Function at 0x10001000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x634
mov eax, dword [0x10004004]
xor eax, esp
mov dword [esp + 0x630], eax
push ebx
push esi
push edi
push 0x20
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov edi, eax
push edi
mov dword [esp + 0x24], edi
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x10]
call ecx
mov ebx, eax
mov dword [esp + 0x24], ebx
cmp ebx, 0xffffffff
jge 0x1000105d
mov eax, dword [edi]
push edi
mov eax, dword [eax + 8]
call eax
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.10001c59
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.NVFBC_PRIV_DATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
je 0x10001130
push esi
call ecx
add esp, 4
mov dword [esp + 0x10], eax
push esi
push eax
push str.NVFBC_PRIV_DATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esi - 1]
cdq
sub eax, edx
sar eax, 1
push eax
mov dword [esp + 0x18], eax
call dword [esp + 0x20]
mov dword [esp + 0x10], eax
add esp, 4
xor eax, eax
xor esi, esi
mov word [esp + 0x1ac], ax
mov byte [esp + 0x1ae], al
cmp dword [esp + 0x14], eax
jle 0x10001125
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
nop dword [eax]
mov ax, word [ebx + esi*2]
push 0x10
mov word [esp + 0x1b0], ax
lea eax, [esp + 0x1b0]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jl 0x100010f0
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
push dword [esp + 0x10]
call dword [esp + 0x1c]
add esp, 4
mov dword [esp + 0x10], 0
xor esi, esi
test ebx, ebx
jle 0x10001169
nop
mov eax, dword [edi]
lea ecx, [esp + 0x1d8]
push ecx
push 0
push esi
mov eax, dword [eax + 0x14]
push edi
call eax
test eax, eax
jne 0x10001164
cmp dword [esp + 0x600], 0x10de
je 0x100011ac
inc esi
cmp esi, ebx
jl 0x10001140
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 2
jl 0x10001138
mov eax, dword [edi]
push edi
mov eax, dword [eax + 8]
call eax
push dword [esp + 0xc]
call dword [esp + 0x1c]
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.10001c59
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10004408]
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea eax, [ecx + 0x10]
push eax
lea eax, [ecx + 0xc]
push eax
lea eax, [ecx + 4]
mov ecx, esi
push eax
push ebx
call fcn.10001b50
add esp, 0x10
test al, al
jne 0x10001209
mov ecx, dword [0x10004408]
lea edx, [esp + 0x62c]
movaps xmm0, xmmword [0x10003210]
movups xmmword [esp + 0x62c], xmm0
lea eax, [ecx + 0x10]
push eax
lea eax, [ecx + 0xc]
push eax
lea eax, [ecx + 4]
mov ecx, esi
push eax
push 0x10
call fcn.10001b50
add esp, 0x10
mov eax, dword [edi]
push edi
mov eax, dword [eax + 8]
call eax
mov esi, dword [0x10004408]
lea eax, [esp + 0x28]
push 0x180
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0xc]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x70020180
mov dword [esp + 0x38], ebx
push eax
call dword [0x1000441c]
push ebx
mov dword [esi + 0x54], 7
call dword [esp + 0x1c]
mov esi, dword [0x10004408]
add esp, 4
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x1b0], 0x28
xorps xmm0, xmm0
mov dword [esp + 0x1d4], 0
push ecx
push eax
movups xmmword [esp + 0x1bc], xmm0
movups xmmword [esp + 0x1cc], xmm0
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
mov eax, dword [esp + 0x1bc]
sub eax, dword [esp + 0x1b4]
mov edx, dword [0x10004408]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x1c0]
sub eax, dword [esp + 0x1b8]
mov dword [esi + 0x18], eax
lea ebx, [edx + 0x50]
mov cl, byte [edx + 0xa]
xor eax, eax
mov edi, dword [edx + 4]
test cl, cl
mov esi, 5
sete al
add eax, 3
test cl, cl
mov dword [edx + 0x3c], eax
mov eax, 2
cmovne eax, esi
lea esi, [edx + 0x4c]
push 0x178
mov dword [edx + 0x40], eax
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x10004408]
add esp, 0xc
mov edx, 0xe
mov dword [esp + 0x28], 0x70030178
mov ecx, 0xb
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
cmp byte [eax + 8], 0
mov eax, dword [esp + 0x2c]
cmovne ecx, edx
mov dword [esp + 0x40], esi
and eax, 0xfffffffa
mov dword [esp + 0x44], ebx
or ecx, eax
lea edx, [esp + 0x28]
mov eax, dword [edi]
mov dword [esp + 0x2c], ecx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jne 0x10001195
mov edi, dword [0x10004408]
xor ebx, ebx
nop dword [eax]
mov dword [ebx + edi + 0xc8], 0
mov edx, 1
mov dword [ebx + edi + 0xcc], 0
mov byte [ebx + edi + 0xd0], 0
mov ecx, dword [edi + 0x54]
mov esi, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
dec esi
shl edx, cl
add esi, edx
dec edx
shr esi, cl
add eax, edx
shr eax, cl
xor ecx, ecx
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call dword [esp + 0x20]
mov edi, dword [0x10004408]
add esp, 4
mov dword [ebx + edi + 0xd4], eax
test eax, eax
je 0x100013f1
add ebx, 0x10
cmp ebx, 0x20
jl 0x10001370
inc dword [edi + 0x2c]
mov al, 1
mov ecx, dword [esp + 0x63c]
mov byte [edi], 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10001c59
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x18]
xor esi, esi
push dword [esi + edi + 0xd4]
call ebx
mov edi, dword [0x10004408]
add esp, 4
mov dword [esi + edi + 0xd4], 0
add esi, 0x10
cmp esi, 0x20
jl 0x100013f7
mov eax, dword [edi + 4]
test eax, eax
je 0x10001195
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push dword [edi + 4]
call ebx
mov eax, dword [0x10004408]
mov dword [edi + 4], 0
mov dword [eax + 4], 0
jmp 0x10001192