Function at 0x10007350
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x420
mov eax, 0x100dfc10
call fcn.10001b03
mov ebx, ecx
cmp dword [0x101827b4], 0
jne 0x100075a0
push 0x10181ce0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [0x101827b4], 0
jne 0x10007595
push ecx
lea ecx, [ebp - 0x42c]
call fcn.10001e94
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
test eax, eax
jle 0x100073b7
cmp eax, edi
jb 0x100073cb
push 0xffffffffffffffff
push 0x100fef24
lea eax, [ebp - 0x218]
push edi
push eax
call esi
add esp, 0x10
push edi
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x1000740f
cmp eax, edi
jae 0x1000740f
lea esi, [ebp + eax - 0x115]
cmp byte [esi], 0x5c
je 0x1000740c
lea eax, [ebp - 0x114]
cmp esi, eax
jbe 0x10007407
cmp byte [esi], 0x2e
jne 0x10007401
mov byte [esi], 0
dec esi
cmp byte [esi], 0x5c
jne 0x100073ef
cmp byte [esi], 0x5c
jne 0x10007429
inc esi
jmp 0x10007429
push 0xffffffffffffffff
push 0x100fef50
lea eax, [ebp - 0x114]
push edi
push eax
call esi
add esp, 0x10
lea esi, [ebp - 0x114]
push edi
lea eax, [ebp - 0x420]
push eax
push str.APP_POOL_ID
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
cmp dword [0x10181be0], 0
mov edi, eax
push 4
je 0x10007451
pop ecx
call fcn.10047e8b
jmp 0x10007458
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
test eax, eax
je 0x1000746b
mov dword [eax], 0x10181f8c
lock inc dword [0x10181f80]
jmp 0x1000746d
xor eax, eax
lea ecx, [ebp - 0x218]
mov dword [0x101827b4], eax
push ecx
mov ecx, eax
call fcn.10047e8b
test esi, esi
lea ecx, [ebp - 0x424]
mov eax, 0x100ee700
cmovne eax, esi
push eax
call fcn.10047e8b
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x424]
mov ecx, dword [0x101827b4]
push dword [esi - 4]
mov eax, dword [ecx]
push esi
push 0
push dword [eax - 4]
call fcn.10047e8b
lea ecx, [esi - 0xc]
mov byte [ebp - 4], 0
call sym.fpsrvutl.dll_Ordinal_5727
mov ecx, dword [0x101827b4]
push 0
mov eax, dword [ecx]
push dword [eax - 4]
push eax
call sym.fpsrvutl.dll_Ordinal_1496
test edi, edi
je 0x10007525
cmp edi, 0x104
je 0x10007525
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x424]
call sym.fpsrvutl.dll_Ordinal_150
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x424]
mov ecx, dword [0x101827b4]
push dword [eax - 4]
mov edx, dword [ecx]
push eax
push 0
push dword [edx - 4]
call fcn.10047e8b
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
push str..log
lea ecx, [ebp - 0x428]
call fcn.10047e8b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x428]
mov eax, dword [ebp - 0x428]
push 0
push dword [eax - 4]
push eax
call sym.fpsrvutl.dll_Ordinal_1496
mov eax, dword [ebp - 0x428]
mov ecx, dword [0x101827b4]
push dword [eax - 4]
push eax
mov eax, dword [ecx]
push 0
push dword [eax - 4]
call fcn.10047e8b
mov eax, dword [ebx]
push str.Microsoft_SharePoint_Foundation_log_file
push 3
push ebx
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x428]
add esp, 0xc
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
lea ecx, [ebp - 0x42c]
call fcn.10002232
push 0x10181ce0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10001b39
ret