Function at 0x100c02ff
Capabilities:
Query environment variable

Disassembly:
push 0x524
mov eax, 0x100f88bc
call fcn.100cca34
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100c05c3
push 0x104
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x51c], 7
mov word [ebp - 0x530], ax
mov dword [ebp - 4], ecx
mov eax, 0xbe06
mov dword [ebp - 0x518], 0xbe7d
mov word [ebp - 0x514], ax
push 0x2c
lea edx, [eax + 0x49]
mov word [ebp - 0x512], dx
lea ebx, [eax + 0x46]
mov word [ebp - 0x510], bx
lea ecx, [edx - 0xa]
add eax, 0x33
lea esi, [edx + 1]
mov word [ebp - 0x50e], ax
lea edi, [ebx - 3]
mov word [ebp - 0x50c], cx
mov word [ebp - 0x50a], ax
lea eax, [edx - 7]
mov word [ebp - 0x508], bx
mov word [ebp - 0x506], ax
add eax, 0xfffffffc
mov word [ebp - 0x504], ax
lea eax, [edx - 5]
mov word [ebp - 0x502], si
mov word [ebp - 0x500], ax
add eax, 0xfffffff2
mov word [ebp - 0x4fe], dx
dec edx
mov word [ebp - 0x4fc], dx
mov word [ebp - 0x4fa], bx
inc ebx
mov word [ebp - 0x4f8], si
mov word [ebp - 0x4f6], di
mov word [ebp - 0x4f4], cx
add ecx, 0xfffffff6
mov word [ebp - 0x4f2], bx
mov word [ebp - 0x4f0], cx
mov word [ebp - 0x4ee], si
mov word [ebp - 0x4ec], ax
lea eax, [esi - 4]
mov word [ebp - 0x4ea], ax
add eax, 3
mov word [ebp - 0x4e8], ax
mov word [ebp - 0x4e6], ax
mov word [ebp - 0x4e4], si
mov word [ebp - 0x4e2], dx
lea edx, [esi - 4]
mov word [ebp - 0x4e0], ax
lea eax, [esi - 0xc]
mov word [ebp - 0x4de], dx
mov word [ebp - 0x4dc], cx
mov word [ebp - 0x4da], ax
add eax, 0xfffffffb
mov word [ebp - 0x4d8], bx
mov word [ebp - 0x4d6], di
mov word [ebp - 0x4d4], ax
lea eax, [esi - 1]
mov word [ebp - 0x4d2], bx
mov word [ebp - 0x4d0], ax
add eax, 0xffffffb1
mov word [ebp - 0x4ce], bx
mov word [ebp - 0x4cc], dx
mov word [ebp - 0x4ca], ax
xor eax, eax
mov word [ebp - 0x4c8], ax
mov ax, word [ebp - 0x514]
pop esi
mov word [ebp - 0x4c4], si
push 0x73
pop edx
push 0x7a
mov word [ebp - 0x4c2], dx
pop ecx
mov word [ebp - 0x4c0], cx
mov word [ebp - 0x4be], si
push 0x6b
pop eax
mov word [ebp - 0x4bc], ax
xor eax, eax
mov word [ebp - 0x4ba], si
mov word [ebp - 0x4b8], dx
mov word [ebp - 0x4b6], cx
mov word [ebp - 0x4b4], ax
mov ax, word [ebp - 0x4c4]
lea eax, [ebp - 0x2a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x518]
call fcn.1000b6ff
push eax
lea ecx, [ebp - 0x4c4]
call fcn.100cc170
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.10004b9e
add esp, 0x14
lea eax, [ebp - 0x20]
cmp dword [ebp - 0x51c], 8
lea ecx, [ebp - 0x530]
cmovae ecx, dword [ebp - 0x530]
push eax
mov eax, dword [ebp - 0x520]
add eax, eax
push eax
mov eax, dword [0x101ef2d0]
push ecx
call dword [eax + pe_nt_image_headers32]
push 0
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0x80
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [0x101ef2d0]
call dword [eax + 0x3b0]
push 0x104
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
neg eax
sbb esi, esi
neg esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x530]
call fcn.1000b2cc
mov eax, esi
call fcn.100cc9de
ret