Function at 0x1034a73
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8b4
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
xor esi, esi
mov dword [ebp - 0x89c], ebx
mov dword [ebp - 0x8ac], ebx
mov dword [ebp - 0x8b0], ebx
mov dword [section..data], 0x195
cmp dword [0x104e1a0], ebx
jne 0x1034e35
mov eax, dword [0x104e188]
cmp dword [eax + 0x2c], ebx
jne 0x1034e35
cmp dword [eax + 0x48], ebx
jne 0x1034ad6
cmp dword [eax + 0xd0], 9
jne 0x1034e35
push edi
mov esi, 0x894
push esi
lea eax, [ebp - 0x898]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x208
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x898], esi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov dword [ebp - 0x8a4], eax
test eax, eax
jne 0x1034b39
mov esi, 0x8007000e
push esi
push 0x2ec
push 0x10090ac
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x1034e07
push edi
push 0
call ebx
push eax
call esi
mov dword [ebp - 0x8a0], eax
test eax, eax
jne 0x1034b6f
mov esi, 0x8007000e
push esi
push 0x2ed
push 0x10090ac
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x1034ded
push edi
push 0
call ebx
push eax
call esi
mov dword [ebp - 0x8a8], eax
test eax, eax
jne 0x1034b91
mov esi, 0x8007000e
push esi
push 0x2ee
jmp 0x1034dbf
mov edi, 0x104
push edi
push eax
xor ecx, ecx
push 0x100906c
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1034bd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1034bc0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x1034bd1
push esi
push 0x2f8
jmp 0x1034dbf
push dword [ebp - 0x8a8]
lea eax, [ebp - 0x610]
push edi
push eax
call fcn.0100d999
mov esi, eax
test esi, esi
jge 0x1034bf5
push esi
push 0x301
jmp 0x1034dbf
push 0x80
lea eax, [ebp - 0x810]
push eax
push 0x89
call fcn.010301ce
mov esi, eax
test esi, esi
jge 0x1034c1c
push esi
push 0x30a
jmp 0x1034dbf
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x898]
push eax
push 0
push 0x1009044
call sub.wer.dll_WerReportCreate
mov esi, eax
test esi, esi
jge 0x1034c47
push esi
push 0x30d
jmp 0x1034dbf
push dword [ebp - 0x89c]
call fcn.01034088
mov esi, eax
test esi, esi
jge 0x1034c63
push esi
push 0x313
jmp 0x1034dbf
push dword [ebp - 0x8a0]
call fcn.0102ff81
mov esi, eax
test esi, esi
jge 0x1034c7f
push esi
push 0x316
jmp 0x1034dbf
lea eax, [ebp - 0x8b0]
push eax
push edi
push dword [ebp - 0x8a0]
call fcn.0101420b
mov esi, eax
test esi, esi
jge 0x1034ca3
push esi
push 0x31c
jmp 0x1034dbf
mov eax, dword [ebp - 0x8b0]
cmp eax, 4
jae 0x1034cbe
mov esi, 0x80004005
push esi
push 0x320
jmp 0x1034dbf
mov ecx, dword [ebp - 0x8a0]
push 0x63
pop edx
push 0x61
mov word [ecx + eax*2 - 6], dx
pop edx
push 0x62
mov word [ecx + eax*2 - 4], dx
pop edx
mov word [ecx + eax*2 - 2], dx
lea eax, [ebp - 0x8ac]
push eax
push dword [ebp - 0x8a4]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1034db4
cmp eax, edi
ja 0x1034db4
mov eax, dword [ebp - 0x8ac]
cmp eax, dword [ebp - 0x8a4]
jbe 0x1034db4
xor edi, edi
xor ecx, ecx
inc edi
push edi
push ecx
mov word [eax - 2], cx
call fcn.01032bfb
mov esi, eax
test esi, esi
jge 0x1034d3f
push esi
push 0x338
push 0x10090ac
push 0x100189c
push edi
jmp 0x1034dcb
push 0
push dword [0x104e198]
push dword [ebp - 0x8ac]
push dword [ebp - 0x8a4]
call fcn.0102f2c7
mov esi, eax
test esi, esi
jge 0x1034d66
push esi
push 0x33b
jmp 0x1034d2f
push 3
push 5
push dword [ebp - 0x8a0]
push dword [ebp - 0x89c]
call sub.wer.dll_WerReportAddFile
mov esi, eax
test esi, esi
jge 0x1034d89
push esi
push 0x342
jmp 0x1034d2f
lea eax, [ebp - 0x8b4]
push eax
push 4
push edi
push dword [ebp - 0x89c]
call sub.wer.dll_WerReportSubmit
mov esi, eax
test esi, esi
jge 0x1034dac
push esi
push 0x345
jmp 0x1034d2f
mov dword [0x104e1a0], edi
jmp 0x1034dd3
mov esi, 0x80028016
push esi
push 0x32e
push 0x10090ac
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
cmp dword [ebp - 0x8a8], 0
je 0x1034ded
push dword [ebp - 0x8a8]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x8a0], 0
je 0x1034e07
push dword [ebp - 0x8a0]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
cmp dword [ebp - 0x8a4], edi
je 0x1034e21
push dword [ebp - 0x8a4]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x89c], edi
pop edi
je 0x1034e35
push dword [ebp - 0x89c]
call sub.wer.dll_WerReportCloseHandle
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret