Function at 0x10072f30
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100731ed
cmp word [0x100ebf80], 0
push esi
push edi
jne 0x10073102
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x208
push 0x100ebf80
push str.SystemRoot
call edi
mov ecx, 0x100ebf80
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10072f70
mov esi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100ebf7e], 0x5c
je 0x10072fa4
push 0x100a21f4
push 0x208
push 0x100ebf80
call esi
add esp, 0xc
push 0x208
push 0x100ec390
push str.ProgramFiles
call edi
mov ecx, 0x100ec390
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10072fc0
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100ec38e], 0x5c
je 0x10072fee
push 0x100a21f4
push 0x208
push 0x100ec390
call esi
add esp, 0xc
push 0x208
push 0x100ec7a0
push str.windir
call edi
mov ecx, 0x100ec7a0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10073007
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100ec79e], 0x5c
je 0x10073035
push 0x100a21f4
push 0x208
push 0x100ec7a0
call esi
add esp, 0xc
mov edi, dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x100ebf80
push 0x208
push 0x100ecbb0
call edi
push 0x100ebf80
push 0x208
push 0x100ecfc0
call edi
push 0x100ebf80
push 0x208
push 0x100ed3d0
call edi
add esp, 0x24
push 0x208
push 0x100ed7e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x100ed7e0
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10073090
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x100ed7de], 0x5c
je 0x100730be
push 0x100a21f4
push 0x208
push 0x100ed7e0
call esi
add esp, 0xc
push 0x100ed7e0
push 0x208
push 0x100edbf0
call edi
mov ecx, 0x100edbf0
add esp, 0xc
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100730e0
sub ecx, edx
sar ecx, 1
xor eax, eax
mov dword [ecx*2 + 0x100edbea], 0x5c
mov word [0x100ee000], ax
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll__wcsnicmp]
xor esi, esi
jmp 0x10073110
mov edx, dword [esi*4 + 0x100e7e98]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10073120
sub eax, edi
mov edi, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x10073150
inc esi
cmp esi, 9
jb 0x10073110
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi*4 + 0x100e7e98]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10073160
sub ecx, edx
sar ecx, 1
imul esi, esi, 0x410
lea ebx, [esi + 0x100ebf80]
mov edx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10073180
sub edx, esi
mov esi, edi
sar edx, 1
lea eax, [esi + 2]
mov dword [ebp - 4], eax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10073197
sub esi, dword [ebp - 4]
sar esi, 1
sub esi, ecx
lea eax, [esi*2 + 2]
mov esi, dword [sym.imp.MSVCR110.dll_memmove]
push eax
lea eax, [edi + ecx*2]
push eax
lea eax, [edi + edx*2]
push eax
call esi
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100731d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push edi
call esi
add esp, 0xc
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret