Function at 0x1001adb9
Capabilities:
Create thread
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
push esi
mov dword [ebp - 0xc], 0xffffffff
mov ebx, edx
push edi
mov dword [ebp - 0x18], 0xffffffff
mov edi, ecx
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xffffffe4
push 3
mov dword [ebp - 0x38], ebx
pop esi
jl 0x1001af6d
mov eax, 0x74aa0d72
mov dword [ebp - 4], 0xeec5
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0xc], 0xd1b9849b
mov ecx, dword [ebp - 4]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, edx
sub ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
cmp ecx, 0xeea5
setne al
cmp eax, dword [ebp - 0xc]
jle 0x1001af1f
mov dword [ebp - 8], 0xfffffffd
xor ecx, ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
setns cl
xor eax, eax
cmp ecx, 0x7c71
setg al
xor edx, edx
cmp dword [ebp - 4], eax
jg 0x1001ae82
mov dword [ebp - 0x14], 0x1718bc69
mov dword [ebp - 8], edx
jmp 0x1001ae7b
dec dword [ebp - 0x14]
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x1001ae75
jmp 0x1001aed8
mov dword [ebp - 8], edx
jmp 0x1001aed3
mov dword [ebp - 4], edx
jmp 0x1001aeac
mov dword [ebp - 0x14], 0xf19716e2
mov dword [ebp - 0x14], edx
jmp 0x1001aea4
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x50], edx
jne 0x1001aea9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001ae98
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x1001ae8c
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001aed0
push edx
push 0x129e
push edx
push edx
push 0x261a
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x1001ae87
cmp dword [ebp - 0x18], edx
jne 0x1001af03
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xb8f3be
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, dword [ebp - 8]
je 0x1001af03
mov ecx, edx
jmp 0x1001af06
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x44]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
jmp 0x1001af3e
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001af38
push 0xc57
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 0x18], 0
jne 0x1001af6d
mov dword [ebp - 4], 0
jmp 0x1001af55
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001af47
dec dword [ebp - 0xc]
mov eax, 0x74aa0d72
cmp dword [ebp - 0xc], 0xffffffe4
jge 0x1001adf3
mov dword [ebp - 0x24], 0x720e
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001af97
push 0
push 0x41a9
push 0x5c7f
push 0x671c
call fcn.1001b5ee
add esp, 0x10
push 0
lea eax, [ebp - 0x1a]
mov byte [ebp - 0x1a], 0
push eax
push 0xfa8
call fcn.1001d803
add esp, 0xc
mov dword [ebp - 4], 0xeaa32b1c
xor ecx, ecx
mov dword [ebp - 4], ecx
push 2
pop edx
jmp 0x1001afcd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001afbf
mov dword [ebp - 4], ecx
jmp 0x1001afe8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x94], 5
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001afd7
mov dword [ebp - 4], ecx
jmp 0x1001b001
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], 0x7cec
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001aff3
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 1
jg 0x1001b1d7
push 2
pop ebx
mov dword [ebp - 8], 0xabbf9acf
xor edx, edx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x34], 0x66969e96
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub ecx, 0x52a5ae63
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 8]
neg edx
sbb edx, edx
inc edx
imul eax, edx
xor edx, edx
cmp eax, 0xc1464f16
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 0x47d1afd0
je 0x1001b07f
cmp dword [ebp - 0x58], 0
je 0x1001b07f
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1001b084
xor edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp - 4]
sub ecx, eax
dec ecx
je 0x1001b126
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffe
jne 0x1001b0a9
cmp dword [ebp - 8], 0
je 0x1001b0a9
mov eax, edx
jmp 0x1001b0ab
xor eax, eax
cmp eax, dword [ebp - 8]
jl 0x1001b0b6
cmp dword [ebp - 8], 0
jne 0x1001b0b8
xor edx, edx
mov dword [ebp - 0xc], 0x5290ce96
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp eax, edx
setle cl
cmp ecx, dword [ebp - 0x54]
jle 0x1001b0e9
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001b16b
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1001b16b
mov dword [ebp - 0x18], 0x430688cd
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
cmp ebx, edx
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
neg eax
cmp eax, 0x16c28cbd
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
jmp 0x1001b16b
mov dword [ebp - 0x18], 0xa227283a
mov dword [ebp - 0x18], edx
push 8
pop eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x18], 0x111919b1
mov dword [ebp - 0x14], 0
jmp 0x1001b163
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 0xade45a91
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001b152
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x74], 0
je 0x1001b1a4
mov eax, dword [ebp - 0x58]
xor edx, edx
cmp eax, 0x4f7d9fd5
mov eax, dword [ebp - 0x34]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
imul eax, edx
test eax, eax
je 0x1001b1a4
xor eax, eax
inc eax
jmp 0x1001b1a6
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x90], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x1001b016
mov ebx, dword [ebp - 0x38]
xor ecx, ecx
cmp dword [edi + 0x10], ecx
jne 0x1001b1e3
xor al, al
jmp 0x1001b572
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x14], ecx
jmp 0x1001b200
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xbc], 0x8e97eede
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001b1ef
inc dword [ebp - 0x30]
lea eax, [ebp - 0x30]
push eax
push 0x32db
push ecx
push 0x67d3
push 0x7b26
call fcn.10024a93
xor edx, edx
add esp, 0x14
mov dword [ebx], edx
cmp dword [edi + 0x14], 0x10
jb 0x1001b233
mov esi, dword [edi]
jmp 0x1001b235
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x1001b23f
mov ecx, dword [edi]
jmp 0x1001b241
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001b570
xor ecx, ecx
mov dword [ebp - 4], 0xbac64a68
inc ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], edx
jmp 0x1001b275
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x20], 0xdba33992
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001b267
mov dword [ebp - 4], edx
jmp 0x1001b2a4
mov dword [ebp - 0xc], 0xda5043c4
mov dword [ebp - 0xc], edx
jmp 0x1001b29c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x20]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x20], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x1001b28b
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1d
jne 0x1001b27f
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 4]
cmp edx, eax
mov eax, dword [ebp - 8]
sete cl
xor edx, edx
cmp ecx, 0xfe924f63
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 8]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 4]
setle bl
xor ecx, ecx
cmp ebx, eax
setl cl
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
sub edx, eax
mov eax, dword [ebp - 4]
cmp edx, eax
mov al, byte [esi]
setne cl
mov dword [ebp - 4], ecx
cmp al, 0x30
jl 0x1001b403
cmp al, 0x39
jg 0x1001b403
mov dword [ebp - 0xc], 0x4504cd45
dec dword [ebp - 0xc]
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], 0x13
je 0x1001b3eb
xor ebx, ebx
mov dword [ebp - 8], 0xea983111
mov dword [ebp - 8], 0xfffffffd
jmp 0x1001b3d8
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], ebx
jmp 0x1001b38b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0x3244d513
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b37a
push ebx
call fcn.1001dd4a
mov dword [ebp - 0x14], 0xffffffe6
cmp dword [ebp - 0x14], 0xffffffe7
pop ecx
jle 0x1001b3d5
push 2
pop eax
mov dword [ebp - 0x18], 0x7dcd66a0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jl 0x1001b3cc
push ebx
push 0x4d2a
call fcn.1001df0c
dec dword [ebp - 0x18]
pop ecx
pop ecx
jns 0x1001b3b7
push 2
pop eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe7
jg 0x1001b3a8
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x16
je 0x1001b36e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x13
jne 0x1001b35e
mov ebx, dword [ebp - 0x38]
movsx eax, byte [esi]
imul ecx, dword [ebx], 0xa
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [ebx], eax
xor edx, edx
jmp 0x1001b235
mov dword [ebp - 0x24], 0xef6f0c3d
xor ebx, ebx
mov dword [ebp - 0x34], 0xa0197cbb
mov dword [ebp - 4], ebx
jmp 0x1001b426
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x64], 0xf70ad6f2
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001b418
push 2
mov dword [ebp - 4], ebx
pop esi
jmp 0x1001b442
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001b434
mov dword [ebp - 4], ebx
jmp 0x1001b45a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jl 0x1001b44c
mov dword [ebp - 4], ebx
jmp 0x1001b473
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0x2044653f
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001b465
mov dword [ebp - 0x2c], ebx
jmp 0x1001b536
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x1001b4e4
mov dword [ebp - 8], ebx
mov dword [ebp - 8], esi
cmp dword [ebp - 8], ebx
jl 0x1001b4ab
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001b4a6
push ebx
call fcn.1001d7cc
pop ecx
dec dword [ebp - 8]
jns 0x1001b497
mov dword [ebp - 8], ebx
jmp 0x1001b4dc
mov dword [ebp - 0xc], 0xfffffff7
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x64], ebx
jne 0x1001b4e1
mov dword [ebp - 0xc], ebx
jmp 0x1001b4d3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x64], 0x7e780ca9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001b4c5
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x1001b4b0
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x1001b48c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jne 0x1001b508
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x2c]
push 0
pop ecx
mov eax, dword [ebp + eax*4 - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov eax, dword [ebp - 4]
setns cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x1001b480
mov eax, dword [ebp - 0x38]
push ebx
mov dword [eax], ebx
lea eax, [ebp - 0x19]
mov dword [ebp - 0x24], 0x720e
push eax
mov byte [ebp - 0x19], bl
call fcn.1001d8cc
push 0x4832
push ebx
push 0x5f5d
call fcn.1001dbf4
add esp, 0x14
jmp 0x1001b1dc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret