Function at 0x416300
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov ax, word [0x55c92c]
mov word [ebp - 0xac], ax
mov byte [ebp - 0x81], 0xdf
mov ecx, dword [0x55c92c]
mov dword [ebp - 0xbc], ecx
mov edx, dword [0x55c92c]
mov dword [ebp - 0x144], edx
mov byte [ebp - 0xae], 0x5f
mov dword [ebp - 0x88], 0x4e922
movzx eax, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x10c]
lea esi, [eax + ecx + 0xa556]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatA]
mov edi, eax
add edi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
add edi, eax
or esi, edi
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
ja 0x4163b0
jb 0x4163a4
cmp dword [ebp - 0x70], 0x4b1f3
ja 0x4163b0
cmp dword [ebp - 0x10c], 0x2a664
je 0x4163c2
movzx eax, word [ebp - 0xac]
movzx ecx, word [ebp - 0xac]
cmp eax, ecx
je 0x416435
movzx esi, word [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
sub esi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
mov edi, eax
add edi, dword [ebp - 0x10c]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
sub edi, eax
mov ecx, edi
shr esi, cl
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea edi, [eax + edx - 0x130ba]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
add edi, dword [ebp - 0x10c]
add ebx, edi
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub eax, 0x2e001
and ebx, eax
or esi, ebx
mov dword [ebp - 0x10c], esi
jmp 0x41645a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
movzx ecx, word [ebp - 0xac]
add ecx, 0x2a7a4
and ecx, 0x63dea
or eax, ecx
mov dword [ebp - 0x10c], eax
xor edx, edx
je 0x4164ad
movzx eax, byte [ebp - 0x81]
mov ecx, dword [ebp - 0x10c]
add ecx, 0x16b3e
and eax, ecx
or eax, 0x2bd97
movzx edx, word [ebp - 0xac]
movzx ecx, word [ebp - 0xac]
sub edx, ecx
add edx, 0xb3ae
and edx, 0xfffd3b55
or eax, edx
movzx edx, word [ebp - 0xac]
sub edx, 0x2dd0b
or eax, edx
mov byte [ebp - 0x81], al
jmp 0x41650d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
add eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea edx, [eax + ecx + 0x5e1e2]
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea eax, [ecx + eax - 0xba60]
add eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
add eax, dword [ebp - 0x10c]
add ecx, eax
mov eax, 0x680cc
sar eax, cl
and edx, eax
or edx, 0xebed
mov dword [ebp - 0x10c], edx
mov ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
sub ecx, 0x20268
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea edx, [eax + edx + 0x7efc0]
and ecx, edx
xor eax, eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], eax
mov cl, byte [ebp - 0x10c]
mov byte [ebp - 0x81], cl
mov edx, dword [ebp - 0x70]
add edx, 0x92640
mov eax, dword [ebp - 0x6c]
adc eax, 0
sub edx, 0x6fc4b
sbb eax, 0
or edx, dword [ebp - 0x70]
or eax, dword [ebp - 0x6c]
movzx ecx, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
sub esi, ecx
movzx ecx, word [ebp - 0xac]
sub esi, ecx
xor ecx, ecx
or edx, esi
or eax, ecx
mov byte [ebp - 0x81], dl
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x10c]
lea esi, [eax + edx - 0x86248]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
sub esi, eax
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
sub esi, eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
movzx ecx, byte [ebp - 0x81]
add eax, ecx
and esi, eax
xor edx, edx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edx
movzx eax, byte [ebp - 0x81]
mov ecx, 0xfffea37f
sub ecx, eax
add ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
mov al, byte [ebp - 0x81]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14