Function at 0x10022c90
Capabilities:
Query environment variable

Disassembly:
cmp byte [ecx], 0
je 0x10022d60
sub esp, 0x6c
mov dword [esp + 0x60], esi
mov esi, eax
mov eax, dword [0x100aa014]
mov dword [esp + 0x5c], ebx
mov ebx, ecx
mov dword [esp + 0x64], edi
mov edi, edx
mov dword [esp + 0x68], ebp
test eax, eax
js 0x10022d68
cmp esi, 4
mov eax, dword [0x100d5684]
je 0x10022d38
cmp eax, 0xffffffff
mov edx, dword [0x100aa014]
je 0x10022e30
test edx, edx
je 0x10022d3f
mov dword [esp], eax
movzx ecx, word [0x100d568a]
movzx edx, byte [esi + 0x100b39a0]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or edx, ecx
movzx edx, dx
mov dword [esp + 4], edx
call esi
mov eax, ebx
sub esp, 8
call fcn.10022b20
movzx eax, word [0x100d5688]
mov dword [esp + 4], eax
mov eax, dword [0x100d5684]
mov dword [esp], eax
call esi
sub esp, 8
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
add esp, 0x6c
ret
inc eax
je 0x10022ec0
mov esi, dword [esp + 0x60]
mov eax, ebx
mov edi, dword [esp + 0x64]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x68]
add esp, 0x6c
jmp fcn.10022b20
ret
mov dword [esp], str.TERM
call sub.msvcrt.dll_getenv
mov dword [esp], 0xfffffff4
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x100d5684], eax
sub esp, 4
cmp eax, 0xffffffff
je 0x10022de0
mov dword [esp], eax
lea edx, [esp + 0x34]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
sub esp, 8
test eax, eax
je 0x10022eb0
mov eax, dword [0x100d5684]
cmp eax, 0xffffffff
je 0x10022de0
mov dword [esp], eax
lea edx, [esp + 0x3a]
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esp, 8
movzx eax, word [esp + 0x42]
mov word [0x100d5688], ax
and eax, 0xf0
mov word [0x100d568a], ax
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
mov edx, eax
xor eax, eax
test edx, edx
je 0x10022f38
mov dword [esp], str.AV_LOG_FORCE_256COLOR
mov dword [0x100aa014], eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x10022e88
shl dword [0x100aa014], 8
cmp esi, 4
mov eax, dword [0x100d5684]
jne 0x10022cc9
jmp 0x10022d38
cmp edx, 1
je 0x10022f68
test edi, edi
lea esi, [esi]
nop
je 0x10022ef8
cmp edx, 0x100
jne 0x10022ed4
mov dword [esp], 2
xor esi, esi
call dword [0x100aa0cc]
mov dword [esp + 0xc], edi
mov edi, str.e_48_5__ume_38_5__dm_se_0m
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.10022af0
jmp 0x10022d20
test ebp, ebp
je 0x10022cbf
mov dword [esp], ebp
mov eax, str.256color
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x10022e0d
jmp 0x10022cbf
mov eax, 0xffffffff
mov dword [0x100d5684], eax
jmp 0x10022de0
test edi, edi
je 0x10022ed4
cmp dword [0x100aa014], 0x100
je 0x10022e52
mov dword [esp], 2
call dword [0x100aa0cc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x10022d20
cmp edx, 0x100
jne 0x10022ed4
mov dword [esp], 2
call dword [0x100aa0cc]
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov ebx, str.e_48_5__ume_38_5__um_se_0m
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.10022af0
jmp 0x10022d20
mov dword [esp], str.AV_LOG_FORCE_COLOR
call sub.msvcrt.dll_getenv
mov edx, eax
mov eax, 1
test edx, edx
jne 0x10022df8
xor eax, eax
cmp dword [0x100d5684], 0xffffffff
setne al
jmp 0x10022df8
mov dword [esp], 2
movzx edx, byte [esi + 0x100b39a0]
mov ebp, str.e__u_3_um_se_0m
mov byte [esp + 0x2f], dl
call dword [0x100aa0cc]
movzx edx, byte [esp + 0x2f]
mov dword [esp + 0x10], ebx
mov dword [esp + 4], ebp
mov ecx, eax
mov al, dl
mov dword [esp], ecx
shr dl, 4
and al, 0xf
movzx edx, dl
movzx eax, al
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
call fcn.10022af0
jmp 0x10022d20