Function at 0x1015641
Capabilities:
Query environment variable

Disassembly:
push 0x14
mov eax, 0x101d531
call fcn.01001448
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1015657
sub eax, esi
sar eax, 1
mov dword [ebp - 0x10], eax
je 0x10156e8
cmp eax, 8
jb 0x10156e8
push 0x24
pop eax
cmp ax, word [ecx]
jne 0x10156e8
push 0x28
pop eax
cmp ax, word [ecx + 2]
jne 0x10156e8
push 0x40
pop eax
cmp ax, word [ecx + 4]
jne 0x10156e8
mov ebx, dword [sym.imp.msvcrt.dll_wcschr]
push 0x2c
push ecx
call ebx
mov esi, eax
mov eax, dword [edi]
push 0x2d
push eax
call ebx
add esp, 0x10
mov dword [ebp - 0x14], eax
test esi, esi
je 0x10156e8
test eax, eax
je 0x10156e8
sub eax, esi
and eax, 0xfffffffe
cmp eax, 2
jne 0x10156e8
sub esi, dword [edi]
xor ecx, ecx
sar esi, 1
sub esi, 3
push 2
lea ebx, [esi + 1]
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01001544
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
jne 0x10156f3
push eax
call fcn.01001514
pop ecx
xor eax, eax
inc eax
call fcn.010016a1
ret 4
mov eax, dword [edi]
push esi
add eax, 6
push eax
push ebx
push dword [ebp + 8]
call fcn.01004405
test eax, eax
jge 0x101570c
push dword [ebp + 8]
jmp 0x10156e2
mov eax, dword [edi]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x10]
sar ecx, 1
sub eax, ecx
mov esi, eax
xor ecx, ecx
push 2
lea ebx, [esi + 1]
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01001544
pop ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push esi
add ecx, 2
push ecx
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.01004405
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x1015766
push dword [ebp - 0x10]
call fcn.01001514
push dword [ebp + 8]
call fcn.01001514
pop ecx
jmp 0x10156e7
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x101577b
push esi
jmp 0x1015756
push 0x208
call fcn.01001544
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
test ebx, ebx
jne 0x10157af
push eax
call fcn.01001514
push esi
call fcn.01001514
push dword [ebp + 8]
call fcn.01001514
add esp, 0xc
jmp 0x10156e8
push 0x103
push ebx
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10157c5
push ebx
jmp 0x1015794
push 2
push 0
push ebx
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x10157e1
push ebx
call fcn.01001514
push dword [ebp - 0x10]
jmp 0x101579a
mov dword [ebp - 0x20], esi
push 0xa000
mov byte [ebp - 4], 3
call fcn.01001544
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x101580a
push eax
call fcn.01001514
pop ecx
push esi
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_FreeLibrary]
jmp 0x10157d6
push 0x4fff
push eax
push dword [ebp - 0x18]
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp - 0x14]
test eax, eax
je 0x10157fb
mov ecx, edi
call fcn.0100be01
push 0
call fcn.01001514
pop ecx
push esi
call dword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_FreeLibrary]
push ebx
call fcn.01001514
push dword [ebp - 0x10]
call fcn.01001514
push dword [ebp + 8]
call fcn.01001514
mov eax, dword [ebp - 0x1c]
add esp, 0xc
jmp 0x10156eb