Function at 0x100134ea
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10143a0d
call fcn.1014399c
sub esp, 0x48
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 0x30]
push 2
call fcn.100141a5
xor edx, edx
mov dword [ebp - 4], edx
push 1
mov dword [ebp - 0x20], 0xfffffff6
mov dword [ebp - 0x14], edx
pop edi
jmp 0x10013525
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10013519
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], edx
jge 0x10013572
xor edi, edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x30], 0
je 0x10013551
push dword [ebp - 0x30]
call fcn.10123626
pop ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi]
lea ecx, [ebp - 0x48]
push 3
pop esi
push esi
mov dword [ebp - 0x24], eax
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], edx
jmp 0x1001369c
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x3c]
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001358e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10013582
mov eax, dword [ebp - 0x3c]
mov dword [eax], edx
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x100135b8
push edx
push edx
push 0x1cd2
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], edx
jl 0x10013661
mov dword [ebp - 0x14], 0x5f0ed1ad
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], edx
jl 0x10013633
mov dword [ebp - 0x18], 0x498e64e6
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x100135fe
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], edx
jl 0x1001362e
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001361e
push edx
push 0x7fa
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp dword [eax + ecx*4], edx
jne 0x1001362e
dec dword [ebp - 0x18]
jns 0x10013606
dec dword [ebp - 0x14]
jns 0x100135d3
mov dword [ebp - 0x14], edx
jmp 0x10013653
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10013650
push 0x1aad
push edx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10013638
dec dword [ebp - 0x1c]
jns 0x100135c4
mov eax, dword [ebp - 0x3c]
inc dword [eax]
cmp dword [eax], edi
jle 0x10013598
push eax
call fcn.10123626
xor edi, edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
dec dword [ebp - 0x20]
pop ecx
jns 0x1001356f
jmp 0x10013535
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xae35
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001368e
mov dword [ebp - 0x14], edx
jmp 0x100136b6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov dword [eax + ecx*4], 0xcd453606
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100136a6
mov edi, dword [ebp - 0x48]
mov dword [edi + 8], 2
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x20], 0x2aa9dade
cmp dword [edi + 8], edx
je 0x100136e2
cmp dword [ebp - 0x20], edx
je 0x100136e2
xor ecx, ecx
inc ecx
jmp 0x100136e4
mov ecx, edx
mov eax, dword [ebp - 0x54]
sub ecx, eax
cmp ecx, dword [ebp - 0x50]
jge 0x100136f8
cmp dword [edi + 8], edx
je 0x100136f8
xor ecx, ecx
inc ecx
jmp 0x100136fa
mov ecx, edx
mov eax, dword [edi + 8]
mov esi, 0x693009c
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
dec ecx
add ecx, eax
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
sub esi, ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
pop edx
setl al
dec dword [edi + 8]
mov dword [ebp - 0x20], eax
jns 0x100136c5
mov edx, dword [ebp - 0x48]
xor ecx, ecx
push edx
mov eax, dword [edx + 4]
add eax, 0xab79
cmp eax, 0x2c02
setle cl
mov dword [ebp - 0x20], ecx
call fcn.10123626
and dword [ebp - 0x48], 0
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
xor esi, esi
pop ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0xfffffff0
jmp 0x100137a6
mov dword [ebp - 0x20], 0x8b10
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001379d
push 1
push 0x1191
push 0x1e5
push 0x157e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
cmp dword [ebp - 0x20], 0
jne 0x100137ac
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x1001376e
mov cl, byte [ebp + esi - 0x24]
mov dl, 0xf9
call fcn.100150c9
mov byte [ebp + esi - 0x24], al
inc esi
cmp esi, 4
jb 0x1001375e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret