Function at 0x1001806
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xe0
push ebx
push ebp
mov ebp, dword [esp + 0xf0]
mov ecx, dword [ebp]
push edi
mov edx, 0x1003520
xor ebx, ebx
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x1001820
mov edi, dword [esp + 0xf0]
and byte [0x1003640], al
and byte [0x1003060], al
and byte [0x10031c0], al
and byte [0x1003760], al
and byte [0x1003260], al
cmp edi, 1
mov word [0x1003510], 0x2a
mov dword [0x1003024], ebx
jne 0x100186a
xor eax, eax
jmp 0x1001cee
push esi
push dword [ebp + 4]
call fcn.01001274
test eax, eax
je 0x1001c80
mov edx, dword [ebp + 4]
mov eax, 0x1003300
mov esi, eax
mov cl, byte [edx]
inc edx
mov byte [esi], cl
inc esi
test cl, cl
jne 0x1001885
push eax
call dword [sym.imp.msvcrt.dll__mbsupr]
pop ecx
push 0x50
lea eax, [esp + 0x1c]
push eax
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
cmp edi, 3
push 2
pop ebx
jne 0x10018eb
mov eax, dword [ebp + 8]
cmp byte [eax], 0x2f
jne 0x1001923
lea ecx, [eax + 1]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10018c6
sub eax, esi
mov dword [esp + 0x10], eax
je 0x1001923
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.01001298
test eax, eax
je 0x1001923
push 2
jmp 0x1001cec
jle 0x100191f
mov eax, dword [ebp + 8]
cmp byte [eax], 0x2f
jne 0x100191f
lea ecx, [eax + 1]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10018fd
sub eax, esi
mov dword [esp + 0x10], eax
je 0x100191f
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.01001298
test eax, eax
jne 0x1001cea
cmp edi, ebx
jle 0x100199b
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0x2f
je 0x100199b
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001930
sub eax, esi
mov edi, 0x100
cmp eax, edi
ja 0x1001cea
mov edx, 0x1003640
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x100194b
push 3
pop ebx
cmp dword [esp + 0xf4], ebx
jle 0x100199b
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0x2f
je 0x100199b
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100196e
sub eax, esi
cmp eax, edi
jbe 0x1001982
mov eax, ebx
jmp 0x1001ced
mov edx, 0x1003060
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x1001987
mov dword [esp + 0x10], 4
jmp 0x100199f
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0xf4]
cmp dword [esp + 0x10], eax
jge 0x1001bd2
mov ebx, dword [sym.imp.msvcrt.dll_strchr]
mov eax, dword [esp + 0x10]
lea esi, [ebp + eax*4]
mov eax, dword [esi]
cmp byte [eax], 0x2f
jne 0x1001cea
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x50
lea eax, [esp + 0x1c]
push eax
push 2
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi]
inc eax
push eax
call fcn.01001298
test eax, eax
je 0x1001a2b
push 0x3a
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1001cea
push 0xf
inc eax
push eax
mov esi, 0x1003510
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
and byte [0x100351f], 0
push esi
call dword [sym.imp.msvcrt.dll__strupr]
add esp, 0x10
jmp 0x1001bbd
push 0x50
lea eax, [esp + 0x1c]
push eax
push 3
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi]
inc eax
push eax
call fcn.01001298
test eax, eax
je 0x1001aa9
cmp byte [0x10031c0], 0
jne 0x1001cea
push 0x3a
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1001cea
lea ecx, [eax + 1]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001a76
sub eax, esi
mov dword [esp + 0x14], eax
je 0x1001cea
push 0x80
push ecx
push 0x10031c0
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
and byte [0x1003240], 0
jmp 0x1001bbd
push 0x50
lea eax, [esp + 0x1c]
push eax
push 0x1f
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi]
inc eax
push eax
call fcn.01001298
test eax, eax
je 0x1001bda
cmp byte [0x1003760], 0
jne 0x1001cea
push 0x104
push 0x1003760
push 0x100111c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x3a
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1001cea
lea ebp, [eax + 1]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001b0d
sub eax, edx
mov dword [esp + 0x14], eax
je 0x1001cea
mov eax, ebp
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001b25
sub eax, ecx
mov edi, 0x1003760
mov ecx, edi
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001b3a
sub ecx, edx
add ecx, esi
cmp ecx, 0x103
jbe 0x1001b56
push 0x104
push ebp
push edi
jmp 0x1001ba6
mov eax, ebp
mov ecx, ebp
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001b5a
mov edi, 0x1003760
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1001b6b
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x4000
lea eax, [esp + 0x6c]
push eax
and ecx, 3
push 0x1003760
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x1001bb6
push 0x104
push ebp
push 0x1003760
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
and byte [0x1003864], 0
mov ebp, dword [esp + 0xf8]
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xf4]
jl 0x10019b6
xor eax, eax
inc eax
jmp 0x1001ced
push 0x50
lea eax, [esp + 0x1c]
push eax
push 4
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi]
inc eax
push eax
call fcn.01001298
test eax, eax
je 0x1001c4b
push 0x3a
push dword [esi]
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1001cea
lea ecx, [eax + 1]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001c18
sub eax, esi
mov dword [esp + 0x14], eax
je 0x1001cea
push 0x80
push ecx
push 0x1003260
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
and byte [0x10032e0], 0
jmp 0x1001bbd
push 0x50
lea eax, [esp + 0x1c]
push eax
push 0x21
push 0
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi]
inc eax
push eax
call fcn.01001298
test eax, eax
je 0x1001cea
mov dword [0x1003024], 1
jmp 0x1001bbd
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x50
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 4]
inc eax
push eax
call fcn.01001298
test eax, eax
jne 0x1001cea
push 0x50
lea eax, [esp + 0x1c]
push eax
push 5
push ebx
call esi
push eax
call edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebp + 4]
inc eax
push eax
call fcn.01001298
test eax, eax
je 0x1001cea
and byte [0x1003300], 0
xor eax, eax
cmp dword [esp + 0xf4], 2
setne al
inc eax
jmp 0x1001bd4
push 3
pop eax
pop esi
pop edi
pop ebp
pop ebx
add esp, 0xe0
ret 8