Function at 0xf30960
Capabilities:
Get common file path
Get hostname
Query environment variable
Set environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0xa80]
sub rsp, 0xb80
mov rsi, r8
mov r12, rdx
mov rdi, rcx
xor ebx, ebx
lea r15, [0x00f45f80]
xor edx, edx
mov r8d, 0x15d8
mov rcx, r15
mov r13d, r9d
mov dword [rbp + 0xac8], ebx
mov dword [rbp + 0xac0], ebx
call fcn.00f2c8c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x00f47174], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [0x00f46490]
add eax, dword [0x00f47174]
mov ecx, eax
call fcn.00f2e4a8
lea rdx, [0x00f47178]
mov r8d, 0x105
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0xf30a10
mov byte [rsp + 0x4f], bl
mov ecx, ebx
lea rdx, [rsp + 0x40]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, 0xf
jb 0xf309f5
lea rcx, [rsp + 0x40]
call fcn.00f2cec4
jmp 0xf30a25
lea rcx, [0x00f47178]
mov dl, 0x5c
call fcn.00f2cf18
mov qword [0x00f47280], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.00f2fd88
mov qword [0x00f46048], rax
mov rcx, qword [rax]
call fcn.00f2fedc
test eax, eax
je 0xf30a52
mov dword [0x00f46150], 3
jmp 0xf30a66
call fcn.00f2fdd8
mov ecx, ebx
test eax, eax
setg cl
inc ecx
mov dword [0x00f46150], ecx
mov rdx, qword [0x00f46048]
mov eax, 0x80
mov qword [0x00f46158], rdi
mov dword [rbp + 0xac8], eax
mov dword [rbp + 0xac0], eax
mov rdx, qword [rdx]
lea rax, [rsp + 0x50]
lea r9, [rbp + 0xac8]
lea r8, [0x00f46050]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xac0]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [0x00f460d0]
mov qword [rsp + 0x20], rax
call qword [0x00f47870]
mov edi, 0x104
test r12, r12
je 0xf30acf
mov rdx, r12
jmp 0xf30ad7
test rsi, rsi
je 0xf30ae8
mov rdx, rsi
lea rcx, [0x00f46160]
mov r8, rdi
call fcn.00f2e318
jmp 0xf30aff
mov rcx, qword [0x00f46158]
lea rdx, [0x00f46160]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x00f46160]
mov dl, 0x5c
call fcn.00f2cf18
lea r12, [0x00f46024]
mov r8d, 0x20
mov rdx, rax
mov rcx, r12
call fcn.00f2e318
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [0x00f46160]
movsxd rdx, eax
mov byte [rdx + r15 + 0xa0], bl
lea rdx, [0x00f46264]
call fcn.00f2cf4c
lea rsi, [0x00f4638c]
lea r9, [0x00f46264]
lea rcx, [0x00f359ac]
mov rdx, rsi
mov r8d, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
call fcn.00f2d25c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
mov byte [rcx + r15 + 0x40b], bl
mov ecx, 0xe32
call fcn.00f2de0c
lea rcx, [0x00f3a07c]
mov r9, rsi
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rax
call fcn.00f2d25c
lea rcx, [rsp + 0x40]
call fcn.00f2def0
mov edx, 0xa
lea r9, [0x00f46490]
lea r8d, [rdx + 5]
lea rcx, [0x00f46368]
call fcn.00f2cff4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor r8d, r8d
mov rcx, r12
mov edx, eax
call fcn.00f2e684
lea rdx, [0x00f46e54]
mov ecx, eax
call fcn.00f31fac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.00f2ff60
mov byte [rsp + 0x4f], bl
mov edx, ebx
movsx ecx, al
lea r8, [rsp + 0x40]
mov dword [0x00f46e64], ecx
lea eax, [rdx + 0x41]
inc edx
mov byte [r8], al
inc r8
cmp edx, 0xe
jb 0xf30c24
lea rcx, [rsp + 0x40]
call fcn.00f2cec4
mov esi, 0x9c
xor edx, edx
mov r8d, esi
mov rcx, r15
call fcn.00f2c8c0
mov rcx, r15
mov dword [0x00f45f80], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00f473d0], rax
call fcn.00f30904
mov ecx, eax
mov dword [0x00f46020], eax
call fcn.00f30934
lea r15d, [rsi + 0x67]
lea rsi, [0x00f46e68]
mov rcx, rsi
mov edx, r15d
mov word [0x00f4601c], ax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rbp - 0x60]
lea rcx, str.SystemRoot
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0xf30cdb
lea rcx, str.SystemRoot
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, qword [0x00f48518]
lea r12, [0x00f46f6c]
mov r8d, r15d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, str.TEMP
test eax, eax
jne 0xf30d2f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, [0x00f359ac]
mov r9, rsi
mov r8d, edi
mov rdx, r12
call fcn.00f2d25c
mov rcx, qword [0x00f48518]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, qword [0x00f47ef0]
lea r12, [0x00f47070]
mov r8d, r15d
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0xf30d83
lea rax, str.TEMP
lea rcx, [0x00f359ac]
mov r9, rsi
mov r8d, edi
mov rdx, r12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.00f2d25c
mov rcx, qword [0x00f47ef0]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, [rsp + 0x60]
lea rcx, str.SystemDrive
mov r8d, 0x3f
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0xf30dd5
mov byte [rsp + 0x4f], bl
lea rdx, [rsp + 0x40]
lea eax, [rbx + 0x41]
inc ebx
mov byte [rdx], al
inc rdx
cmp ebx, 0xf
jb 0xf30da8
lea rcx, [rsp + 0x40]
call fcn.00f2cec4
lea rdx, [0x00f3a0d4]
lea rcx, str.SystemDrive
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdx, [rbp + 0xad8]
lea rcx, [0x00f473d8]
mov ebx, 0x7f
mov dword [rbp + 0xad8], ebx
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, [rbp + 0xad8]
lea rcx, [0x00f47458]
mov dword [rbp + 0xad8], ebx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [0x00f46e54]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [0x00f46e54]
xor r8d, r8d
mov edx, eax
call fcn.00f2e684
lea rdx, [rbp + 0xb0]
mov ecx, eax
call fcn.00f2e4a8
lea r8d, [rbx - 0x5f]
lea rdx, [0x00f47288]
lea rcx, [rbp + 0xb0]
call fcn.00f2e63c
lea r9, [rbp + 0xb0]
lea edx, [rbx - 0x6b]
lea r8d, [rbx - 0x61]
lea rcx, [0x00f472a8]
call fcn.00f2cff4
test r13b, 1
jne 0xf30e7c
call fcn.00f306a8
mov dword [0x00f472c8], eax
call fcn.00f2e24c
mov eax, 1
add rsp, 0xb80
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret