Function at 0x1001a39c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
mov dword [ebp - 0x28], ecx
mov bl, dl
xor ecx, ecx
mov dword [ebp - 0x18], 0xc2e0cf57
mov byte [ebp - 5], cl
push esi
push edi
cmp byte [ebp - 5], cl
je 0x1001a3d1
push 0x1caf
push 0x1af
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
xor ecx, ecx
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x1001a3e7
push 0x11cb
call dword [sym.imp.USER32.dll_MessageBeep]
xor ecx, ecx
test bl, bl
je 0x1001a5a6
push 9
pop ebx
mov dword [ebp - 0x10], 0x15aa961
push 3
mov dword [ebp - 0x10], ebx
pop edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], 0xffff
mov dword [ebp - 4], ecx
jmp 0x1001a41c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], 0xff606579
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001a40e
push 2
mov dword [ebp - 4], ecx
pop edx
jmp 0x1001a437
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], 0xb8914be
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001a429
xor esi, esi
inc esi
cmp dword [ebp - 0x58], ecx
je 0x1001a495
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0xdf6f9781
mov dword [ebp - 4], ecx
jmp 0x1001a461
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x24], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a453
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x1001a59a
mov dword [ebp - 4], 0xfffb
mov dword [ebp - 0x10], 0x5e148cb4
mov dword [ebp - 0xc], ecx
jmp 0x1001a4b6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2c], 0xe474c77a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001a4a8
cmp dword [ebp - 4], ecx
je 0x1001a4d7
mov eax, dword [ebp - 0x6c]
mov ecx, 0xd5d909cc
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [ebp - 4]
mov eax, esi
jg 0x1001a4d9
mov eax, ecx
imul eax, eax, 0xfffffffa
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], 0xfcd4d338
sbb eax, eax
neg eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp ebx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 4]
je 0x1001a54f
mov dword [ebp - 0xc], 0xfffffff1
jmp 0x1001a548
mov dword [ebp - 0x10], 0x95c3c62e
mov dword [ebp - 4], ecx
jmp 0x1001a536
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001a525
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa0], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jg 0x1001a519
jmp 0x1001a57f
mov dword [ebp - 0x10], 0xdeab2dd2
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x1001a565
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, dword [ebp - 0x2c]
xor edx, edx
mov dword [ebp - 0x2c], esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp eax, ecx
setl dl
add edx, esi
xor ecx, ecx
mov dword [ebp - 0x10], edx
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x1001a59a
push 0x518
push 0x185a
call dword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1001a8e8
mov dword [ebp - 0xc], 0xda439beb
xor esi, esi
mov dword [ebp - 0x18], 0xe2a8d3a1
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], 0xfffffff9
push 0xfffffffffffffffc
pop ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x6954eb85
mov dword [ebp - 0x20], 0xfe98d7e9
push 2
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 4], ecx
pop edx
jmp 0x1001a5f8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x74], 0xbca6
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001a5ea
mov dword [ebp - 4], ecx
jmp 0x1001a613
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x84], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001a602
push 3
mov dword [ebp - 4], ecx
pop edi
jmp 0x1001a631
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x90], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001a620
mov dword [ebp - 0xc], ecx
jmp 0x1001a708
mov dword [ebp - 0x14], 0x1bc383c6
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], 0xf4f23013
mov dword [ebp - 0x14], 0xd7af2c9a
mov dword [ebp - 4], ecx
jmp 0x1001a670
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], 0xdb8faaae
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001a662
mov dword [ebp - 4], ecx
jmp 0x1001a688
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x7c], 0x4ff5452f
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a67a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x74], ecx
xor ecx, ecx
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x40], ecx
jl 0x1001a705
mov dword [ebp - 0x14], 0x55950707
mov dword [ebp - 0x14], 0xa4c5706b
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ecx
jmp 0x1001a6cc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0xf3b8cff2
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001a6bb
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ecx
jl 0x1001a700
mov dword [ebp - 4], 0xc3414b58
mov dword [ebp - 4], ecx
jmp 0x1001a6f3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 0x977a1245
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a6e5
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jns 0x1001a6d9
dec dword [ebp - 0x40]
jns 0x1001a6a5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x1001a63e
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
jmp 0x1001a73c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001a72e
mov dword [ebp - 4], ecx
jmp 0x1001a755
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], 0xcb444811
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001a747
mov dword [ebp - 0x38], 0xffffffed
cmp dword [ebp - 0x38], 0xc
jne 0x1001a8b0
push 9
pop ebx
mov dword [ebp - 0xc], ecx
jmp 0x1001a781
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c], 0x5ba7723
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001a773
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x1001a7a8
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
xor ecx, ecx
mov dword [ebp - 0x1c], esi
jmp 0x1001a897
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
jmp 0x1001a7cd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x64], 0x160c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1001a7bf
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x64]
neg edx
mov eax, dword [ebp - 0x64]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 0x303f0244
setg cl
xor eax, eax
cmp ecx, 0xf4f8
setge al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x64]
sete cl
add eax, ecx
mov ecx, 0xd020bd2a
cmp ecx, eax
sbb eax, eax
neg eax
js 0x1001a823
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x1001a83f
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x1001a83f
mov dword [ebp - 0x18], 0xf0f5ebe
cmp dword [ebp - 0x1c], 0
je 0x1001a83a
cmp dword [ebp - 0x18], 0
je 0x1001a83a
mov eax, esi
jmp 0x1001a83c
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0x254e7f13
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setg cl
cmp dword [ebp - 0x64], ecx
jl 0x1001a87c
cmp dword [ebp - 0x38], 0
jne 0x1001a87c
xor edx, edx
jmp 0x1001a87e
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
push 0
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x1c], ebx
jge 0x1001a7b0
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xc
push 0
pop ecx
je 0x1001a76e
mov dword [ebp - 0xc], 0x14
jmp 0x1001a8ca
mov dword [ebp - 0x18], 0x5575
mov dword [ebp - 0x18], 0xffffffff
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff2
jl 0x1001a8b9
push ecx
push 0x61e
push 0x13b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret