Function at 0x1008f170
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018ad56
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101de034], 4
jl 0x1008f1ae
mov dword [0x101de034], 0
mov eax, dword [0x101de034]
cmp dword [eax*4 + 0x101de024], 0
jne 0x1008f1e3
push 0x14000
call fcn.10147d31
add esp, 4
mov dword [ebp - 0x488], eax
mov ecx, dword [0x101de034]
mov edx, dword [ebp - 0x488]
mov dword [ecx*4 + 0x101de024], edx
mov eax, dword [0x101de034]
mov ecx, dword [eax*4 + 0x101de024]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
test ecx, ecx
je 0x1008f5e0
mov edx, dword [ebp - 0x4c]
movzx eax, word [edx]
cmp eax, 0x25
jne 0x1008f491
push 0x25
mov ecx, dword [ebp - 0x4c]
add ecx, 2
push ecx
call fcn.1014f554
add esp, 8
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x1008f48c
push 0x20
mov edx, dword [ebp - 0x4c]
push edx
call fcn.1014f554
add esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1008f252
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x54]
jbe 0x1008f263
push 0xd
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.1014f554
add esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1008f271
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x54]
jbe 0x1008f282
push 0xa
mov eax, dword [ebp - 0x4c]
push eax
call fcn.1014f554
add esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1008f294
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp - 0x54]
jbe 0x1008f48c
mov edx, dword [ebp - 0x4c]
add edx, 2
mov eax, dword [ebp - 0x54]
sub eax, edx
sar eax, 1
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 2
push ecx
lea edx, [ebp - 0x45c]
push edx
call fcn.1014f8e2
add esp, 0xc
mov eax, dword [ebp - 0x4c]
add eax, 2
mov ecx, dword [ebp - 0x54]
sub ecx, eax
sar ecx, 1
xor edx, edx
mov word [ebp + ecx*2 - 0x45c], dx
mov byte [ebp - 0x59], 0
push 0x101a0fe4
lea eax, [ebp - 0x25c]
push eax
call fcn.1014eafb
add esp, 8
lea ecx, [ebp - 0x45c]
push ecx
call fcn.100c1390
add esp, 4
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
jne 0x1008f31c
lea edx, [ebp - 0x45c]
push edx
mov ecx, 0x101dafb0
call fcn.1007ebf0
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
je 0x1008f431
mov byte [ebp - 0x59], 1
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1008f419
push str.PROTECTEDFILE
lea ecx, [ebp - 0x45c]
push ecx
call fcn.1014ecc1
add esp, 8
test eax, eax
je 0x1008f36d
push str.PROTECTEDFILEPATH
lea edx, [ebp - 0x45c]
push edx
call fcn.1014ecc1
add esp, 8
test eax, eax
jne 0x1008f419
mov eax, dword [ebp - 0x460]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1009f160
mov dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.1008ef90
add esp, 0xc
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x4a0]
cmp dword [ecx + 0x14], 8
jb 0x1008f3c7
mov edx, dword [ebp - 0x4a0]
mov eax, dword [edx]
mov dword [ebp - 0x4bc], eax
jmp 0x1008f3d3
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
push edx
lea eax, [ebp - 0x25c]
push eax
call fcn.1014eafb
add esp, 8
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10085cf0
mov byte [ebp - 4], 0
mov dword [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
jmp 0x1008f42f
mov ecx, dword [ebp - 0x460]
push ecx
lea edx, [ebp - 0x25c]
push edx
call fcn.1014eafb
add esp, 8
jmp 0x1008f452
push pe_nt_image_headers32
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1008f452
mov byte [ebp - 0x59], 1
movzx edx, byte [ebp - 0x59]
test edx, edx
je 0x1008f48c
mov eax, dword [ebp - 0x54]
add eax, 2
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x25c]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call fcn.1014eafb
add esp, 8
push 0
mov eax, dword [ebp - 0x50]
push eax
call fcn.1014f554
add esp, 8
mov dword [ebp - 0x50], eax
jmp 0x1008f1f8
jmp 0x1008f5bd
mov ecx, dword [ebp - 0x4c]
movzx edx, word [ecx]
cmp edx, 0xff
jle 0x1008f5bd
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1008f5bd
push 0
mov ecx, dword [ebp - 0x4c]
movzx edx, word [ecx]
push edx
lea eax, [ebp - 0x47c]
push eax
call fcn.1008ed50
add esp, 0xc
mov dword [ebp - 4], 4
cmp dword [ebp - 0x468], 8
jb 0x1008f4e5
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x4a4], ecx
jmp 0x1008f4f1
lea edx, [ebp - 0x47c]
mov dword [ebp - 0x4a4], edx
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x468], 8
jb 0x1008f514
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x4c0], ecx
jmp 0x1008f520
lea edx, [ebp - 0x47c]
mov dword [ebp - 0x4c0], edx
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x4c0]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x4a8], edx
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x484], eax
jmp 0x1008f552
mov ecx, dword [ebp - 0x480]
add ecx, 2
mov dword [ebp - 0x480], ecx
mov edx, dword [ebp - 0x480]
xor eax, eax
cmp edx, dword [ebp - 0x484]
sete al
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
movzx edx, cl
test edx, edx
je 0x1008f592
xor eax, eax
jne 0x1008f574
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x480]
mov ax, word [edx]
mov word [ecx], ax
mov ecx, dword [ebp - 0x50]
add ecx, 2
mov dword [ebp - 0x50], ecx
jmp 0x1008f543
mov edx, dword [ebp - 0x4c]
add edx, 2
mov dword [ebp - 0x4c], edx
mov dword [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x47c]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
jmp 0x1008f1f8
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov dx, word [ecx]
mov word [eax], dx
mov eax, dword [ebp - 0x50]
add eax, 2
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov dword [ebp - 0x4c], ecx
jmp 0x1008f1f8
xor edx, edx
mov eax, dword [ebp - 0x50]
mov word [eax], dx
mov ecx, dword [0x101de034]
mov edx, dword [ecx*4 + 0x101de024]
mov dword [ebp - 0x4c4], edx
mov eax, dword [0x101de034]
add eax, 1
mov dword [0x101de034], eax
mov eax, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret