Function at 0x100b4a70
Capabilities:
Check if file exists
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x101dc354]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x38]
push esi
mov esi, dword [ebp + 0x24]
push edi
mov edi, 0x208
mov dword [esp + 0x10], ebx
push edi
push 0
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], 0x101dd050
mov byte [esp + 0x30], 0
mov dword [esp + 0x28], 0x100012d4
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [esp + 0x248]
push edi
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [esp + 0x3c]
stosd dword es:[edi], eax
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0xc], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x100d6f56
cmp dword [ebp + 0xc], ecx
je 0x100d6f9a
cmp dword [ebp + 0x10], ecx
je 0x100d6fa1
cmp dword [ebp + 0x14], ecx
je 0x100d6fa8
cmp dword [ebp + 0x18], ecx
je 0x100d6faf
cmp dword [ebp + 0x20], ecx
je 0x100d6fb6
test esi, esi
je 0x100d6f5d
sub esp, 0xc
call fcn.100b559a
xor ebx, ebx
mov edi, eax
inc ebx
mov esi, 0x4000000
test edi, edi
js 0x100d6fbd
lea eax, [esp + 0x2c]
mov edx, 0x100087a0
push eax
push 0x100091f8
push ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100ae0e0
test eax, eax
je 0x100d6fff
mov edi, 0x104
lea eax, [esp + 0x40]
push edi
push eax
push dword [0x101dc9fc]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleFileNameW]
test eax, eax
je 0x100d701c
lea ecx, [esp + 0x40]
call fcn.100b5558
test eax, eax
je 0x100d7041
lea ecx, [esp + 0x40]
mov edx, edi
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
lea ecx, [esp + 0x24c]
push eax
call fcn.100af27e
mov edi, eax
test edi, edi
js 0x100d7060
lea ecx, [esp + 0x1c]
call fcn.100aa7b0
push ebx
push dword [esp + 0x24]
call fcn.100aa670
lea eax, [esp + 0x28]
xor edi, edi
push eax
push 0x100091e0
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleHandleExW]
test eax, eax
je 0x100d707a
mov ecx, dword [esp + 0x28]
call fcn.100b34b7
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTime]
movzx eax, word [esp + 0x3e]
push eax
movzx eax, word [esp + 0x40]
push eax
movzx eax, word [esp + 0x42]
push eax
movzx eax, word [esp + 0x44]
push eax
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x46]
push eax
movzx eax, word [esp + 0x48]
push eax
push 0x100091a8
push edi
push edi
push esi
call fcn.100ab973
add esp, 0x2c
call fcn.100b0dc8
cmp eax, ebx
je 0x100d708b
test eax, eax
js 0x100d70a2
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
mov ecx, 0x10009190
call fcn.100b0d9f
cmp dword [esp + 0x14], edi
jne 0x100d70b7
push 0x10009154
push edi
push 0x100000
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
mov edi, eax
test edi, edi
jne 0x100d70de
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jne 0x100d70c6
call fcn.100b5527
test eax, eax
js 0x100d710c
call fcn.100b1835
test eax, eax
js 0x100d7121
call fcn.100b3578
lea edx, [esp + 0x248]
lea ecx, [esp + 0x40]
call fcn.100b1717
mov edi, eax
test edi, edi
js 0x100d7136
cmp dword [0x101dc370], 0
jne 0x100d7140
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push 0x1000913c
push ebx
mov edx, 0x100090e0
mov dword [esp + 0x38], edi
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100b53d5
test eax, eax
jne 0x100b4d14
push dword [esp + 0x2c]
push 0x100090d4
push edi
push edi
push esi
call fcn.100ab973
add esp, 0x14
lea ecx, [esp + 0x2c]
call fcn.100b61be
call fcn.100b11ae
test eax, eax
js 0x100d715b
lea ecx, [esp + 0x248]
call fcn.100b1de4
mov edi, eax
test edi, edi
js 0x100d7170
lea ecx, [esp + 0x248]
call fcn.100b361b
mov edi, eax
test edi, edi
js 0x100d717a
push ecx
lea ecx, [esp + 0x24c]
call fcn.100b48c9
mov edi, eax
test edi, edi
js 0x100d7184
lea ecx, [esp + 0x248]
call fcn.100b52c7
mov edi, eax
test edi, edi
js 0x100d6fdc
call fcn.100b1990
test eax, eax
js 0x100d718e
call fcn.100b5274
test eax, eax
js 0x100d71a3
mov esi, dword [0x101dcab0]
test esi, esi
je 0x100d71b8
mov eax, dword [esp + 0x10]
mov ecx, esi
push eax
call dword [0x101e07c0]
call esi
mov edi, eax
test edi, edi
js 0x100d6fe6
call fcn.100b1ffc
mov edi, eax
test edi, edi
js 0x100d71d7
call fcn.100b1aa8
mov edi, eax
test edi, edi
js 0x100d71d7
call fcn.100b41c1
mov edi, eax
test edi, edi
js 0x100d71e1
call fcn.100b4534
mov edi, eax
test edi, edi
js 0x100d71eb
call fcn.100b50e6
mov edi, eax
test edi, edi
js 0x100d71f5
lea ecx, [esp + 0xc]
call fcn.100b4f7d
mov edi, eax
test edi, edi
js 0x100d71ff
xor esi, esi
push esi
push ebx
push ebx
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [0x101dc9d0], eax
test eax, eax
je 0x100d7209
push esi
push ebx
push ebx
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [0x101dca04], eax
test eax, eax
je 0x100d7242
push esi
push ebx
push ebx
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [0x101dc9cc], eax
test eax, eax
je 0x100d7268
push esi
push ebx
push ebx
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [0x101dc9b0], eax
test eax, eax
je 0x100d728e
push esi
push esi
push 0x100090a4
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x100d72a8
test byte [0x101de5f0], 2
jne 0x100b4ea3
call fcn.100b17a5
cmp dword [0x101dc370], esi
jne 0x100b4eba
call fcn.100b4f5a
test eax, eax
js 0x100d72db
mov edi, esi
mov ecx, dword [esp + 0x10]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101e07c0]
call esi
mov ecx, dword [0x101dc9c4]
test ecx, ecx
jne 0x100d72f4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [0x101dc9c4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x101dc9f4], eax
mov eax, dword [ebp + 0x10]
mov dword [0x101dca08], eax
mov eax, dword [ebp + 0x14]
mov dword [0x101dca0c], eax
mov eax, dword [ebp + 0x18]
mov dword [0x101dca1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [0x101dca00], eax
mov eax, dword [ebp + 0x20]
mov dword [0x101dc9c0], eax
mov eax, dword [esp + 0xc]
and dword [esp + 0xc], 0
mov dword [ecx], eax
test edi, edi
js 0x100d6f7b
mov ecx, dword [esp + 0xc]
test ecx, ecx
jne 0x100d7389
lea ecx, [esp + 0x1c]
call fcn.100aa570
mov ecx, dword [esp + 0x454]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b88c0
mov esp, ebp
pop ebp
ret 0x20
push 0x10028e68
jmp 0x100d6f62
push 0x10028f78
xor ebx, ebx
mov eax, 0x80004003
inc ebx
mov edi, eax
push ebx
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp dword [0x101dc9bc], 0
je 0x100d7309
call fcn.100b4377
xor esi, esi
mov dword [0x101dc9bc], esi
jmp 0x100d730b
push 0x10028e8c
jmp 0x100d6f62
push 0x10028eb8
jmp 0x100d6f62
push 0x10028ee4
jmp 0x100d6f62
push 0x10028f10
jmp 0x100d6f62
push 0x10028f40
jmp 0x100d6f62
push 0x1002c438
push ebx
push edi
push esi
call fcn.100ab973
add esp, 0x10
test edi, edi
jns 0x100b4b49
push 0x10028fa0
jmp 0x100d6fe1
push 0x100292d0
push ebx
push edi
push esi
jmp 0x100d6ff2
push 0x10029358
push ebx
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b4f24
push 0x10028fd8
push 0
push 0
push esi
call fcn.100ab973
add esp, 0x10
mov dword [0x101de5e0], ebx
jmp 0x100b4b6b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100d7033
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100d703a
mov edi, 0x80004005
push 0x10029034
jmp 0x100d6fe1
lea eax, [esp + 0x40]
mov edi, 0x8000ffff
push eax
push 0x10029054
push ebx
push edi
push esi
call fcn.100ab973
add esp, 0x14
jmp 0x100d6f7b
lea eax, [esp + 0x40]
push eax
push 0x10029088
push ebx
push edi
push esi
call fcn.100ab973
add esp, 0x14
jmp 0x100b4f24
lea ecx, [esp + 0x248]
call fcn.100e8a21
jmp 0x100b4bf6
push 0x100290d0
push edi
push edi
push esi
call fcn.100ab973
add esp, 0x10
mov eax, edi
jmp 0x100b4c48
push 0x10029120
push ebx
push eax
push esi
call fcn.100ab973
add esp, 0x10
jmp 0x100b4c50
push 4
mov edx, ebx
pop ecx
call fcn.100e652d
jmp 0x100b4c6c
push eax
push 0x1002916c
push 0
push 0
push esi
call fcn.100ab973
add esp, 0x14
jmp 0x100b4c96
push 0
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp esi, 0x102
jne 0x100d7102
push 2
mov edx, ebx
pop ecx
call fcn.100e652d
mov esi, 0x4000000
jmp 0x100b4c96
push 0x1002919c
push ebx
push eax
push esi
call fcn.100ab973
add esp, 0x10
jmp 0x100b4ca3
push 0x100291d8
push ebx
push eax
push esi
call fcn.100ab973
add esp, 0x10
jmp 0x100b4cb0
push 0x10029218
jmp 0x100d6fe1
mov edx, ebx
mov ecx, ebx
call fcn.100e652d
cmp dword [0x101dc370], 0
jne 0x100b4d1d
jmp 0x100b4cdc
push 0x10029248
push ebx
push eax
push esi
call fcn.100ab973
add esp, 0x10
jmp 0x100b4d2a
push 0x10029278
jmp 0x100d6fe1
push 0x100292a0
jmp 0x100d6fe1
push 0x100292b8
jmp 0x100d6fe1
push 0x100292f0
push ebx
push eax
push esi
call fcn.100ab973
add esp, 0x10
jmp 0x100b4d90
push 0x10029310
push ebx
push eax
push esi
call fcn.100ab973
add esp, 0x10
jmp 0x100b4d9d
push 0x1004ccf8
mov edx, 0x178
mov ecx, 0x1004ca54
call fcn.100e970f
mov esi, dword [0x101dcab0]
jmp 0x100b4dab
push 0x10029378
jmp 0x100d6feb
push 0x100293a0
jmp 0x100d6feb
push 0x100293cc
jmp 0x100d6feb
push 0x100293f4
jmp 0x100d6feb
push 0x1002941c
jmp 0x100d6feb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d721b
movzx eax, ax
or eax, 0x80070000
mov edi, eax
test eax, eax
js 0x100d7228
mov edi, 0x80004005
mov eax, edi
push 0x1002943c
jmp 0x100d723b
mov edi, 0x80004005
mov eax, edi
push 0x100294bc
push ebx
push eax
jmp 0x100d6fed
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d7254
movzx eax, ax
or eax, 0x80070000
mov edi, eax
test eax, eax
js 0x100d7261
mov edi, 0x80004005
mov eax, edi
push 0x10029464
jmp 0x100d723b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d727a
movzx eax, ax
or eax, 0x80070000
mov edi, eax
test eax, eax
js 0x100d7287
mov edi, 0x80004005
mov eax, edi
push 0x10029490
jmp 0x100d723b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100d72a0
movzx eax, ax
or eax, 0x80070000
mov edi, eax
test eax, eax
js 0x100d7236
jmp 0x100d722f
push 0x78
call fcn.100b84d0
pop ecx
test eax, eax
je 0x100d72bd
mov ecx, eax
call fcn.100e0788
jmp 0x100d72bf
mov eax, esi
mov dword [0x101de614], eax
test eax, eax
je 0x100b4e95
mov ecx, eax
mov dword [eax + 0x44], ebx
call fcn.100ed54a
jmp 0x100b4e95
push 0x100294e8
push ebx
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b4eb8
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101e07c0]
call esi
jmp 0x100b4edc
xor esi, esi
cmp dword [0x101dca10], 0
je 0x100d731f
call fcn.100b42f1
mov dword [0x101dca10], esi
cmp dword [0x101dc9c8], 0
je 0x100d7333
call fcn.100b4344
mov dword [0x101dc9c8], esi
cmp dword [0x101dc9f8], 0
je 0x100d7347
call fcn.100b4317
mov dword [0x101dc9f8], esi
cmp dword [0x101dc9b8], 0
je 0x100d735b
call fcn.100b42cb
mov dword [0x101dc9b8], esi
call fcn.100b441c
call fcn.100b422e
call fcn.1011e425
call fcn.100b4254
call fcn.100b422e
call fcn.1011e425
mov dword [0x101dc378], ebx
call fcn.100b352c
jmp 0x100b4f2c
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101e07c0]
call esi
jmp 0x100b4f38