Function at 0x10077bfb
Capabilities:
Create process on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d60
call fcn.100ccb40
mov eax, dword [0x10110164]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2afc], 0xe552
mov eax, 0xe50e
mov word [ebp - 0x2af8], ax
push ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [eax + 0x1c]
add eax, 0x31
mov word [ebp - 0x2af6], cx
mov word [ebp - 0x2af4], ax
lea eax, [ecx + 0x52]
mov word [ebp - 0x2af2], ax
add eax, 0xffffffbb
mov word [ebp - 0x2af0], ax
mov word [ebp - 0x2aee], cx
lea ecx, [ebp - 0x2afc]
mov word [ebp - 0x2aec], ax
xor eax, eax
push esi
mov word [ebp - 0x2aea], ax
mov ax, word [ebp - 0x2af8]
push edi
call fcn.10011237
push eax
lea eax, [ebp - 0x354]
push 0x208
push eax
call fcn.10077bbe
add esp, 0xc
mov dword [ebp - 0xc], 0x22311394
mov dword [ebp - 8], 0x5927931f
call fcn.1000cc24
mov dword [ebp - 0x2978], 0x6f
mov edi, eax
mov ecx, dword [ebp - 0x2978]
xor ecx, 0x78
mov byte [ebp - 0x2974], cl
mov ecx, dword [ebp - 0x2978]
inc cl
xor ecx, 0x6d
mov byte [ebp - 0x2973], cl
mov eax, dword [ebp - 0x2978]
add al, 2
xor eax, 0x2e
mov byte [ebp - 0x2972], al
mov eax, dword [ebp - 0x2978]
add al, 3
xor eax, 0x78
mov byte [ebp - 0x2971], al
mov eax, dword [ebp - 0x2978]
add al, 4
push 0x65
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x2978]
mov byte [ebp - 0x2970], al
mov eax, dword [ebp - 0x2978]
add al, 5
mov byte [ebp - 0x296e], 0
xor eax, 0x6d
mov byte [ebp - 0x296f], al
mov al, byte [ebp - 0x2974]
mov esi, dword [edi]
push 0x3c
pop eax
add esi, eax
lea eax, [ebp - 0xc]
push 4
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.1007b68a
push eax
push edi
call dword [esi]
mov edi, dword [ebp + 8]
cmp edi, 0xe019100b
jne 0x10077d68
push 0x100fa518
mov ecx, ebx
call fcn.100396c3
test al, al
lea ecx, [edi + 0xf]
cmovne edi, ecx
push 0x3b
pop ecx
mov word [ebp - 0x2ad8], cx
push 0x30
lea eax, [ecx + 0x48]
mov word [ebp - 0x2ad6], ax
pop eax
mov word [ebp - 0x2ad4], ax
push 0x43
pop eax
mov word [ebp - 0x2ad2], cx
lea ecx, [ebp - 0x2ad8]
mov word [ebp - 0x2ad0], ax
push 0x63
pop eax
mov word [ebp - 0x2ace], ax
xor eax, eax
mov word [ebp - 0x2acc], ax
mov ax, word [ebp - 0x2ad8]
mov esi, dword [0x101ef2d0]
push edi
call fcn.1004e328
push eax
lea eax, [ebp - 0x14c]
push 0xa0
push eax
call dword [esi + 0x5d0]
push 0x44
pop eax
push 0x40
mov dword [ebp - 0x2d60], eax
lea eax, [ebp - 0x2d5c]
push 0
push eax
call fcn.100cea50
mov dword [ebp - 0x2c0c], 0xd542
mov ecx, 0xd560
mov word [ebp - 0x2c08], cx
add esp, 0x1c
lea edx, [ecx + 7]
mov word [ebp - 0x2c06], dx
lea eax, [ecx - 0x32]
mov word [ebp - 0x2c04], ax
add eax, 3
mov word [ebp - 0x2c02], ax
lea eax, [ecx + 2]
mov word [ebp - 0x2c00], cx
add ecx, 0x12
mov word [ebp - 0x2bfe], ax
add eax, 0xffffffd8
mov word [ebp - 0x2bfc], cx
mov word [ebp - 0x2bfa], ax
lea eax, [edx + 0x13]
mov word [ebp - 0x2bf8], dx
mov word [ebp - 0x2bf6], cx
lea ecx, [ebp - 0x2c0c]
mov word [ebp - 0x2bf4], ax
add eax, 0xffffffa0
mov word [ebp - 0x2bf2], ax
xor eax, eax
mov word [ebp - 0x2bf0], ax
mov ax, word [ebp - 0x2c08]
mov esi, dword [0x101ef2d0]
lea eax, [ebp - 0x354]
push edi
push eax
call fcn.100110c7
push eax
lea eax, [ebp - 0x96c]
push 0x208
push eax
call dword [esi + 0x5d0]
mov eax, dword [0x10201ab4]
add esp, 0x14
mov edi, dword [eax + 0xa8]
mov eax, 0x81
push 0x49
mov word [ebp - 0x2b4c], ax
pop eax
mov word [ebp - 0x2b4a], ax
push 0x39
pop edx
push 0x3d
pop ecx
push 0x3c
pop esi
mov word [ebp - 0x2b48], dx
mov word [ebp - 0x2b46], cx
push 0x3b
pop eax
mov word [ebp - 0x2b44], si
mov word [ebp - 0x2b42], ax
push 0x4a
mov word [ebp - 0x2b40], cx
pop eax
mov word [ebp - 0x2b3e], cx
mov word [ebp - 0x2b3c], ax
push 0x33
pop ecx
push 0x37
mov word [ebp - 0x2b3a], cx
pop eax
mov word [ebp - 0x2b38], si
mov word [ebp - 0x2b36], ax
push 0x3d
pop eax
mov word [ebp - 0x2b34], si
mov word [ebp - 0x2b32], ax
push 0x3a
pop eax
mov word [ebp - 0x2b30], cx
mov word [ebp - 0x2b2e], ax
mov word [ebp - 0x2b2c], ax
mov word [ebp - 0x2b2a], ax
push 0x3e
pop eax
mov word [ebp - 0x2b28], ax
push 0x48
pop eax
mov word [ebp - 0x2b26], cx
mov word [ebp - 0x2b24], ax
push 0x49
pop eax
mov word [ebp - 0x2b22], ax
push 0x4a
pop eax
mov word [ebp - 0x2b20], ax
push 0x3a
pop eax
mov word [ebp - 0x2b1e], ax
push 0x38
mov word [ebp - 0x2b1c], cx
pop eax
mov word [ebp - 0x2b1a], ax
push 0x48
pop eax
mov word [ebp - 0x2b18], ax
push 0x4b
pop ecx
mov word [ebp - 0x2b16], cx
push 0x4c
pop eax
mov word [ebp - 0x2b14], ax
mov word [ebp - 0x2b12], dx
push 0x3b
pop eax
mov word [ebp - 0x2b10], ax
push 0x3d
pop eax
mov word [ebp - 0x2b0e], ax
push 0x4a
pop eax
mov word [ebp - 0x2b0c], ax
mov word [ebp - 0x2b0a], cx
mov word [ebp - 0x2b08], cx
mov word [ebp - 0x2b06], si
mov word [ebp - 0x2b04], ax
add eax, 0x39
mov word [ebp - 0x2b02], ax
xor eax, eax
mov word [ebp - 0x2b00], ax
mov ax, word [ebp - 0x2b4c]
mov esi, dword [edi]
lea ecx, [ebp - 0x2b4c]
call fcn.10010f82
push eax
push edi
call dword [esi + 0x110]
test eax, eax
je 0x100781ca
cmp dword [ebx + 0x10], 0
je 0x100781ca
cmp dword [ebx + 0x14], 8
jb 0x1007804a
mov ebx, dword [ebx]
mov dword [ebp - 0x2c60], 0x4833
mov eax, 0x4848
mov word [ebp - 0x2c5c], ax
add eax, 0xffffffc3
mov word [ebp - 0x2c5a], ax
mov eax, 0x4875
mov word [ebp - 0x2c58], ax
push ebx
lea ecx, [eax - 5]
mov word [ebp - 0x2c56], cx
lea edx, [ecx - 0x52]
mov word [ebp - 0x2c54], cx
lea edi, [ecx - 0x6d]
mov word [ebp - 0x2c52], ax
lea esi, [ecx + 1]
add eax, 0xffffff8b
mov word [ebp - 0x2c50], ax
lea eax, [ecx - 0x6b]
mov word [ebp - 0x2c4e], ax
add eax, 0x6d
mov word [ebp - 0x2c4c], ax
lea eax, [ecx - 0x6f]
mov word [ebp - 0x2c4a], dx
add ecx, 0xffffff97
mov word [ebp - 0x2c48], di
mov word [ebp - 0x2c46], ax
add eax, 0x55
mov word [ebp - 0x2c44], si
mov word [ebp - 0x2c42], di
mov word [ebp - 0x2c40], dx
mov word [ebp - 0x2c3e], cx
mov word [ebp - 0x2c3c], ax
lea eax, [edx + 0x33]
mov word [ebp - 0x2c3a], ax
add eax, 0xffffffb3
mov word [ebp - 0x2c38], ax
lea eax, [edx + 0x54]
mov word [ebp - 0x2c36], dx
mov word [ebp - 0x2c34], ax
mov word [ebp - 0x2c32], si
mov word [ebp - 0x2c30], ax
mov word [ebp - 0x2c2e], ax
add eax, 4
mov word [ebp - 0x2c2c], dx
mov word [ebp - 0x2c2a], si
mov word [ebp - 0x2c28], cx
lea ecx, [ebp - 0x2c60]
mov word [ebp - 0x2c26], ax
lea eax, [edx + 0x52]
mov word [ebp - 0x2c24], si
mov word [ebp - 0x2c22], di
mov word [ebp - 0x2c20], ax
add eax, 2
mov word [ebp - 0x2c1e], ax
lea eax, [edx - 0x13]
mov word [ebp - 0x2c1c], ax
add eax, 0xfffffff7
mov word [ebp - 0x2c1a], di
mov word [ebp - 0x2c18], ax
mov word [ebp - 0x2c16], ax
lea eax, [edx - 0x14]
mov word [ebp - 0x2c14], ax
add eax, 0x44
mov word [ebp - 0x2c12], ax
xor eax, eax
mov word [ebp - 0x2c10], ax
mov ax, word [ebp - 0x2c5c]
call fcn.1000b6ff
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x10201ab4]
push 0x7f
mov edi, dword [eax + 0xa8]
pop eax
push 0x37
pop edx
push 0x49
mov word [ebp - 0x2b9c], ax
pop eax
push 0x36
pop esi
mov word [ebp - 0x2b9a], dx
mov word [ebp - 0x2b98], ax
push 0x47
pop eax
push 0x38
mov word [ebp - 0x2b96], si
mov word [ebp - 0x2b94], ax
pop eax
push 0x4a
mov word [ebp - 0x2b92], ax
pop eax
push 0x45
pop ecx
mov word [ebp - 0x2b90], ax
push 0x46
pop eax
mov word [ebp - 0x2b8e], cx
mov word [ebp - 0x2b8c], ax
push 0x31
pop eax
push 0x34
pop ebx
mov word [ebp - 0x2b8a], ax
mov word [ebp - 0x2b88], bx
push 0x3d
pop ebx
mov word [ebp - 0x2b86], bx
push 0x38
pop ebx
mov word [ebp - 0x2b84], cx
mov word [ebp - 0x2b82], si
push 0x39
mov word [ebp - 0x2b80], ax
mov word [ebp - 0x2b7e], bx
pop ecx
mov word [ebp - 0x2b7c], cx
mov word [ebp - 0x2b7a], dx
push 0x45
pop ecx
mov word [ebp - 0x2b78], bx
push 0x3c
pop ebx
mov word [ebp - 0x2b76], ax
push 0x48
pop edx
mov word [ebp - 0x2b74], cx
mov word [ebp - 0x2b72], bx
mov word [ebp - 0x2b70], dx
push 0x46
pop ebx
mov word [ebp - 0x2b6e], bx
mov word [ebp - 0x2b6c], ax
push 0x35
pop eax
push 0x3b
mov word [ebp - 0x2b6a], bx
pop edx
mov word [ebp - 0x2b68], ax
mov word [ebp - 0x2b66], dx
push 0x48
pop edx
mov word [ebp - 0x2b64], bx
mov word [ebp - 0x2b62], dx
push 0x4a
pop edx
mov word [ebp - 0x2b60], dx
mov word [ebp - 0x2b5e], dx
mov word [ebp - 0x2b5c], si
mov word [ebp - 0x2b5a], cx
push 0x49
pop ecx
mov word [ebp - 0x2b58], cx
lea ecx, [ebp - 0x2b9c]
push 0x37
pop edx
mov word [ebp - 0x2b56], dx
mov word [ebp - 0x2b54], ax
add eax, 0x4c
mov word [ebp - 0x2b52], ax
xor eax, eax
mov word [ebp - 0x2b50], ax
mov ax, word [ebp - 0x2b9c]
mov esi, dword [edi]
lea eax, [ebp - 0x55c]
push 0x208
push eax
call fcn.10039c8d
push eax
push edi
call dword [esi + 0x60]
push 0x2d
pop ecx
push 0x7d
pop edx
push 0x34
pop ebx
test eax, eax
js 0x10078673
mov dword [ebp - 0x29cc], 0x7732
mov eax, dword [ebp - 0x29cc]
xor eax, 0x7b
mov word [ebp - 0x29c8], ax
mov eax, dword [ebp - 0x29cc]
inc eax
push 0x37
pop edi
xor eax, edi
mov word [ebp - 0x29c6], ax
mov eax, dword [ebp - 0x29cc]
add eax, 2
push 0x35
pop esi
xor eax, esi
mov word [ebp - 0x29c4], ax
mov eax, dword [ebp - 0x29cc]
add eax, 3
push 0x44
pop edx
xor eax, edx
mov word [ebp - 0x29c2], ax
mov eax, dword [ebp - 0x29cc]
add eax, 4
xor eax, edi
mov word [ebp - 0x29c0], ax
mov eax, dword [ebp - 0x29cc]
add eax, 5
xor eax, ebx
mov word [ebp - 0x29be], ax
mov eax, dword [ebp - 0x29cc]
add eax, 6
push 0x38
pop edx
xor eax, edx
mov word [ebp - 0x29bc], ax
mov eax, dword [ebp - 0x29cc]
add eax, 7
xor eax, ebx
mov word [ebp - 0x29ba], ax
mov eax, dword [ebp - 0x29cc]
add eax, 8
xor eax, 0x46
mov word [ebp - 0x29b8], ax
mov eax, dword [ebp - 0x29cc]
add eax, 9
xor eax, ecx
mov word [ebp - 0x29b6], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0xa
xor eax, 0x46
mov word [ebp - 0x29b4], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0xb
xor eax, 0x43
mov word [ebp - 0x29b2], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0xc
push 0x33
pop edx
xor eax, edx
mov word [ebp - 0x29b0], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0xd
xor eax, esi
mov word [ebp - 0x29ae], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0xe
xor eax, ecx
mov word [ebp - 0x29ac], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0xf
xor eax, ebx
mov word [ebp - 0x29aa], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x10
xor eax, 0x30
mov word [ebp - 0x29a8], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x11
xor eax, 0x64
mov word [ebp - 0x29a6], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x12
xor eax, 0x61
mov word [ebp - 0x29a4], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x13
xor eax, ecx
mov word [ebp - 0x29a2], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x14
push 0x39
pop esi
xor eax, esi
mov word [ebp - 0x29a0], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x15
xor eax, esi
mov word [ebp - 0x299e], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x16
xor eax, edi
mov word [ebp - 0x299c], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x17
xor eax, 0x42
mov word [ebp - 0x299a], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x18
xor eax, ecx
mov word [ebp - 0x2998], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x19
xor eax, 0x41
mov word [ebp - 0x2996], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x1a
push 0x38
pop ecx
xor eax, ecx
mov word [ebp - 0x2994], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x1b
xor eax, ecx
mov word [ebp - 0x2992], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x1c
xor eax, 0x42
mov word [ebp - 0x2990], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x1d
push 0x36
pop ecx
xor eax, ecx
mov word [ebp - 0x298e], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x1e
xor eax, 0x43
mov word [ebp - 0x298c], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x1f
xor eax, 0x30
mov word [ebp - 0x298a], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x20
push 0x31
pop ecx
xor eax, ecx
mov word [ebp - 0x2988], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x21
xor eax, ebx
mov word [ebp - 0x2986], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x22
xor eax, ebx
mov word [ebp - 0x2984], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x23
xor eax, ecx
mov word [ebp - 0x2982], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x24
xor eax, 0x41
mov word [ebp - 0x2980], ax
mov eax, dword [ebp - 0x29cc]
add eax, 0x25
push 0x7d
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x29cc]
mov word [ebp - 0x297e], ax
xor eax, eax
mov word [ebp - 0x297c], ax
mov ax, word [ebp - 0x29c8]
lea eax, [ebp - 0x55c]
push eax
call fcn.1000b49e
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x7d
pop edx
jmp 0x10078676
push 0x39
pop esi
mov eax, dword [0x10201ab4]
push 0x48
pop ecx
push 0x3b
mov edi, dword [eax + 0xa8]
mov word [ebp - 0x2bec], dx
mov word [ebp - 0x2bea], cx
mov word [ebp - 0x2be8], si
pop eax
mov word [ebp - 0x2be6], ax
mov word [ebp - 0x2be4], si
push 0x37
pop edx
mov word [ebp - 0x2be2], dx
push 0x36
pop eax
mov word [ebp - 0x2be0], ax
mov word [ebp - 0x2bde], si
mov word [ebp - 0x2bdc], cx
push 0x2f
pop ecx
mov word [ebp - 0x2bda], cx
push 0x35
pop esi
mov word [ebp - 0x2bd8], si
mov word [ebp - 0x2bd6], ax
push 0x3a
pop ebx
mov word [ebp - 0x2bd4], bx
mov word [ebp - 0x2bd2], bx
mov word [ebp - 0x2bd0], cx
mov word [ebp - 0x2bce], ax
push 0x67
pop eax
mov word [ebp - 0x2bcc], ax
mov word [ebp - 0x2bca], si
push 0x32
pop eax
mov word [ebp - 0x2bc8], ax
mov word [ebp - 0x2bc6], cx
push 0x3b
pop eax
mov word [ebp - 0x2bc4], ax
mov word [ebp - 0x2bc2], ax
push 0x34
pop ebx
mov word [ebp - 0x2bc0], bx
push 0x44
pop ebx
mov word [ebp - 0x2bbe], bx
mov word [ebp - 0x2bbc], cx
push 0x33
mov word [ebp - 0x2bba], dx
pop eax
mov word [ebp - 0x2bb8], si
mov word [ebp - 0x2bb6], ax
push 0x38
pop ecx
mov word [ebp - 0x2bb4], cx
push 0x36
pop ecx
mov word [ebp - 0x2bb2], cx
mov word [ebp - 0x2bb0], dx
push 0x47
pop edx
mov word [ebp - 0x2bae], dx
mov word [ebp - 0x2bac], bx
mov word [ebp - 0x2baa], si
push 0x3a
pop ecx
mov word [ebp - 0x2ba8], cx
mov word [ebp - 0x2ba6], ax
mov word [ebp - 0x2ba4], dx
push 0x7f
pop eax
mov word [ebp - 0x2ba2], ax
xor eax, eax
mov word [ebp - 0x2ba0], ax
mov ax, word [ebp - 0x2bec]
mov esi, dword [edi]
lea eax, [ebp - 0x2d0c]
push eax
lea ecx, [ebp - 0x2bec]
call fcn.10039b93
push eax
push edi
call dword [esi + 0x64]
test eax, eax
js 0x100789ea
push 0x3d
pop ecx
mov word [ebp - 0x2ae8], cx
lea eax, [ebx + 0x41]
mov word [ebp - 0x2ae6], ax
push 0x32
pop eax
mov word [ebp - 0x2ae4], ax
push 0x45
pop eax
mov word [ebp - 0x2ae2], cx
lea ecx, [ebp - 0x2ae8]
mov word [ebp - 0x2ae0], ax
push 0x65
pop eax
mov word [ebp - 0x2ade], ax
xor eax, eax
mov word [ebp - 0x2adc], ax
mov ax, word [ebp - 0x2ae8]
push dword [ebp - 0x2d0c]
mov esi, dword [0x101ef2d0]
call fcn.1007b789
push eax
lea eax, [ebp - 0x764]
push 0x208
push eax
call dword [esi + 0x5d0]
mov dword [ebp - 0x2cb4], 0xeb4e
mov edx, 0xeb78
mov eax, 0xeb35
add esp, 0x10
mov word [ebp - 0x2cb0], ax
add eax, 0x42
mov word [ebp - 0x2cae], ax
mov word [ebp - 0x2cac], dx
lea edi, [edx + 4]
lea eax, [edx - 0x6c]
mov word [ebp - 0x2caa], ax
lea ecx, [edx + 2]
mov word [ebp - 0x2ca8], di
lea esi, [edx - 0x15]
dec eax
lea ebx, [edx - 0x70]
mov word [ebp - 0x2ca6], ax
mov word [ebp - 0x2ca4], di
mov word [ebp - 0x2ca2], cx
add ecx, 0xffffff90
mov word [ebp - 0x2ca0], cx
lea ecx, [edi - 1]
mov word [ebp - 0x2c9e], si
mov word [ebp - 0x2c9c], dx
add edx, 0xffffff97
mov word [ebp - 0x2c9a], ax
lea eax, [edi - 2]
mov word [ebp - 0x2c98], bx
add ebx, 0x6f
mov word [ebp - 0x2c96], dx
mov word [ebp - 0x2c94], si
mov word [ebp - 0x2c92], ax
add eax, 3
mov word [ebp - 0x2c90], cx
mov word [ebp - 0x2c8e], ax
mov word [ebp - 0x2c8c], cx
mov word [ebp - 0x2c8a], si
mov word [ebp - 0x2c88], bx
mov word [ebp - 0x2c86], di
mov word [ebp - 0x2c84], ax
lea eax, [edi + 2]
mov word [ebp - 0x2c82], dx
mov word [ebp - 0x2c80], si
mov word [ebp - 0x2c7e], ax
add eax, 0xfffffffa
mov word [ebp - 0x2c7c], cx
add ecx, 0xffffff91
mov word [ebp - 0x2c7a], dx
mov word [ebp - 0x2c78], ax
mov word [ebp - 0x2c76], cx
mov word [ebp - 0x2c74], ax
lea eax, [edi - 3]
mov word [ebp - 0x2c72], ax
mov word [ebp - 0x2c70], ax
inc eax
lea ebx, [edi - 0x74]
mov word [ebp - 0x2c6e], bx
mov word [ebp - 0x2c6c], cx
lea ecx, [ebp - 0x2cb4]
mov word [ebp - 0x2c6a], ax
lea eax, [edi - 0x72]
mov word [ebp - 0x2c68], ax
add eax, 0x29
mov word [ebp - 0x2c66], ax
xor eax, eax
mov word [ebp - 0x2c64], ax
mov ax, word [ebp - 0x2cb0]
lea eax, [ebp - 0x764]
push eax
call fcn.1000b6ff
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x10201ab4]
mov edx, 0x1987
push 0x2000
mov edi, dword [eax + 0xa8]
lea ecx, [edx + 0x78]
mov dword [ebp - 0x2d08], 0x19c6
lea ebx, [edx - 4]
mov eax, 0x19bd
lea esi, [edx + 0x64]
mov word [ebp - 0x2d04], ax
add eax, 0xffffffc8
mov word [ebp - 0x2d02], ax
mov word [ebp - 0x2d00], dx
mov word [ebp - 0x2cfe], cx
add ecx, 0xfffffff7
mov word [ebp - 0x2cfc], bx
mov word [ebp - 0x2cfa], cx
mov word [ebp - 0x2cf8], bx
add ebx, 0xfffffffd
mov word [ebp - 0x2cf6], bx
lea ebx, [edx + 0x77]
mov word [ebp - 0x2cf4], ax
lea eax, [edx - 5]
mov word [ebp - 0x2cf2], si
mov word [ebp - 0x2cf0], ax
add eax, 0x6f
mov word [ebp - 0x2cee], bx
mov word [ebp - 0x2cec], ax
lea eax, [edx + 0x6b]
mov word [ebp - 0x2cea], dx
mov word [ebp - 0x2ce8], si
mov word [ebp - 0x2ce6], ax
add eax, 0xffffffb1
mov word [ebp - 0x2ce4], cx
lea ecx, [edx + 0x6e]
mov word [ebp - 0x2ce2], ax
lea eax, [edx + 0x78]
mov word [ebp - 0x2ce0], cx
add edx, 0xfffffffb
mov word [ebp - 0x2cde], si
mov word [ebp - 0x2cdc], bx
mov word [ebp - 0x2cda], ax
mov word [ebp - 0x2cd8], dx
mov word [ebp - 0x2cd6], ax
add eax, 0xffffff84
mov word [ebp - 0x2cd4], si
mov word [ebp - 0x2cd2], dx
mov word [ebp - 0x2cd0], dx
mov word [ebp - 0x2cce], ax
lea eax, [esi - 0x6b]
mov word [ebp - 0x2ccc], ax
add eax, 0x77
mov word [ebp - 0x2cca], dx
mov word [ebp - 0x2cc8], ax
lea eax, [esi - 0x67]
mov word [ebp - 0x2cc6], bx
mov word [ebp - 0x2cc4], cx
lea ecx, [ebp - 0x2d08]
mov word [ebp - 0x2cc2], ax
add eax, 0x6f
mov word [ebp - 0x2cc0], dx
mov word [ebp - 0x2cbe], ax
lea eax, [esi + 5]
mov word [ebp - 0x2cbc], ax
add eax, 0xffffffcb
mov word [ebp - 0x2cba], ax
xor eax, eax
mov word [ebp - 0x2cb8], ax
mov ax, word [ebp - 0x2d04]
mov esi, dword [edi]
lea eax, [ebp - 0x296c]
push eax
call fcn.1000b6ff
push eax
push edi
call dword [esi + 0x60]
test eax, eax
js 0x10078e8d
mov dword [ebp - 0x2a20], 0x5735
mov eax, dword [ebp - 0x2a20]
xor eax, 0x7b
mov word [ebp - 0x2a1c], ax
mov eax, dword [ebp - 0x2a20]
inc eax
push 0x37
pop edi
xor eax, edi
mov word [ebp - 0x2a1a], ax
mov eax, dword [ebp - 0x2a20]
add eax, 2
xor eax, 0x43
mov word [ebp - 0x2a18], ax
mov eax, dword [ebp - 0x2a20]
add eax, 3
xor eax, edi
mov word [ebp - 0x2a16], ax
mov eax, dword [ebp - 0x2a20]
add eax, 4
push 0x34
pop ebx
xor eax, ebx
mov word [ebp - 0x2a14], ax
mov eax, dword [ebp - 0x2a20]
add eax, 5
xor eax, 0x43
mov word [ebp - 0x2a12], ax
mov eax, dword [ebp - 0x2a20]
add eax, 6
push 0x33
pop ecx
xor eax, ecx
mov word [ebp - 0x2a10], ax
mov eax, dword [ebp - 0x2a20]
add eax, 7
xor eax, 0x36
mov word [ebp - 0x2a0e], ax
mov eax, dword [ebp - 0x2a20]
add eax, 8
xor eax, ecx
mov word [ebp - 0x2a0c], ax
mov eax, dword [ebp - 0x2a20]
add eax, 9
push 0x2d
pop edx
xor eax, edx
mov word [ebp - 0x2a0a], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0xa
xor eax, 0x30
mov word [ebp - 0x2a08], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0xb
push 0x45
pop ecx
xor eax, ecx
mov word [ebp - 0x2a06], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0xc
xor eax, 0x32
mov word [ebp - 0x2a04], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0xd
push 0x31
pop esi
xor eax, esi
mov word [ebp - 0x2a02], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0xe
xor eax, edx
mov word [ebp - 0x2a00], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0xf
xor eax, ebx
mov word [ebp - 0x29fe], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x10
xor eax, 0x66
mov word [ebp - 0x29fc], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x11
xor eax, 0x65
mov word [ebp - 0x29fa], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x12
xor eax, 0x38
mov word [ebp - 0x29f8], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x13
xor eax, edx
mov word [ebp - 0x29f6], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x14
xor eax, 0x38
mov word [ebp - 0x29f4], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x15
xor eax, ebx
mov word [ebp - 0x29f2], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x16
xor eax, 0x32
mov word [ebp - 0x29f0], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x17
xor eax, 0x46
mov word [ebp - 0x29ee], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x18
xor eax, edx
mov word [ebp - 0x29ec], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x19
xor eax, esi
mov word [ebp - 0x29ea], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x1a
xor eax, esi
mov word [ebp - 0x29e8], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x1b
push 0x44
pop edx
xor eax, edx
mov word [ebp - 0x29e6], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x1c
xor eax, esi
mov word [ebp - 0x29e4], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x1d
xor eax, 0x30
mov word [ebp - 0x29e2], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x1e
xor eax, edi
mov word [ebp - 0x29e0], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x1f
xor eax, ecx
mov word [ebp - 0x29de], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x20
xor eax, 0x43
mov word [ebp - 0x29dc], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x21
xor eax, 0x42
mov word [ebp - 0x29da], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x22
xor eax, 0x46
mov word [ebp - 0x29d8], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x23
xor eax, edi
mov word [ebp - 0x29d6], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x24
xor eax, 0x35
mov word [ebp - 0x29d4], ax
mov eax, dword [ebp - 0x2a20]
add eax, 0x25
push 0x7d
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x2a20]
mov word [ebp - 0x29d2], ax
xor eax, eax
mov word [ebp - 0x29d0], ax
mov ax, word [ebp - 0x2a1c]
lea eax, [ebp - 0x296c]
push eax
call fcn.1000b49e
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10078e93
push 0x34
pop ebx
push 0x31
pop esi
mov eax, dword [0x10201ab4]
push 0x33
pop ecx
push 0x43
mov edi, dword [eax + 0xa8]
mov dword [ebp - 0x2a74], 0xfc0a
mov eax, dword [ebp - 0x2a74]
xor eax, 0x7b
mov word [ebp - 0x2a70], ax
mov eax, dword [ebp - 0x2a74]
inc eax
xor eax, ecx
mov word [ebp - 0x2a6e], ax
mov eax, dword [ebp - 0x2a74]
add eax, 2
xor eax, ecx
mov word [ebp - 0x2a6c], ax
mov eax, dword [ebp - 0x2a74]
add eax, 3
xor eax, esi
mov word [ebp - 0x2a6a], ax
mov eax, dword [ebp - 0x2a74]
add eax, 4
xor eax, ecx
mov word [ebp - 0x2a68], ax
mov eax, dword [ebp - 0x2a74]
add eax, 5
xor eax, 0x45
mov word [ebp - 0x2a66], ax
mov eax, dword [ebp - 0x2a74]
add eax, 6
pop edx
xor eax, edx
mov word [ebp - 0x2a64], ax
mov eax, dword [ebp - 0x2a74]
add eax, 7
push 0x44
pop ecx
xor eax, ecx
mov word [ebp - 0x2a62], ax
mov eax, dword [ebp - 0x2a74]
add eax, 8
xor eax, esi
mov word [ebp - 0x2a60], ax
mov eax, dword [ebp - 0x2a74]
add eax, 9
push 0x2d
pop ecx
xor eax, ecx
mov word [ebp - 0x2a5e], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0xa
xor eax, 0x30
mov word [ebp - 0x2a5c], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0xb
xor eax, 0x44
mov word [ebp - 0x2a5a], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0xc
xor eax, 0x36
mov word [ebp - 0x2a58], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0xd
xor eax, edx
mov word [ebp - 0x2a56], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0xe
xor eax, ecx
mov word [ebp - 0x2a54], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0xf
xor eax, ebx
mov word [ebp - 0x2a52], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x10
xor eax, 0x33
mov word [ebp - 0x2a50], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x11
xor eax, 0x39
mov word [ebp - 0x2a4e], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x12
xor eax, 0x39
mov word [ebp - 0x2a4c], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x13
xor eax, ecx
mov word [ebp - 0x2a4a], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x14
xor eax, 0x41
mov word [ebp - 0x2a48], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x15
xor eax, edx
mov word [ebp - 0x2a46], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x16
xor eax, 0x30
mov word [ebp - 0x2a44], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x17
xor eax, 0x46
mov word [ebp - 0x2a42], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x18
xor eax, ecx
mov word [ebp - 0x2a40], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x19
xor eax, 0x41
mov word [ebp - 0x2a3e], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x1a
xor eax, 0x41
mov word [ebp - 0x2a3c], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x1b
xor eax, 0x30
mov word [ebp - 0x2a3a], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x1c
xor eax, edx
mov word [ebp - 0x2a38], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x1d
xor eax, 0x42
mov word [ebp - 0x2a36], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x1e
xor eax, 0x32
mov word [ebp - 0x2a34], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x1f
push 0x36
pop ecx
xor eax, ecx
mov word [ebp - 0x2a32], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x20
xor eax, esi
mov word [ebp - 0x2a30], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x21
xor eax, 0x32
mov word [ebp - 0x2a2e], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x22
push 0x44
pop ecx
xor eax, ecx
mov word [ebp - 0x2a2c], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x23
xor eax, edx
mov word [ebp - 0x2a2a], ax
mov eax, dword [ebp - 0x2a74]
add eax, 0x24
xor eax, ebx
mov word [ebp - 0x2a28], ax
mov eax, dword [ebp - 0x2a74]
push 0x7d
add eax, 0x25
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x2a74]
mov word [ebp - 0x2a26], ax
xor eax, eax
mov word [ebp - 0x2a24], ax
mov ax, word [ebp - 0x2a70]
mov esi, dword [edi]
lea eax, [ebp - 0xac]
push 0xa0
push eax
call fcn.1000b49e
push eax
push edi
call dword [esi + 0x60]
test eax, eax
js 0x100794aa
mov dword [ebp - 0x2ac8], 0x3f75
mov eax, dword [ebp - 0x2ac8]
xor eax, 0x7b
mov word [ebp - 0x2ac4], ax
mov eax, dword [ebp - 0x2ac8]
inc eax
xor eax, 0x42
mov word [ebp - 0x2ac2], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 2
xor eax, 0x32
mov word [ebp - 0x2ac0], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 3
xor eax, 0x43
mov word [ebp - 0x2abe], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 4
push 0x45
pop edi
xor eax, edi
mov word [ebp - 0x2abc], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 5
push 0x31
pop ecx
xor eax, ecx
mov word [ebp - 0x2aba], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 6
xor eax, 0x30
mov word [ebp - 0x2ab8], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 7
xor eax, ecx
mov word [ebp - 0x2ab6], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 8
xor eax, ecx
mov word [ebp - 0x2ab4], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 9
push 0x2d
pop edx
xor eax, edx
mov word [ebp - 0x2ab2], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0xa
push 0x39
pop esi
xor eax, esi
mov word [ebp - 0x2ab0], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0xb
xor eax, esi
mov word [ebp - 0x2aae], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0xc
xor eax, ebx
mov word [ebp - 0x2aac], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0xd
xor eax, edi
mov word [ebp - 0x2aaa], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0xe
xor eax, edx
mov word [ebp - 0x2aa8], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0xf
xor eax, ebx
mov word [ebp - 0x2aa6], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x10
xor eax, 0x42
mov word [ebp - 0x2aa4], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x11
xor eax, esi
mov word [ebp - 0x2aa2], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x12
xor eax, 0x43
mov word [ebp - 0x2aa0], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x13
xor eax, edx
mov word [ebp - 0x2a9e], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x14
xor eax, esi
mov word [ebp - 0x2a9c], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x15
push 0x36
pop edi
xor eax, edi
mov word [ebp - 0x2a9a], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x16
push 0x33
pop esi
xor eax, esi
mov word [ebp - 0x2a98], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x17
xor eax, ecx
mov word [ebp - 0x2a96], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x18
xor eax, edx
mov word [ebp - 0x2a94], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x19
xor eax, ebx
mov word [ebp - 0x2a92], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x1a
xor eax, ecx
mov word [ebp - 0x2a90], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x1b
xor eax, esi
mov word [ebp - 0x2a8e], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x1c
xor eax, ebx
mov word [ebp - 0x2a8c], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x1d
xor eax, 0x43
mov word [ebp - 0x2a8a], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x1e
xor eax, 0x42
mov word [ebp - 0x2a88], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x1f
xor eax, edi
mov word [ebp - 0x2a86], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x20
push 0x45
pop ecx
xor eax, ecx
mov word [ebp - 0x2a84], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x21
xor eax, ebx
mov word [ebp - 0x2a82], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x22
push 0x37
pop edi
xor eax, edi
mov word [ebp - 0x2a80], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x23
xor eax, 0x46
mov word [ebp - 0x2a7e], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x24
xor eax, ecx
mov word [ebp - 0x2a7c], ax
mov eax, dword [ebp - 0x2ac8]
add eax, 0x25
push 0x7d
pop ecx
xor eax, ecx
lea ecx, [ebp - 0x2ac8]
mov word [ebp - 0x2a7a], ax
xor eax, eax
mov word [ebp - 0x2a78], ax
mov ax, word [ebp - 0x2ac4]
lea eax, [ebp - 0xac]
push eax
call fcn.1000b49e
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
lea eax, [ebp - 0x2d1c]
push eax
lea eax, [ebp - 0x2d60]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x96c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100cc9b8
leave
ret