Function at 0x1002b0e0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x1002b39d
cmp word [0x1004be98], 0
push esi
push edi
jne 0x1002b2b2
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x104
push 0x1004be98
push str.SystemRoot
call edi
mov ecx, 0x1004be98
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b120
mov esi, dword [sym.imp.MSVCR110.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1004be96], 0x5c
je 0x1002b154
push 0x10035d40
push 0x104
push 0x1004be98
call esi
add esp, 0xc
push 0x104
push 0x1004c0a0
push str.ProgramFiles
call edi
mov ecx, 0x1004c0a0
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b170
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1004c09e], 0x5c
je 0x1002b19e
push 0x10035d40
push 0x104
push 0x1004c0a0
call esi
add esp, 0xc
push 0x104
push 0x1004c2a8
push str.windir
call edi
mov ecx, 0x1004c2a8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b1b7
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1004c2a6], 0x5c
je 0x1002b1e5
push 0x10035d40
push 0x104
push 0x1004c2a8
call esi
add esp, 0xc
mov edi, dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x1004be98
push 0x104
push 0x1004c4b0
call edi
push 0x1004be98
push 0x104
push 0x1004c6b8
call edi
push 0x1004be98
push 0x104
push 0x1004c8c0
call edi
add esp, 0x24
push 0x104
push 0x1004cac8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x1004cac8
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b240
sub ecx, edx
sar ecx, 1
cmp word [ecx*2 + 0x1004cac6], 0x5c
je 0x1002b26e
push 0x10035d40
push 0x104
push 0x1004cac8
call esi
add esp, 0xc
push 0x1004cac8
push 0x104
push 0x1004ccd0
call edi
mov ecx, 0x1004ccd0
add esp, 0xc
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b290
sub ecx, edx
sar ecx, 1
xor eax, eax
mov dword [ecx*2 + 0x1004ccca], 0x5c
mov word [0x1004ced8], ax
push ebx
mov ebx, dword [sym.imp.MSVCR110.dll__wcsnicmp]
xor esi, esi
jmp 0x1002b2c0
mov edx, dword [esi*4 + 0x10047f20]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002b2d0
sub eax, edi
mov edi, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x1002b300
inc esi
cmp esi, 9
jb 0x1002b2c0
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi*4 + 0x10047f20]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b310
sub ecx, edx
sar ecx, 1
imul esi, esi, 0x208
lea ebx, [esi + 0x1004be98]
mov edx, ebx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002b330
sub edx, esi
mov esi, edi
sar edx, 1
lea eax, [esi + 2]
mov dword [ebp - 4], eax
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002b347
sub esi, dword [ebp - 4]
sar esi, 1
sub esi, ecx
lea eax, [esi*2 + 2]
mov esi, dword [sym.imp.MSVCR110.dll_memmove]
push eax
lea eax, [edi + ecx*2]
push eax
lea eax, [edi + edx*2]
push eax
call esi
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002b380
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push edi
call esi
add esp, 0xc
pop ebx
pop edi
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret