Function at 0x61006960
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x103c
mov ebp, esp
push edi
push esi
push ebx
call sym.cygwin1.dll__alloca
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, eax
lea ebx, [ebp + 0xc]
mov eax, dword [0x61148914]
mov edx, ecx
movzx eax, byte [eax + 0xf]
shr al, 1
and eax, 1
test al, al
je 0x61006600
neg edx
mov dword [esp + 8], edx
lea esi, [ebp - 0x1018]
mov dword [esp + 4], 0x610065af
mov dword [esp], esi
call fcn.6108c610
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
lea eax, [eax + esi]
mov dword [esp], eax
mov ebx, esi
mov dword [esp + 4], edx
call fcn.6108c130
mov dword [esp + 4], 0x610065bd
mov dword [esp], esi
call sym.cygwin1.dll__strcat
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x61006650
test edx, 0x8080
jne 0x61006675
shr edx, 0x10
add ebx, 2
mov dword [esp], 0xfffffff4
add dl, dl
lea edi, [ebp - 0x101c]
sbb ebx, 3
sub ebx, esi
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileType
sub esp, 4
cmp eax, 2
je 0x61006740
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0x610ef77c
mov dword [esp + 8], 2
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x610065bf
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x61006740
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
lea esi, [esi]
lea edi, [edi]
call fcn.6108a140
mov dword [esp], 0
mov eax, dword [0x610ef740]
mov edx, 1
call fcn.61069e80
nop
lea esi, [esi]
jbe 0x610067d1
imul esp, dword [eax + 0x6d], 0x69746c75
jo 0x610067d8
pop edi
arpl word [ecx + 0x67], di
ja 0x610067dc
outsb dx, byte [esi]
pop edi
jo 0x610067e9
outsd dx, dword [esi]
bound ebp, qword [ebp + 0x6d]
sub byte [ebx + 0x6f], ah
outsb dx, byte [esi]
jae 0x610067f6
and byte [ebx + 0x68], ah
popal
jb 0x610067b2
sub al, 0x20
jne 0x610067fa
jae 0x610067f7
outsb dx, byte [si]
and byte fs:[ecx + 0x6e], ch
je 0x610067c3
and byte [ebp + 0x6e], dh
jae 0x61006805
outsb dx, byte [si]
and byte fs:[ecx + 0x6e], ch
je 0x610067ce
add byte [ebx + 0x59], al
inc edi
push edi
dec ecx
dec esi
pop edi
dec ebp
dec ecx
push ebx
dec ebp
inc ecx
push esp
inc ebx
dec eax
pop edi
dec edi
dec ebx
add byte [ebp + 0x26b4], cl
add byte [eax], al
and eax, 0x616d2073
insd dword es:[edi], dx
popal
imul esp, dword [bp + di + 0x20], 0x626d756e
jb 0x610067f0
jb 0x610067f0
insd dword es:[edi], dx
imul esi, dword [ebx + 0x6d], 0x68637461
and byte [ebp + 0x74], ah
arpl word gs:[ebp + 0x64], si
and byte [0x2f702520], ch
and eax, 0x90900070
nop
nop
nop
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and eax, 0x65762073
jb 0x6100687a
imul ebp, dword [edi + 0x6e], 0x73696d20
insd dword es:[edi], dx
popal
je 0x61006875
push 0x74656420
arpl word gs:[ebp + 0x64], si
and byte [0x2f702520], ch
and eax, 0x590a2e70
outsd dx, dword [esi]
jne 0x6100684a
push 0x20657661
insd dword es:[edi], dx
jne 0x6100689e
je 0x6100689d
jo 0x610068a2
and byte gs:[ebx + 0x6f], ah
jo 0x610068a5
jae 0x6100685f
outsd dx, dword [esi]
and byte [ebx + 0x79], ah
ja 0x610068b0
outsb dx, byte [esi]
xor dword [esi], ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte [edi + 0x6e], ch
and byte [ecx + 0x6f], bh
jne 0x610068c7
and byte [ebx + 0x79], dh
jae 0x610068ce
insd dword es:[edi], dx
or dl, byte cs:[ebx + 0x65]
popal
popal
jb 0x610068c6
push 0x726f6620
and byte [ebx + 0x79], ah
ja 0x610068d7
outsb dx, byte [esi]
xor dword [esi], ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte [ebp + 0x73], dh
jne 0x610068ea
imul ebp, dword [esi + 0x67], 0x65687420
and byte [eax + ebp*2 + 0x65], dh
and byte [edi + 0x69], dl
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x610068f9
and byte [ebx + 0x74], dl
popal
jb 0x61006900
sub eax, 0x6e69463e
das
push ebx
popal
jb 0x610068fb
push 0x63616620
imul ebp, dword [ecx + ebp*2 + 0x74], 0x6e610a79
insb byte es:[edi], dx
imul esi, dword [ecx + edi*2 + 0xa], 0x20646e61
insb byte es:[edi], dx
or ah, byte [ecx + 0x6e]
and byte fs:[ebp + 0x6c], ah
je 0x61006912
and byte [ecx + 0x6c], ah
insb byte es:[edi], dx
and byte [edx + 0x75], ah
je 0x610068d6
je 0x61006920
and byte gs:[ebp + 0x6f], ch
jae 0x61006932
and byte [edx + 0x65], dh
arpl word [ebp + 0x6e], sp
je 0x610068e6
jbe 0x6100692d
jb 0x6100693d
jb 0x6100693d
imul ebp, dword [edi + 0x6e], 0x5420202e
and byte [eax], ah
push esp
push 0x6f6d2065
jae 0x6100694c
je 0x610068f9
and byte [edx + 0x65], dh
jb 0x61006940
arpl word [ebp + 0x6e], sp
je 0x61006900
jbe 0x61006947
jb 0x61006957
imul ebp, dword [edi + 0x6e], 0x68732a20
outsb dx, byte [esi]
and byte [edx], ch
jae 0x61006953
push 0x646c756f
sub cl, byte [edx]
outsd dx, dword [esi]
jne 0x6100695a
sub cl, byte fs:[edx]
jb 0x61006958
jae 0x6100695e
and byte gs:[ecx + 0x6e], ch
outsb dx, byte [esi]
and byte [eax + 0x3a], bh
js 0x61006937
pop esp
arpl word [ecx + 0x67], di
ja 0x6100696c
ja 0x6100696c
outsb dx, byte [esi]
pop esp
bound ebp, qword [ecx + 0x6e]
sub al, 0x20
ja 0x61006974
jb 0x61006974
and byte [edi], ah
js 0x6100693a
daa
and byte [ecx + 0x73], ch
and byte [eax + ebp*2 + 0x65], dh
and byte [edx + esi*2 + 0x69], ah
jbe 0x61006985
and byte [edi + 0x6e], ch
and byte [edi + 0x68], dh
imul esp, dword [ebx + 0x68], 0x756f7920
and byte [eax + 0x61], ch
jbe 0x61006997
or ch, byte [ecx + 0x6e]
jae 0x610069ab
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte fs:[eax + ebp*2 + 0x65], dh
je 0x610069a7
and byte gs:[ebx + 0x79], ah
and byte [ebx + 0x79], ah
ja 0x610069af
outsb dx, byte [esi]
and byte [ecx + ebp*2 + 0x73], ah
je 0x610069bf
jb 0x610069b7
imul esp, dword [edx + 0x75], 0x6e6f6974
bound esi, qword [ebp + 0x74]
imul ebp, dword [edi + 0x6e], 0x768d002e
outsb dx, byte [esi]
add byte cs:[ebp - 0x4372ff8a], cl
daa
add byte [eax], al
jbe 0x61006959
add byte [ebp + 0x27bc], cl
lea edi, [edi]
mov esp, 0x27
add byte [ebp - 0x77], dl
push ebp
mov ebp, esp
sub esp, 0x428
invalid
invalid
invalid
fimul dword [esi]
add byte [eax], al
fimul dword [esi]
popal
add byte [ecx + 0x5d8bf85d], cl
pop ebp
or byte [ecx + 0x758bfc75], cl
adc byte [edx + eax*2 - 0x39], dh
inc esp
and al, 4
sub byte [eax + eax + 0x61], dl
popal
push ebx
add byte [ecx - 0x77], ah
sbb al, 0x24
add bh, al
inc esp
and al, 8
add byte [eax + eax], al
add byte [ebp - 0x4077b], cl
dec dword [ecx - 0x38fbdbbc]
add al, 0x24
cmpsb byte [esi], byte es:[edi]
add byte [bx + di - 0x18], ah
sal ch, cl
or eax, 0xcec8300