Function at 0x71cec390
Capabilities:
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x71d78674]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x71d7ab5c]
push edi
cmp eax, dword [ecx + 4]
jle 0x71cec42f
push 0x71d7ab5c
call fcn.71cf5946
add esp, 4
cmp dword [0x71d7ab5c], 0xffffffff
jne 0x71cec42f
push 0x10
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push str.AswJsFltOutputSeverity
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
xor esi, esi
cmp eax, 0xe
ja 0x71cec41c
lea eax, [ebp - 0x24]
push eax
call fcn.71cfcebe
add esp, 4
mov edi, eax
call fcn.71cfc1da
cmp dword [eax], esi
jne 0x71cec41c
cmp edi, 3
cmovbe esi, edi
push 0x71d7ab5c
mov dword [0x71d7ab60], esi
call fcn.71cf58fc
add esp, 4
mov eax, dword [0x71d7ab60]
test eax, eax
jle 0x71cec5c1
mov edi, dword [ebp + 8]
cmp edi, eax
jl 0x71cec5c1
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x42c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp + 0x10]
mov edx, 3
lea ecx, [edi - 1]
push ebx
push esi
push eax
cmp ecx, edx
lea eax, [ebp - 0x42c]
cmova ecx, edx
push dword [ecx*4 + 0x71d54f90]
push str.Severity:__s__Pid:_d__Tid:_d___hs__d_:
push 0
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x424]
push 0x200
push eax
call fcn.71cec680
add esp, 0x2c
test eax, eax
js 0x71cec5c6
mov esi, dword [ebp - 0x42c]
xor edi, edi
test esi, esi
je 0x71cec584
cmp esi, 0x7fffffff
ja 0x71cec584
mov edi, dword [ebp - 0x428]
xor ebx, ebx
test esi, esi
jne 0x71cec505
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
je 0x71cec542
test edi, edi
jne 0x71cec4fe
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov ebx, 0x8007007a
jmp 0x71cec542
lea eax, [ebp + 0x18]
push eax
push ecx
push dword [ebp + 0x14]
lea ebx, [esi - 1]
mov ecx, edi
mov edx, ebx
mov dword [ebp - 0x428], ebx
call fcn.71cc9f40
add esp, 0xc
test eax, eax
js 0x71cec577
cmp eax, ebx
ja 0x71cec577
jne 0x71cec571
xor eax, eax
mov word [edi + ebx*2], ax
xor ebx, ebx
mov eax, dword [ebp - 0x428]
mov esi, 1
lea edi, [edi + eax*2]
test ebx, ebx
js 0x71cec55e
cmp esi, 2
jbe 0x71cec5ab
lea eax, [ebp - 0x424]
mov dword [edi], 0xa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
xor ebx, ebx
sub esi, eax
jmp 0x71cec53f
xor eax, eax
mov word [edi + ebx*2], ax
mov ebx, 0x8007007a
jmp 0x71cec534
mov ebx, 0x80070057
test esi, esi
je 0x71cec542
mov ecx, dword [ebp - 0x428]
xor edx, edx
pop edi
pop esi
mov eax, ebx
mov word [ecx], dx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov eax, 0x8007139f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret