Function at 0x102b777
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x424], eax
mov eax, dword [0x1077004]
mov esi, 0x1077004
cmp eax, esi
je 0x102b7c7
test dword [eax + 0x1c], 0x100
je 0x102b7c7
cmp byte [eax + 0x19], 4
jb 0x102b7c7
push 0x10075a0
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
and dword [ebp - 0x420], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor ecx, ecx
test eax, eax
setge cl
xor eax, eax
mov ebx, 0x80070000
mov edi, 0x104
mov dword [ebp - 0x428], ecx
cmp ax, word [0x1079140]
jne 0x102b850
push edi
push 0x1079140
push str._windir__system32wfs.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x102b850
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102b81e
and eax, 0xffff
or eax, ebx
mov ecx, eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x102b850
test dword [eax + 0x1c], 0x100
je 0x102b850
cmp byte [eax + 0x19], 2
jb 0x102b850
push ecx
push 0x1007840
push 0x10075a0
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x418]
push eax
push 0x10108a4
push 1
push 0
push 0x10108c4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x102b9b3
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x41c], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x41c]
push edx
push 0x1007830
push eax
call dword [ecx]
test eax, eax
jl 0x102b9a5
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax]
push 0
push dword [ebp - 0x424]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x102b999
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
add esp, 0x18
push 4
push 0
push edi
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jl 0x102b999
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x102b973
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102b93e
and eax, 0xffff
or eax, ebx
mov esi, eax
mov eax, dword [0x1077004]
cmp eax, 0x1077004
je 0x102b973
test dword [eax + 0x1c], 0x100
je 0x102b973
cmp byte [eax + 0x19], 2
jb 0x102b973
push esi
push 0x10077e0
push 0x10075a0
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ea0b
test esi, esi
jl 0x102b999
lea eax, [ebp - 0x414]
push 0x1079140
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x102b999
mov dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x102b9e4
mov ecx, dword [0x1077004]
cmp ecx, esi
je 0x102b9e4
test dword [ecx + 0x1c], 0x100
je 0x102b9e4
cmp byte [ecx + 0x19], 2
jb 0x102b9e4
push eax
push 0x1007778
push 0x10075a0
push 0x41
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101ea0b
cmp dword [ebp - 0x428], 0
pop edi
pop esi
pop ebx
je 0x102b9f6
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
xor ecx, ebp
call fcn.0101d9bb
leave
ret 4