Function at 0x68a2de70
Capabilities:
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x68ab13e4]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x68ab34e4]
push edi
cmp eax, dword [ecx + 4]
jle 0x68a2df0f
push 0x68ab34e4
call fcn.68a39824
add esp, 4
cmp dword [0x68ab34e4], 0xffffffff
jne 0x68a2df0f
push 0x10
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push str.AswJsFltOutputSeverity
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
xor esi, esi
cmp eax, 0xe
ja 0x68a2defc
lea eax, [ebp - 0x24]
push eax
call fcn.68a40efb
add esp, 4
mov edi, eax
call fcn.68a40217
cmp dword [eax], esi
jne 0x68a2defc
cmp edi, 3
cmovbe esi, edi
push 0x68ab34e4
mov dword [0x68ab34e8], esi
call fcn.68a397d3
add esp, 4
mov eax, dword [0x68ab34e8]
test eax, eax
jle 0x68a2e0a1
mov edi, dword [ebp + 8]
cmp edi, eax
jl 0x68a2e0a1
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x42c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push dword [ebp + 0x10]
mov edx, 3
lea ecx, [edi - 1]
push ebx
push esi
push eax
cmp ecx, edx
lea eax, [ebp - 0x42c]
cmova ecx, edx
push dword [ecx*4 + 0x68aa86f8]
push str.Severity:__s__Pid:_d__Tid:_d___hs__d_:
push 0
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x424]
push 0x200
push eax
call fcn.68a2b3f0
add esp, 0x2c
test eax, eax
js 0x68a2e0a6
mov esi, dword [ebp - 0x42c]
xor edi, edi
test esi, esi
je 0x68a2e064
cmp esi, 0x7fffffff
ja 0x68a2e064
mov edi, dword [ebp - 0x428]
xor ebx, ebx
test esi, esi
jne 0x68a2dfe5
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
je 0x68a2e022
test edi, edi
jne 0x68a2dfde
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov ebx, 0x8007007a
jmp 0x68a2e022
lea eax, [ebp + 0x18]
push eax
push ecx
push dword [ebp + 0x14]
lea ebx, [esi - 1]
mov ecx, edi
mov edx, ebx
mov dword [ebp - 0x428], ebx
call fcn.68a09ec0
add esp, 0xc
test eax, eax
js 0x68a2e057
cmp eax, ebx
ja 0x68a2e057
jne 0x68a2e051
xor eax, eax
mov word [edi + ebx*2], ax
xor ebx, ebx
mov eax, dword [ebp - 0x428]
mov esi, 1
lea edi, [edi + eax*2]
test ebx, ebx
js 0x68a2e03e
cmp esi, 2
jbe 0x68a2e08b
lea eax, [ebp - 0x424]
mov dword [edi], 0xa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
xor ebx, ebx
sub esi, eax
jmp 0x68a2e01f
xor eax, eax
mov word [edi + ebx*2], ax
mov ebx, 0x8007007a
jmp 0x68a2e014
mov ebx, 0x80070057
test esi, esi
je 0x68a2e022
mov ecx, dword [ebp - 0x428]
xor edx, edx
pop edi
pop esi
mov eax, ebx
mov word [ecx], dx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov eax, 0x8007139f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret