Function at 0x101f78a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
test byte [ebp + 0x10], 1
push 0x40
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
pop ebx
je 0x101f89a
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], ebx
call fcn.0101dbdf
mov esi, eax
cmp esi, edi
jge 0x101f7cc
push 0x1003a38
jmp 0x101f9c4
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x101f812
cmp dword [ebp - 0xc], eax
jae 0x101f854
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.0101dbdf
mov esi, eax
test esi, esi
jge 0x101f803
push 0x1003a04
jmp 0x101f9c4
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x101f840
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x101f82c
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x101f833
mov esi, 0x80004005
push dword [ebp + 0xc]
push 0x10039cc
jmp 0x101f956
cmp dword [ebp - 0xc], eax
jae 0x101f854
mov esi, 0x8007007a
push 0x100399c
jmp 0x101f9c4
cmp eax, 0x104
jbe 0x101f89a
lea eax, [ebp - 4]
push eax
call fcn.0101f69b
mov esi, eax
cmp esi, 0x80070057
jne 0x101f870
xor esi, esi
test esi, esi
jge 0x101f87e
push 0x1003958
jmp 0x101f9c4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.0101db19
mov esi, eax
test esi, esi
jge 0x101f89a
push 0x1003928
jmp 0x101f9c4
test byte [ebp + 0x10], 2
mov eax, dword [ebp - 4]
je 0x101f995
and dword [ebp - 0x10], 0
test eax, eax
jne 0x101f8b2
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
cmp dword [ebp - 0xc], ebx
jbe 0x101f8bd
mov ebx, dword [ebp - 0xc]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0101dbdf
mov esi, eax
test esi, esi
jge 0x101f8d7
push 0x1003900
jmp 0x101f9c4
mov edi, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x101f92d
cmp ebx, eax
jae 0x101f978
mov ebx, eax
cmp eax, 0x104
jb 0x101f902
lea ebx, [eax + 7]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0101dbdf
mov esi, eax
test esi, esi
jge 0x101f91c
push 0x10038d0
jmp 0x101f9c4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push ebx
push dword [ebp + 0x10]
call edi
test eax, eax
jne 0x101f968
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x101f947
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x101f94e
mov esi, 0x80004005
push dword [ebp + 0x10]
push 0x10038a8
push 1
push esi
push 0x4000000
call fcn.0101e5b9
add esp, 0x14
jmp 0x101f9d4
cmp ebx, eax
jae 0x101f978
mov esi, 0x8007007a
push 0x100387c
jmp 0x101f9c4
cmp eax, 0x104
jbe 0x101f99c
lea eax, [ebp - 8]
push eax
call fcn.0101f69b
mov esi, eax
test esi, esi
jge 0x101f99c
push 0x1003850
jmp 0x101f9c4
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x101f9ae
mov ecx, dword [ebp + 8]
and dword [ebp - 8], 0
mov dword [ecx], eax
jmp 0x101f9e2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0101e123
mov esi, eax
test esi, esi
jge 0x101f9d4
push 0x1003820
push 1
push esi
push 0x4000000
call fcn.0101e5b9
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x101f9e2
push dword [ebp - 8]
call fcn.0101db34
cmp dword [ebp - 4], 0
je 0x101f9f0
push dword [ebp - 4]
call fcn.0101db34
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc