Function at 0x68a32ef0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
mov eax, dword [0x68aaf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x210]
push esi
push edi
push 0x104
push eax
push str.AswJsFltOutDir
mov dword [ebp - 0x32c], edx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x320], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, 0x80070002
test eax, eax
je 0x68a33144
cmp eax, 0x104
jae 0x68a33144
mov eax, dword [ebp - 0x320]
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov ebx, dword [ebx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x320], eax
mov eax, dword [0x68ab33d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x68ab33d4]
mov dword [ebp - 0x324], eax
mov eax, dword [0x68ab33c8]
mov dword [ebp - 0x31c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
push ebx
push dword [ebp - 0x320]
push dword [ebp - 0x324]
push dword [ebp - 0x328]
push dword [ebp - 0x31c]
push eax
push str._d_p__d_ct__llu__08x_08x_08x_08x.dat
lea eax, [ebp - 0x318]
push 0x82
push eax
call fcn.68a09db0
mov esi, eax
add esp, 0x2c
test esi, esi
js 0x68a331b4
xor eax, eax
cmp ax, word [ebp - 0x210]
je 0x68a331c7
xor esi, esi
cmp ax, word [ebp - 0x318]
je 0x68a33144
mov ecx, 0x104
lea eax, [ebp - 0x210]
cmp word [eax], si
je 0x68a32ffd
add eax, 2
sub ecx, 1
jne 0x68a32ff0
xor eax, eax
mov esi, 0x80070057
test ecx, ecx
mov edx, 0x104
mov edi, ecx
cmovne esi, eax
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x68a33144
movzx eax, word [ebp + edi*2 - 0x212]
cmp eax, 0x5c
je 0x68a330c1
cmp eax, 0x2f
je 0x68a330c1
mov ecx, edx
lea eax, [ebp - 0x210]
cmp word [eax], 0
je 0x68a33052
add eax, 2
sub ecx, 1
jne 0x68a33044
mov eax, edx
mov ebx, ecx
sub eax, ecx
mov esi, 0x80070057
neg ebx
sbb ebx, ebx
and ebx, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x68a330b9
mov edi, edx
lea ecx, [ebp - 0x210]
lea ecx, [ecx + ebx*2]
sub edi, ebx
je 0x68a330a0
mov ebx, 0x68a5ff9c
mov eax, 0x7ffffffe
sub ebx, ecx
test eax, eax
je 0x68a330a0
movzx esi, word [ebx + ecx]
test si, si
je 0x68a330a0
mov word [ecx], si
dec eax
add ecx, 2
sub edi, 1
jne 0x68a33087
test edi, edi
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edi, edi
cmovne esi, eax
test esi, esi
js 0x68a331b4
mov ecx, edx
lea eax, [ebp - 0x210]
nop dword [eax]
cmp word [eax], 0
je 0x68a330de
add eax, 2
sub ecx, 1
jne 0x68a330d0
mov eax, edx
mov edi, ecx
sub eax, ecx
mov esi, 0x80070057
neg edi
sbb edi, edi
and edi, eax
xor eax, eax
test ecx, ecx
cmovne esi, eax
je 0x68a33144
lea ecx, [ebp - 0x210]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x68a3312b
lea edi, [ebp - 0x318]
mov eax, 0x7ffffffe
sub edi, ecx
test eax, eax
je 0x68a3312b
movzx esi, word [edi + ecx]
test si, si
je 0x68a3312b
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x68a33112
test edx, edx
lea eax, [ecx - 2]
mov esi, 0x8007007a
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
test edx, edx
cmovne esi, eax
test esi, esi
js 0x68a331b4
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x68a331dd
push 0
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], 0
push eax
push dword [ebp - 0x32c]
push dword [ebp - 0x330]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x68a331ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x68a331ad
movzx esi, si
or esi, 0x80070000
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.68a3943b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x68a331b6
mov ecx, dword [ebp - 4]
pop edi
movzx eax, ax
xor ecx, ebp
pop esi
or eax, 0x80070000
pop ebx
call fcn.68a3943b
mov esp, ebp
pop ebp
ret