Function at 0x1009c480
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x65c
mov eax, dword [0x100db040]
xor eax, esp
mov dword [esp + 0x658], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x28], edi
cmp dword [edi + 4], 0
je 0x1009c820
cmp dword [edi + 0x10], 0
je 0x1009c4cd
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x658]
xor ecx, esp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
xor esi, esi
test byte [edi + 0x18], 0x10
je 0x1009c7f5
push 0x1000
call fcn.100a3b58
mov esi, eax
add esp, 4
test esi, esi
jne 0x1009c50b
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x658]
xor ecx, esp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov byte [esi], 0
test eax, eax
je 0x1009c537
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1354
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
lea eax, [esp + 0x260]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1009c592
lea eax, [esp + 0x260]
mov byte [esp + 0x65f], 0
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x400
lea eax, [esp + 0x264]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1009c644
lea ecx, [esp + 0x260]
mov byte [esp + 0x65f], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009c5c1
sub ecx, edx
lea eax, [esp + ecx + 0x25f]
lea ecx, [esp + 0x260]
cmp eax, ecx
jb 0x1009c602
nop dword [eax]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x1009c5ff
cmp cl, 0x2f
je 0x1009c5ff
cmp cl, 0x3a
je 0x1009c5ff
dec eax
lea ecx, [esp + 0x260]
cmp eax, ecx
jae 0x1009c5e0
jmp 0x1009c602
mov byte [eax], 0
lea ecx, [esp + 0x260]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1009c610
sub ecx, edx
je 0x1009c644
lea eax, [esp + 0x260]
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x260]
push 0x400
push eax
push str._NT_SYMBOL_PATH
call ebx
test eax, eax
je 0x1009c693
lea eax, [esp + 0x260]
mov byte [esp + 0x65f], 0
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x400
lea eax, [esp + 0x264]
push eax
push str._NT_ALTERNATE_SYMBOL_PATH
call ebx
test eax, eax
je 0x1009c6dc
lea eax, [esp + 0x260]
mov byte [esp + 0x65f], 0
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x400
lea eax, [esp + 0x264]
push eax
push str.SYSTEMROOT
call ebx
test eax, eax
je 0x1009c768
lea eax, [esp + 0x260]
mov byte [esp + 0x65f], 0
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
lea eax, [esp + 0x260]
push str._system32
push 0x400
push eax
call fcn.100a96ac
add esp, 0xc
lea eax, [esp + 0x260]
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push 0x100d1350
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
test byte [edi + 0x18], 0x20
je 0x1009c7f5
push 0x400
lea eax, [esp + 0x264]
push eax
push str.SYSTEMDRIVE
call ebx
test eax, eax
je 0x1009c7ee
push str.SRV
push 0x1000
push esi
mov byte [esp + 0x66b], 0
call fcn.100a96ac
add esp, 0xc
lea eax, [esp + 0x260]
push eax
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push str.websymbols
push 0x1000
push esi
call fcn.100a96ac
add esp, 0xc
push str.http:__msdl.microsoft.com_download_symbols_
push 0x1000
push esi
call fcn.100a96ac
mov ecx, dword [edi + 4]
add esp, 0xc
push esi
call fcn.1009ba50
mov ebx, eax
jmp 0x1009c804
push str.SRVc:websymbolshttp:__msdl.microsoft.com_download_symbols_
jmp 0x1009c7d3
mov ecx, dword [edi + 4]
push esi
call fcn.1009ba50
mov ebx, eax
test esi, esi
je 0x1009c80d
push esi
call fcn.100a40b3
add esp, 4
test ebx, ebx
jne 0x1009c842
mov eax, dword [edi]
mov ecx, edi
push ebx
push ebx
push ebx
push str.Error_while_initializing_dbghelp.dll
call dword [eax + 0x10]
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x658]
xor ecx, esp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xc]
xor ecx, ecx
mov dword [esp + 0x2c], eax
xor ebx, ebx
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], str.kernel32.dll
mov dword [esp + 0x34], str.tlhelp32.dll
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0x224
nop
push dword [esp + ebx*4 + 0x30]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x1009c8e0
push 0x100d1254
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Module32First
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Module32Next
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x1009c8d7
cmp dword [esp + 0x18], 0
je 0x1009c8d7
test eax, eax
jne 0x1009c94b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
inc ebx
mov dword [esp + 0x1c], esi
cmp ebx, 2
jb 0x1009c880
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
test esi, esi
je 0x1009c91e
mov ecx, dword [esp + 0x10]
push dword [esp + 0x2c]
push 8
call ecx
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x1009c951
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
call fcn.1009bdf0
test eax, eax
je 0x1009c936
mov dword [edi + 0x10], 1
mov ecx, dword [esp + 0x664]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100a0150
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
jmp 0x1009c906
lea ecx, [esp + 0x38]
mov dword [esp + 0x10], 0
push ecx
push eax
call dword [esp + 0x20]
test eax, eax
je 0x1009c9ae
mov edi, dword [esp + 0x14]
xor esi, esi
nop dword [eax]
push dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x28]
cdq
push edx
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x168]
push eax
push dword [esp + 0x34]
call fcn.1009bfe0
lea eax, [esp + 0x38]
inc esi
push eax
push edi
call ebx
test eax, eax
jne 0x1009c970
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x10], 0
jle 0x1009c91e
mov eax, 1
jmp 0x1009c92f