Function at 0x71cefb50
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push esi
push edi
push 0x104
push eax
push str.AswJsFltOutDir
mov dword [ebp - 0x32c], edx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x320], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
mov esi, 0x80070002
cmp eax, 0x102
ja 0x71cefda4
mov eax, dword [ebp - 0x320]
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov ebx, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x320], eax
mov eax, dword [0x71d7aa58]
mov dword [ebp - 0x328], eax
mov eax, dword [0x71d7aa5c]
mov dword [ebp - 0x324], eax
mov eax, dword [0x71d7aa50]
mov dword [ebp - 0x31c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
push ebx
push dword [ebp - 0x320]
push dword [ebp - 0x324]
push dword [ebp - 0x328]
push dword [ebp - 0x31c]
push eax
push str._d_p__d_ct__llu__08x_08x_08x_08x.dat
lea eax, [ebp - 0x318]
push 0x82
push eax
call fcn.71cc9e30
mov esi, eax
add esp, 0x2c
test esi, esi
js 0x71cefe14
xor eax, eax
cmp ax, word [ebp - 0x210]
je 0x71cefe27
xor esi, esi
cmp ax, word [ebp - 0x318]
je 0x71cefda4
mov ecx, 0x104
lea eax, [ebp - 0x210]
nop dword [eax]
cmp word [eax], si
je 0x71cefc5d
add eax, 2
sub ecx, 1
jne 0x71cefc50
xor eax, eax
mov esi, 0x80070057
test ecx, ecx
mov edx, 0x104
mov edi, ecx
cmovne esi, eax
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x71cefda4
movzx eax, word [ebp + edi*2 - 0x212]
cmp eax, 0x5c
je 0x71cefd21
cmp eax, 0x2f
je 0x71cefd21
mov ecx, edx
lea eax, [ebp - 0x210]
cmp word [eax], 0
je 0x71cefcb2
add eax, 2
sub ecx, 1
jne 0x71cefca4
mov eax, edx
mov ebx, ecx
sub eax, ecx
mov esi, 0x80070057
neg ebx
sbb ebx, ebx
and ebx, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x71cefd19
mov edi, edx
lea ecx, [ebp - 0x210]
lea ecx, [ecx + ebx*2]
sub edi, ebx
je 0x71cefd00
mov ebx, 0x71d1ac1c
mov eax, 0x7ffffffe
sub ebx, ecx
test eax, eax
je 0x71cefd00
movzx esi, word [ebx + ecx]
test si, si
je 0x71cefd00
mov word [ecx], si
dec eax
add ecx, 2
sub edi, 1
jne 0x71cefce7
test edi, edi
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edi, edi
cmovne esi, eax
test esi, esi
js 0x71cefe14
mov ecx, edx
lea eax, [ebp - 0x210]
nop dword [eax]
cmp word [eax], 0
je 0x71cefd3e
add eax, 2
sub ecx, 1
jne 0x71cefd30
mov eax, edx
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x71cefda4
lea ecx, [ebp - 0x210]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x71cefd8b
lea edi, [ebp - 0x318]
mov eax, 0x7ffffffe
sub edi, ecx
test eax, eax
je 0x71cefd8b
movzx esi, word [edi + ecx]
test si, si
je 0x71cefd8b
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x71cefd72
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
js 0x71cefe14
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x71cefe3d
push 0
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push dword [ebp - 0x32c]
push dword [ebp - 0x330]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x71cefe0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x71cefe0d
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x71cefe16
mov ecx, dword [ebp - 4]
pop edi
movzx eax, ax
xor ecx, ebp
pop esi
or eax, 0x80070000
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret