Function at 0x1002bb80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
lea ecx, [eax + 0x548]
mov esi, eax
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ecx
cmp eax, ecx
ja 0x1002bd31
mov ebx, dword [esp + 0x28]
jmp 0x1002bbb0
cmp esi, 0x369e
ja 0x1002bcb3
je 0x1002bc8c
lea eax, [esi - 0x359a]
cmp eax, 0xd0
ja case.0x1002bbda.13723
movzx eax, byte [eax + 0x1002beb0]
jmp dword [eax*4 + 0x1002be98]
push 0x20
call fcn.1003e491
add esp, 4
mov ebx, eax
mov dword [esp + 0x20], 0x1000
jmp case.0x1002bbda.13723
movzx ecx, word [esp + 0x40]
push 0xa
push ebx
push ecx
call fcn.1004f2c7
movsx edx, word [esp + 0x2c]
push edx
call fcn.1003eda6
add esp, 0x10
mov dword [esp + 0x1c], eax
jmp case.0x1002bbda.13723
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002bc22
mov ax, word [0x100682a4]
mov word [edi], ax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002bc38
movzx ecx, word [esp + 0x42]
sub eax, edx
push 0xa
add eax, ebx
push eax
push ecx
call fcn.1004f2c7
add esp, 0xc
jmp case.0x1002bbda.13723
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp case.0x1002bbda.13723
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], eax
jmp case.0x1002bbda.13723
cmp dword [esp + 0x1c], 0
jne 0x1002bc98
mov byte [esp + 0x13], 0
lea edi, [ebx - 1]
jmp 0x1002bca0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002bca0
mov ax, word [0x100682a4]
mov word [edi], ax
jmp case.0x1002bbda.13723
cmp esi, 0x3ccd
ja 0x1002be7b
je 0x1002be71
mov eax, esi
sub eax, 0x36d2
je 0x1002bd3c
sub eax, 0x34
jne case.0x1002bbda.13723
mov ecx, 0xaf6
jmp 0x1002bce0
mov eax, ecx
sub eax, 0xaf6
je 0x1002bcf0
sub eax, 0x56
je 0x1002bd31
jmp 0x1002bcf4
mov dword [esp + 0x18], ebx
add ecx, 0x56
cmp ecx, 0xb4c
jbe 0x1002bce0
idiv cl
inc ebx
or dword [ebx + 0x4d8b0845], 0xc183500c
sbb al, 0x51
call fcn.100210c0
add esp, 8
test eax, eax
setne dl
mov byte [esp + 0x18], dl
add esi, 0x34
mov dword [esp + 0x24], esi
cmp esi, dword [esp + 0x28]
jbe 0x1002bbb0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002bd41
movzx ecx, word [esp + 0x44]
sub eax, edx
push 0xa
add eax, ebx
push eax
push ecx
call fcn.1004f2c7
add esp, 0xc
cmp byte [esp + 0x13], 0
je case.0x1002bbda.13723
mov esi, 0x6053
lea esp, [esp]
cmp esi, 0x6183
ja 0x1002bdf3
je 0x1002bde6
lea eax, [esi - 0x6053]
cmp eax, 0xe4
ja case.0x1002be07.25040
movzx edx, byte [eax + 0x1002bf98]
jmp dword [edx*4 + 0x1002bf84]
mov dword [esp + 0x14], str.iaaeMlbyVr
mov byte [esp + 0x31], 0x69
jmp case.0x1002be07.25040
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 1]
mov byte [esp + 0x2f], cl
jmp case.0x1002be07.25040
mov eax, dword [esp + 0x14]
mov dl, byte [eax + 4]
mov al, byte [eax + 5]
mov byte [esp + 0x2c], dl
mov byte [esp + 0x34], al
jmp case.0x1002be07.25040
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 2]
mov dl, byte [eax + 3]
mov byte [esp + 0x32], cl
mov byte [esp + 0x35], dl
jmp case.0x1002be07.25040
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 6]
mov byte [esp + 0x33], cl
jmp case.0x1002be07.25040
lea eax, [esi - 0x61cf]
cmp eax, 0xe4
ja case.0x1002be07.25040
movzx edx, byte [eax + 0x1002c094]
jmp dword [edx*4 + 0x1002c080]
movsx eax, word [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp case.0x1002be07.25040
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 7]
mov dl, byte [eax + 8]
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2e], dl
jmp case.0x1002be07.25040
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 9]
mov byte [esp + 0x30], cl
mov byte [esp + 0x36], 0
jmp case.0x1002be07.25040
mov edx, dword [esp + 0x1c]
push edx
call fcn.1003e865
add esp, 4
add esi, 0x4c
cmp esi, 0x62b3
jbe 0x1002bd70
mov esi, dword [esp + 0x24]
jmp case.0x1002bbda.13723
outsd dx, dword [esi]
adc ch, byte [edi]
mov al, 0xa4
jmp case.0x1002bbda.13723
mov eax, esi
sub eax, 0x3d01
je 0x1002bcff
sub eax, 0x34
je 0x1002bd31
jmp case.0x1002bbda.13723