Function at 0x1001a6f0
Capabilities:
Inspect section memory permissions
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x10086084]
xor eax, esp
mov dword [esp + 0x270], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x1c]
push edi
mov dword [esp + 0x30], eax
xor eax, eax
push 0x208
push eax
lea eax, [esp + 0x78]
mov dword [esp + 0x20], esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0xc
xor ecx, ecx
mov dword [esp + 0x34], eax
mov edi, eax
mov dword [esp + 0x28], eax
inc ecx
mov dword [esp + 0x10], edi
push eax
mov ebx, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x30]
xor ecx, ecx
test eax, eax
je 0x1001a782
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1001b1ac
cmp word [eax], cx
je 0x1001b1ac
test dword [esp + 0x14], 0x1000
jne 0x1001a7e1
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x74]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1001b1ac
cmp word [esp + 0x70], bx
je 0x1001b1ac
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1001b1ac
xor ecx, ecx
cmp word [eax], cx
je 0x1001b1ac
push 0x208
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
test ebx, ebx
jne 0x1001a807
push 0xe
mov ebx, eax
pop esi
jmp 0x1001b181
push 0x208
push eax
push ebx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x48]
add esp, 0xc
mov dword [ebx], 0xfeedf001
test edx, edx
jns 0x1001a836
mov ecx, ebx
call fcn.10030ba6
or eax, 0x80000000
mov dword [ebx + 0x194], eax
mov eax, edx
and eax, 0x40000000
mov dword [esp + 0x4c], eax
je 0x1001a85d
mov ecx, ebx
mov dword [esp + 0x1c], 1
call fcn.10030ba6
or eax, 0xc0000000
mov dword [ebx + 0x194], eax
test edx, 0x20000000
je 0x1001a884
mov ecx, ebx
call fcn.10030ba6
mov ecx, dword [esp + 0x14]
or eax, 0x20000000
or ecx, 0x40
mov dword [ebx + 0x194], eax
mov dword [esp + 0x14], ecx
jmp 0x1001a888
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
sub eax, 1
je 0x1001a8e4
sub eax, 1
je 0x1001a8d8
sub eax, 1
je 0x1001a8cc
sub eax, 1
je 0x1001a8c0
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1001b195
mov dword [ebx + 0x19c], 4
jmp 0x1001a8ee
mov dword [ebx + 0x19c], 3
jmp 0x1001a8ee
mov dword [ebx + 0x19c], 2
jmp 0x1001a8ee
mov dword [ebx + 0x19c], 1
test ecx, 0xdfffcfbd
je 0x1001a8fe
push 0x57
pop esi
jmp 0x1001b1bf
test cl, 2
je 0x1001a918
mov ecx, ebx
call fcn.10030c79
or eax, 2
mov edx, eax
call fcn.10030ca3
mov ecx, dword [esp + 0x14]
test cl, 0x40
je 0x1001a932
mov ecx, ebx
call fcn.10030c79
or eax, 0x40
mov edx, eax
call fcn.10030ca3
mov ecx, dword [esp + 0x14]
mov eax, ecx
and eax, 0x20000000
mov dword [esp + 0x40], eax
je 0x1001a95a
mov ecx, ebx
call fcn.10030c79
or eax, 0x20000000
mov edx, eax
call fcn.10030ca3
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
test ecx, 0x2000
je 0x1001a969
push 4
pop esi
mov dword [esp + 0x18], esi
cmp esi, 2
jbe 0x1001a981
cmp esi, 3
je 0x1001a9a6
cmp esi, 4
je 0x1001a9a1
cmp esi, 7
jne 0x1001a8f6
mov edx, esi
mov ecx, ebx
call fcn.10030df6
test dword [esp + 0x14], 0x1000
je 0x1001a9b2
mov esi, dword [esp + 0x24]
mov ecx, esi
call fcn.10036382
jmp 0x1001a9c4
push 7
pop edx
jmp 0x1001a983
test eax, eax
je 0x1001a8f6
push 3
jmp 0x1001a9a3
xor eax, eax
lea ecx, [esp + 0x70]
push eax
xor edx, edx
call fcn.1003670e
mov esi, dword [esp + 0x24]
mov ecx, ebx
mov edx, eax
call fcn.10030a0e
test eax, eax
je 0x1001a9d7
mov dword [eax + 0x1d4], edx
mov ecx, ebx
call fcn.10030b0c
test eax, eax
jne 0x1001a9ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1001b1bb
or edx, 0xffffffff
mov ecx, ebx
call fcn.100310cb
push dword [0x100866bc]
push dword [0x100866b8]
call fcn.10021e9a
test eax, eax
je 0x1001a9e2
mov ecx, ebx
call fcn.100310a3
cmp eax, 0xffffffff
je 0x1001a9e2
mov eax, dword [esp + 0x2c]
push 3
pop ecx
cmp eax, ecx
jne 0x1001aa35
mov dword [ebx + 0x19c], ecx
mov dword [esp + 0x28], 1
jmp 0x1001aa78
cmp eax, 4
jne 0x1001aa64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001aa64
xor eax, eax
mov dword [ebx + 0x19c], 3
push eax
mov dword [esp + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1001aa78
xor eax, eax
mov dword [ebx + 0x19c], 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], eax
mov ecx, ebx
call fcn.10026b6d
test eax, eax
je 0x1001a9e2
call fcn.1003a815
mov dword [ebx + 0x1b4], eax
mov ecx, ebx
push dword [0x100866bc]
push dword [0x100866b8]
call fcn.10031dfb
cmp dword [esp + 0x38], edi
je 0x1001aed5
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
cmp dword [esp + 0x1c], eax
jne 0x1001aac9
xor edx, edx
mov ecx, ebx
inc edx
call fcn.10030f59
mov ecx, ebx
call fcn.100310a3
lea edx, [esp + 0x40]
mov ecx, eax
call fcn.1001a63f
test eax, eax
jne 0x1001aaf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x1001aaf6
push 0xd
pop edi
mov dword [esp + 0x10], edi
cmp dword [esp + 0x1c], 0
je 0x1001ab20
test edi, edi
jne 0x1001ab8c
mov ecx, ebx
call fcn.10030c79
test al, 0x40
je 0x1001ab24
call fcn.100310a3
mov ecx, eax
call fcn.10021de0
mov dword [esp + 0x20], eax
test edi, edi
jne 0x1001ab8c
mov edx, dword [esp + 0x20]
mov ecx, ebx
call fcn.100218a3
test eax, eax
jne 0x1001ab71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jg 0x1001ab45
jmp 0x1001ab4d
movzx eax, di
or eax, 0x80070000
push 0x1aa
push 0x100044cc
push eax
push 0x100044e8
mov ecx, ebx
call fcn.10030b0c
xor ecx, ecx
xor edx, edx
push eax
inc ecx
call fcn.1002fae3
jmp 0x1001ab8c
mov ecx, ebx
call fcn.10031cf2
test byte [eax + 0x10], 8
je 0x1001ab8c
cmp dword [esp + 0x4c], 0
je 0x1001ab8c
push 5
pop edi
mov dword [esp + 0x10], edi
cmp dword [esp + 0x1c], 0
je 0x1001ac0c
test edi, edi
jne 0x1001ac69
mov ecx, ebx
call fcn.10030c79
test al, 0x40
je 0x1001ac14
call fcn.10031cf2
test byte [eax + 0x10], 0x40
je 0x1001ac14
cmp dword [esp + 0x20], edi
je 0x1001abc3
call fcn.100310a3
mov ecx, eax
call fcn.10021e65
xor edx, edx
mov ecx, ebx
inc edx
call fcn.10030f59
push ebx
call sym.WIMGAPI.DLL_WIMCloseHandle
xor eax, eax
mov ecx, esi
mov ebx, eax
call fcn.1001cb44
mov esi, eax
test esi, esi
jne 0x1001b181
mov eax, dword [esp + 0x30]
push eax
push dword [esp + 0x1c]
mov eax, dword [esp + 0x44]
push dword [esp + 0x1c]
push dword [esp + 0x38]
push eax
push dword [esp + 0x38]
call sym.WIMGAPI.DLL_WIMCreateFile
jmp 0x1001b195
test edi, edi
jne 0x1001ae98
mov ecx, ebx
call fcn.10038c06
test eax, eax
je 0x1001ac50
mov ecx, ebx
call fcn.10039229
test eax, eax
je 0x1001ac50
mov ecx, ebx
call fcn.10030ba6
test eax, eax
jns 0x1001ac43
call fcn.10022104
test eax, eax
jne 0x1001ac43
push 0xd
pop edi
jmp 0x1001ac65
mov ecx, ebx
call fcn.10022397
test eax, eax
jne 0x1001ac69
jmp 0x1001ac3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x1001ac69
mov edi, 0x570
mov dword [esp + 0x10], edi
cmp dword [esp + 0x1c], 0
je 0x1001ace4
test edi, edi
jne 0x1001ae98
mov ecx, ebx
call fcn.10030c79
test al, 0x40
je 0x1001acec
call fcn.10031cf2
mov esi, dword [eax + 0x10]
or esi, 0x40
call fcn.10031cf2
mov edx, dword [esp + 0x20]
mov dword [eax + 0x10], esi
call fcn.10021d14
test eax, eax
je 0x1001acb8
mov ecx, ebx
call fcn.10030eb9
or eax, 8
mov ecx, ebx
mov edx, eax
call fcn.10030eeb
jmp 0x1001accf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x1001accf
push 0xe
pop edi
mov dword [esp + 0x10], edi
mov ecx, ebx
call fcn.10031cf2
mov esi, dword [eax + 0x10]
and esi, 0xffffffbf
call fcn.10031cf2
mov dword [eax + 0x10], esi
test edi, edi
jne 0x1001ae98
mov ecx, ebx
call fcn.10031cf2
mov esi, eax
call fcn.10031cf2
mov edx, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
add edx, dword [eax + 0x40]
adc ecx, dword [eax + 0x44]
push ecx
push edx
mov ecx, ebx
call fcn.10031b39
push dword [0x100866bc]
xor edx, edx
mov ecx, ebx
push dword [0x100866b8]
call fcn.10031ade
mov ecx, ebx
mov edi, eax
mov esi, edx
call fcn.10031cf2
cmp dword [eax + 0x84], esi
jl 0x1001ad87
jg 0x1001ad41
cmp dword [eax + 0x80], edi
jb 0x1001ad87
mov ecx, ebx
call fcn.10031cf2
mov ecx, eax
mov eax, dword [ecx + 0x88]
or eax, dword [ecx + 0x8c]
je 0x1001ad87
mov ecx, ebx
call fcn.10031cf2
mov esi, eax
call fcn.10031cf2
mov edx, dword [esi + 0x88]
mov ecx, dword [esi + 0x8c]
add edx, dword [eax + 0x80]
adc ecx, dword [eax + 0x84]
push ecx
push edx
mov ecx, ebx
call fcn.10031b39
push dword [0x100866bc]
xor edx, edx
mov ecx, ebx
push dword [0x100866b8]
call fcn.10031ade
mov ecx, ebx
mov edi, eax
mov esi, edx
call fcn.10031cf2
cmp dword [eax + 0x10c], esi
jl 0x1001adff
jg 0x1001adb9
cmp dword [eax + 0x108], edi
jb 0x1001adff
mov ecx, ebx
call fcn.10031cf2
mov ecx, eax
mov eax, dword [ecx + 0x110]
or eax, dword [ecx + 0x114]
je 0x1001adff
mov ecx, ebx
call fcn.10031cf2
mov esi, eax
call fcn.10031cf2
mov edx, dword [esi + 0x110]
mov ecx, dword [esi + 0x114]
add edx, dword [eax + 0x108]
adc ecx, dword [eax + 0x10c]
push ecx
push edx
mov ecx, ebx
call fcn.10031b39
push dword [0x100866bc]
xor edx, edx
mov ecx, ebx
push dword [0x100866b8]
call fcn.10031ade
push edx
push eax
mov ecx, ebx
call fcn.10031dfb
mov ecx, ebx
call fcn.10030eb9
test eax, 0x100
je 0x1001ae3d
mov ecx, ebx
call fcn.10031cf2
push dword [eax + 0x44]
push dword [eax + 0x40]
call fcn.10031b39
cmp dword [esp + 0x1c], 0
je 0x1001ae98
mov ecx, ebx
call fcn.10031dd9
push edx
push eax
push ecx
call fcn.100310a3
mov ecx, eax
call fcn.10014099
mov ecx, ebx
call fcn.100310a3
mov ecx, eax
call fcn.100140fb
push dword [0x100866bc]
xor edx, edx
mov ecx, ebx
push dword [0x100866b8]
call fcn.10031ade
push edx
push eax
push ecx
mov ecx, ebx
call fcn.100310a3
mov ecx, eax
call fcn.10014099
push 0x10
pop edx
mov ecx, ebx
call fcn.10030f59
cmp dword [esp + 0x20], 0
je 0x1001aead
mov ecx, ebx
call fcn.100310a3
mov ecx, eax
call fcn.10021e65
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x1001b1bf
mov ecx, ebx
call fcn.10031cf2
test dword [eax + 0x10], 0x40000
je 0x1001b0ed
push 2
pop edx
jmp 0x1001b134
mov esi, dword [0x10004518]
mov ecx, ebx
mov edi, dword [0x1000451c]
call fcn.10031cf2
mov dword [eax], esi
mov dword [eax + 4], edi
call fcn.10031cf2
mov dword [eax + 8], 0xd0
call fcn.10030c79
test eax, 0x20000000
je 0x1001af13
call fcn.10031cf2
mov dword [eax + 0xc], 0xe00
jmp 0x1001af1f
call fcn.10031cf2
mov dword [eax + 0xc], 0x10d00
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x1001b0bb
sub eax, 1
je 0x1001b09d
sub eax, 1
je 0x1001b06d
sub eax, 1
je 0x1001b03d
sub eax, 3
jne 0x1001af79
mov ecx, ebx
call fcn.10031cf2
or dword [eax + 0x10], 2
call fcn.10031cf2
push 7
or dword [eax + 0x10], 0x200000
pop edx
mov ecx, ebx
call fcn.10030df6
call fcn.10031cf2
mov dword [eax + 0x14], 0x8000
xor esi, esi
inc esi
push 8
pop ecx
xor eax, eax
lea edi, [esp + 0x50]
mov dword [esp + 0x18], eax
rep stosd dword es:[edi], eax
push 0x10
lea eax, [esp + 0x54]
push eax
push 0x10004520
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x1001afd4
cmp eax, 0x10
ja 0x1001afd4
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x54]
push 0x10004540
push eax
call dword [sym.imp.msvcrt.dll_swscanf_s]
add esp, 0xc
test eax, eax
jle 0x1001afd4
mov ecx, ebx
call fcn.10031cf2
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x14], ecx
mov ecx, ebx
call fcn.10031cf2
mov word [eax + 0x2a], si
call fcn.10031cf2
mov word [eax + 0x28], si
call fcn.10031cf2
add eax, 0x18
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov esi, eax
test esi, esi
jne 0x1001b019
xor edx, edx
mov ecx, ebx
call fcn.10021d14
test eax, eax
jne 0x1001b019
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1001b019
push 0xe
pop esi
mov ecx, ebx
call fcn.10031cf2
xor ecx, ecx
push ecx
mov ecx, ebx
mov eax, dword [eax + 8]
push eax
call fcn.10031b39
push 0x10
pop edx
mov ecx, ebx
call fcn.10030f59
jmp 0x1001aeb1
mov ecx, ebx
call fcn.10031cf2
or dword [eax + 0x10], 2
call fcn.10031cf2
push 7
pop edx
or dword [eax + 0x10], 0x200000
call fcn.10030df6
call fcn.10031cf2
mov dword [eax + 0x14], 0x1000
jmp 0x1001af79
mov ecx, ebx
call fcn.10031cf2
or dword [eax + 0x10], 2
call fcn.10031cf2
push 3
pop edx
or dword [eax + 0x10], 0x80000
call fcn.10030df6
call fcn.10031cf2
mov dword [eax + 0x14], 0x20000
jmp 0x1001af79
mov ecx, ebx
call fcn.10031cf2
or dword [eax + 0x10], 2
call fcn.10031cf2
push 2
or dword [eax + 0x10], 0x40000
jmp 0x1001af65
mov ecx, ebx
call fcn.10031cf2
or dword [eax + 0x10], 2
call fcn.10031cf2
xor esi, esi
inc esi
mov edx, esi
or dword [eax + 0x10], 0x20000
call fcn.10030df6
call fcn.10031cf2
mov dword [eax + 0x14], 0x8000
jmp 0x1001af7c
call fcn.10031cf2
mov ecx, ebx
test dword [eax + 0x10], 0x20000
je 0x1001b104
xor eax, eax
lea edx, [eax + 1]
jmp 0x1001b134
call fcn.10031cf2
mov ecx, ebx
test dword [eax + 0x10], 0x200000
je 0x1001b11b
push 7
jmp 0x1001aecf
call fcn.10031cf2
mov ecx, ebx
test dword [eax + 0x10], 0x80000
je 0x1001b132
push 3
jmp 0x1001aecf
xor edx, edx
call fcn.10030df6
mov ecx, ebx
call fcn.10031cf2
mov edi, 0xfeedf001
movzx eax, word [eax + 0x28]
cmp dword [ebx], edi
jne 0x1001b154
mov word [ebx + 0x1b0], ax
mov ecx, ebx
call fcn.10031cf2
movzx eax, word [eax + 0x2a]
cmp dword [ebx], edi
jne 0x1001b16a
mov word [ebx + 0x1b2], ax
mov edx, ebx
mov ecx, ebx
call fcn.10031a31
mov eax, dword [esp + 0x30]
test eax, eax
je 0x1001b181
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov edx, esi
lea ecx, [esp + 0x70]
call fcn.1002fbdc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1001b1bf
push 0x57
pop esi
test esi, esi
je 0x1001b173
test ebx, ebx
je 0x1001b181
xor eax, eax
mov ecx, ebx
lea edx, [eax + 1]
call fcn.10030f59
push ebx
call sym.WIMGAPI.DLL_WIMCloseHandle
xor eax, eax
mov ebx, eax
jmp 0x1001b181