edx
lea esi, [edx - 1]
inc ecx
shr ecx, 1
add esi, ecx
mov dword [esp + 0x10], ecx
cmp ecx, esi
jae 0x1001b0f1
mov ebx, ecx
push dword [edi + ebx*4]
mov edx, 0x10066ea4
push ecx
mov ecx, 0x10076b78
call fcn.10003a53
pop ecx
mov ecx, eax
call fcn.1001f0d8
inc ebx
cmp ebx, esi
jb 0x1001b0cf
xor ebx, ebx
push 0x10076b78
call fcn.10021af6
pop ecx
push eax
call fcn.10021af6
pop ecx
lea eax, [esp + 0x58]
push eax
push ecx
lea eax, [esp + 0x38]
mov ecx, 0x10076c98
push eax
call fcn.1001ef50
pop ecx
mov ecx, eax
call fcn.1001ef50
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1001af7a
test edi, edi
je 0x1001b147
push edi
call fcn.10043dc9
pop ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
or dword [esp + 0x14c], 0xffffffff
mov eax, dword [esp + 0x40]
test eax, eax
je 0x1001b16a
push eax
call fcn.10043dc9
pop ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001b180
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x70], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b170
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x70]
mov eax, dword [esp + 0x1c]
neg ecx
mov dword [esp + eax*4 + 0x70], ecx
dec dword [esp + 0x14]
jns 0x1001ae5f
push 1
lea eax, [esp + 0x98]
mov edx, 0x6c7b
push eax
push ecx
push 0x7559
push ecx
push ecx
call fcn.1001aab8
add esp, 0x18
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x1001ae45
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
lea eax, [esp + 0x90]
mov dword [esp + 0x14c], 2
push eax
lea eax, [esp + 0x70]
mov dword [esp + 0x84], 0xfffffff9
push eax
push ecx
push ecx
lea eax, [esp + 0x94]
mov dword [esp + 0x9c], 0xfffffff6
push eax
mov dword [esp + 0x98], 0xffffffff
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0x84], 0xfe662db8
lea eax, [esp + 0x90]
push ecx
mov dword [esp + 0xb8], 9
lea edx, [esp + 0xb8]
mov dword [esp + 0xac], 0x493e623b
lea ecx, [esp + 0x9c]
mov dword [esp + 0x94], 0xb5d1cb6a
push eax
call fcn.1001b763
mov byte [esp + 0x43], bl
add esp, 0x20
cmp byte [esp + 0x23], 0
je 0x1001b287
call fcn.1001ebdf
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x18], 0x7478144a
mov dword [esp + 0x5c], 0x5f0ed1ad
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ebx
jmp 0x1001b2ba
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x98], 0xdf75
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001b2a7
mov dword [esp + 0x10], ebx
jmp 0x1001b2d7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x24], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001b2c7
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x1001b316
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x98]
cmp eax, 0x1d832937
sete cl
mov dword [esp + 0x18], ecx
push ecx
mov byte [esp + 0x26], bl
lea ecx, [esp + 0x26]
call fcn.1001dc08
dec dword [esp + 0x28]
pop ecx
jns 0x1001b2e8
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], 0x7d8e
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], ebx
jmp 0x1001b34a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x88], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001b337
mov dword [esp + 0x10], ebx
jmp 0x1001b36a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa0], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b357
mov eax, dword [esp + 0x14]
inc dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x14]
sub eax, 0xccde
sub edx, eax
neg edx
sbb edx, edx
inc edx
sub ecx, edx
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xb0bf
setge al
cmp dword [esi + 0x14], 8
mov dword [esp + 0xa8], eax
jb 0x1001b3bf
mov eax, dword [esi]
jmp 0x1001b3c1
mov eax, esi
push dword [esi + 0x10]
mov ecx, edi
push ebx
push eax
call fcn.1001f9ed
mov edi, ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], edi
cmp edi, dword [esp + 0x5c]
jae 0x1001b45c
cmp eax, 0xffffffff
je 0x1001b435
cmp eax, edi
je 0x1001b406
push ecx
lea eax, [esp + 0x64]
push eax
push ecx
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x3c]
lea edx, [esp + 0x50]
call fcn.1001c39a
mov eax, dword [esp + 0x50]
add esp, 0x14
mov edi, dword [esp + 0x28]
add edi, eax
cmp dword [esi + 0x14], 8
mov dword [esp + 0x34], edi
jb 0x1001b41a
mov eax, dword [esi]
jmp 0x1001b41c
mov eax, esi
push dword [esi + 0x10]
mov ecx, dword [esp + 0x30]
push edi
push eax
call fcn.1001f9ed
mov dword [esp + 0x3c], eax
cmp edi, 0xffffffff
jne 0x1001b3d7
jmp 0x1001b45c
lea eax, [esp + 0x34]
mov edx, 0x574
push eax
push dword [esp + 0x30]
lea eax, [esp + 0x68]
xor cl, cl
push 0x480c
push eax
push 0x23db
call fcn.1001c70c
add esp, 0x14
mov dword [esp + 0x14], 0x2667a876
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x14], ebx
jmp 0x1001b485
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xac], 0xfdf99ff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b472
mov dword [esp + 0x18], 0x7138
cmp dword [esp + 0x18], 0x718c
jle 0x1001b4e7
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0xb8]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b4bf
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push ebx
push 1
lea ecx, [esp + 0xc0]
call fcn.100020a8
inc edi
cmp edi, 0x511c
jl 0x1001b4a2
inc esi
cmp esi, 0x6e34
jl 0x1001b4a0
push 2
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1001b531
push 1
push 0x6b82
push 0x3b28
push ebx
mov dword [esp + 0x38], 0x3292c5eb
mov edx, 0x3298
push 1
mov ecx, 0x5038
call fcn.1001c0db
mov eax, dword [esp + 0x3c]
add esp, 0x14
mov eax, dword [esp + 0xb0]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001b4f0
cmp dword [esp + 0x18], 0x6e3e
jge 0x1001b54c
push str.qrseapwb_rszco_hxm_oallov_itvjqflzc_fhmgeh_ahznl_ndfr_yqssyu_rurqczq_rcvdoo_vvfybczdv_pfkvz
call fcn.10043bf4
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x150], esi
call fcn.1001f424
lea ecx, [esp + 0x60]
call fcn.1001fb78
jmp 0x1001b578
push 0xe3d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esp + 0x144]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret