Function at 0x10006e6b
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10058968
call fcn.100582b8
sub esp, 0x5ec
cmp byte [ebp + 0x38], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov edx, ecx
je 0x10006f30
cmp byte [ebp + 0x24], 0
je 0x10006f06
mov edi, dword [ebp + 0x1c]
xor esi, esi
mov eax, dword [edi]
mov ecx, dword [edi]
mov eax, dword [edi]
neg ecx
add eax, ecx
mov ecx, dword [edx]
add ecx, eax
je 0x10006eaf
cmp dword [edi], esi
je 0x10006eaf
inc esi
mov dword [ebx], esi
xor ecx, ecx
mov eax, dword [edi]
mov eax, dword [edx]
mov eax, dword [edx]
cmp eax, 1
mov eax, dword [edi]
setne cl
xor ebx, ebx
cmp ecx, 0xf9c3ab31
mov ecx, dword [edi]
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp + 0x18]
setne dl
imul ecx, edx
mov dword [eax], ecx
mov ecx, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, 0xab462a77
cmp ecx, eax
mov eax, dword [ebp + 0x14]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x3c]
push dword [eax]
mov eax, dword [ebp + 0x40]
mov edx, dword [edx]
mov ecx, dword [ecx]
push dword [eax]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.10003d54
add esp, 0x10
jmp 0x10006ef5
cmp byte [ebp + 0x30], 0
je 0x10007138
mov dword [ebp - 0x14], 0x14b8
cmp dword [ebp - 0x14], 0x7e6
jge 0x10007069
call fcn.1004043c
push eax
push 0x100616a4
push str.in.txt
call fcn.10040733
add esp, 0xc
call fcn.1004043c
add eax, 0x20
push eax
push 0x100616b0
push str.out.txt
call fcn.10040733
add esp, 0xc
lea eax, [ebp + 0x38]
mov ebx, 0x10060b0c
push eax
push ebx
call fcn.10040302
cmp dword [ebp + 0x38], 0
pop ecx
pop ecx
je 0x10007069
xor esi, esi
jmp 0x10007030
mov edx, dword [ebp + 0x38]
xor ebx, ebx
inc ebx
cmp edx, ebx
jle 0x10006fcb
lea edi, [ebp - 0x314]
push edi
push 0x10060b0c
call fcn.10040302
mov edx, dword [ebp + 0x38]
inc ebx
pop ecx
add edi, 4
pop ecx
cmp ebx, edx
jl 0x10006fb3
xor edi, edi
mov dword [ebp - 0x18], esi
inc edi
mov ecx, esi
test edx, edx
jle 0x10007020
lea ebx, [ebp - 0x318]
jmp 0x10006ff7
test ecx, ecx
je 0x10006fee
mov eax, dword [ebp + ecx*4 - 0x5fc]
cmp eax, dword [ebx]
je 0x10006ffb
mov dword [ebp + ecx*4 - 0x5f8], edi
inc ecx
inc edi
cmp edi, edx
jle 0x10006fdf
mov eax, dword [ebp + ecx*4 - 0x5fc]
cmp eax, dword [ebx]
jne 0x10007015
mov eax, dword [ebp - 0x18]
dec ecx
inc eax
add ebx, 4
mov dword [ebp - 0x18], eax
cmp eax, edx
jl 0x10006ff7
test ecx, ecx
je 0x10007020
push 0x100616bc
jmp 0x10007025
push str.Yes_n
call fcn.100400a6
pop ecx
mov ebx, 0x10060b0c
lea eax, [ebp - 0x318]
push eax
push ebx
call fcn.10040302
pop ecx
pop ecx
cmp dword [ebp - 0x318], esi
jne 0x10006fa3
push 0x100616c8
call fcn.100400a6
pop ecx
lea eax, [ebp + 0x38]
push eax
push ebx
call fcn.10040302
pop ecx
pop ecx
cmp dword [ebp + 0x38], esi
jne 0x10007030
jmp 0x1000706b
xor esi, esi
mov dword [ebp - 0x14], 0x394a
cmp dword [ebp - 0x14], 0x3bc7
jle 0x10007103
push esi
push 0x149f
push 0xad2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov ebx, esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x18], 0x74c1
mov dword [ebp + 0x38], eax
xor eax, ebx
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100070c5
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.10001eb4
mov eax, dword [ebp + 0x38]
add eax, edi
dec dword [ebp - 0x18]
mov dword [ebp + 0x38], eax
jne 0x100070ae
inc edi
cmp edi, 0x6a46
jl 0x100070a2
inc ebx
cmp ebx, 0x356b
jl 0x100070a0
push 0x63a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp + 0x2c]
cmp byte [eax], 0
je 0x1000711b
push esi
push esi
mov edx, 0x4566
mov cl, 1
call fcn.100053cb
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0x3688
jge 0x10006ef5
push str.yuhtbvh_sxoldk_nby_fil_jornpu_lvtufkezx_qqqofvsu_knszjqbbz_hwy_zlnt_ujpfj_indjqjf_rufeziwo
call fcn.100400a6
pop ecx
jmp 0x10006ef5
mov dword [ebp - 0x14], 0x7ae1
xor esi, esi
cmp dword [ebp - 0x14], 0x7cc3
jle 0x10007171
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10072ab8
or eax, edi
cdq
push edx
push eax
call fcn.10001ac8
inc ebx
cmp ebx, 0x617b
jl 0x1000714e
inc edi
cmp edi, 0x5a2d
jl 0x1000714c
mov edi, dword [ebp + 0x28]
mov dword [edi], esi
jmp 0x10007195
push ecx
push 0x724e
push ecx
mov dword [ebp - 0x1c], 0x29949dfc
lea ecx, [ebp - 0x1c]
xor dl, dl
call fcn.1000615b
add esp, 0xc
dec dword [edi]
cmp dword [edi], esi
jge 0x10007178
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x7a9c
jge 0x10006ef5
mov edx, str.hcmbtqc_hjejkumm_ybhromkw_ygngpvcbz_tzgcpddv_xth_ydarikyhz_tjyfl_tlbw_cdl_gzsvcq_nrrch_zwef_pepr
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x10006ef5