Function at 0x100261c6
Capabilities:
Query environment variable

Disassembly:
push 0x848
mov eax, 0x1015254f
call fcn.1012b6ae
mov dword [ebp - 0x850], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x838]
mov ebx, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x854], eax
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x83c], edi
call fcn.100088c7
mov dword [ebp - 4], 1
xor esi, esi
push 0x410
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.1012db70
mov eax, dword [ebp - 0x838]
add esp, 0xc
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x1002625a
mov ecx, dword [ebp - 0x84c]
push 0x101bd7f8
call fcn.100088c7
mov dword [ebp - 0x83c], 1
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x838]
add ecx, 0xfffffff0
jmp 0x100266da
js 0x100266ed
cmp word [eax], 0x2e
jne 0x1002629c
push 0x410
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.1012db70
add esp, 0xc
test ebx, ebx
je 0x100266ac
push dword [ebp - 0x838]
lea eax, [ebp - 0x420]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x100266ac
push 2
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x838]
call fcn.10014b9c
mov byte [ebp - 4], 3
push 0x101845a8
push dword [eax]
call fcn.10131153
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x840]
add ecx, 0xfffffff0
call fcn.100078bc
test esi, esi
jne 0x10026423
call fcn.10007945
push eax
lea ecx, [ebp - 0x840]
call fcn.10008bfd
mov byte [ebp - 4], 6
call fcn.10007945
push eax
lea ecx, [ebp - 0x848]
call fcn.10008bfd
mov byte [ebp - 4], 8
lea eax, [ebp - 0x844]
push 2
pop edi
push edi
push eax
lea ecx, [ebp - 0x838]
call fcn.1001f1fd
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x840]
push esi
push ecx
push dword [eax]
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x83c], edi
call fcn.10024d57
mov esi, dword [ebp - 0x840]
test eax, eax
je 0x10026354
cmp dword [esi - 0xc], 0
mov byte [ebp - 0x831], 0
jne 0x1002635b
mov byte [ebp - 0x831], 1
mov dword [ebp - 4], 8
mov dword [ebp - 0x83c], edi
and edi, 0xfffffffd
mov dword [ebp - 0x83c], edi
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x844]
lea ecx, [ecx - 0x10]
call fcn.100078bc
cmp byte [ebp - 0x831], 0
je 0x100263c8
mov ecx, dword [ebp - 0x84c]
push 0x101bd7f8
call fcn.100088c7
or edi, 1
mov dword [ebp - 0x83c], edi
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x848]
lea ecx, [ecx - 0x10]
call fcn.100078bc
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.100078bc
jmp 0x100266cd
push 0
lea eax, [ebp - 0x848]
push eax
push esi
call fcn.1005313d
add esp, 0xc
test eax, eax
je 0x1002640c
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1012db70
add esp, 0xc
test ebx, ebx
je 0x1002640c
push dword [ebp - 0x848]
lea eax, [ebp - 0x420]
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x848]
lea ecx, [ecx - 0x10]
call fcn.100078bc
jmp 0x10026552
push 2
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x838]
call fcn.10014b9c
mov byte [ebp - 4], 0x10
push 0x101845b0
push dword [eax]
call fcn.10131153
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x844]
add ecx, 0xfffffff0
call fcn.100078bc
test esi, esi
jne 0x10026563
call fcn.10007945
push eax
lea ecx, [ebp - 0x840]
call fcn.10008bfd
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x844]
push 2
push eax
lea ecx, [ebp - 0x838]
call fcn.1001f1fd
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x840]
push 4
pop edi
push esi
push ecx
push dword [eax]
mov ecx, dword [ebp - 0x850]
mov dword [ebp - 0x83c], edi
call fcn.10024d57
mov esi, dword [ebp - 0x840]
test eax, eax
je 0x100264c7
cmp dword [esi - 0xc], 0
mov byte [ebp - 0x831], 0
jne 0x100264ce
mov byte [ebp - 0x831], 1
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x83c], edi
and edi, 0xfffffffb
mov dword [ebp - 0x83c], edi
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x844]
lea ecx, [ecx - 0x10]
call fcn.100078bc
cmp byte [ebp - 0x831], 0
je 0x10026529
mov ecx, dword [ebp - 0x84c]
push 0x101bd7f8
call fcn.100088c7
or edi, 1
mov dword [ebp - 0x83c], edi
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.100078bc
jmp 0x100266cd
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1012db70
add esp, 0xc
test ebx, ebx
je 0x10026552
push esi
push ebx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
call fcn.100078bc
jmp 0x100266ac
push dword [ebp - 0x838]
mov esi, 0x410
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.100100b8
mov eax, dword [ebp - 0x838]
cmp dword [eax - 0xc], 0
jl 0x100266ed
cmp word [eax], 0x25
jne 0x100265f7
push esi
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x830]
mov esi, 0x208
push esi
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x206
ja 0x100266ac
cmp word [ebp - 0x830], 0
je 0x100266ac
push SysReAllocString
lea eax, [ebp - 0x830]
push eax
push 0
push esi
lea eax, [ebp - 0x420]
push eax
call fcn.10015d3f
jmp 0x100266ac
push 0
push 0x5c
lea ecx, [ebp - 0x838]
call fcn.10018481
cmp eax, 0xffffffff
jne 0x100266ac
push ebx
push esi
lea eax, [ebp - 0x420]
push eax
call fcn.100100b8
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push 0x101845b8
push eax
call esi
push dword [ebp - 0x838]
lea eax, [ebp - 0x420]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
call fcn.10010313
test eax, eax
jne 0x100266ac
mov ebx, dword [ebp - 0x838]
push 0x27
call fcn.10010082
mov esi, 0x208
pop ecx
test eax, eax
je 0x10026679
xor edx, edx
lea ecx, [ebp - 0x420]
push edx
push ecx
push esi
push edx
push ebx
push edx
call eax
jmp 0x1002668d
xor ecx, ecx
lea eax, [ebp - 0x420]
push ecx
push eax
push esi
push ecx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x10026695
cmp eax, esi
jb 0x100266ac
push dword [ebp - 0x838]
lea eax, [ebp - 0x420]
push 0x410
push eax
call fcn.100100b8
mov ecx, dword [ebp - 0x84c]
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x420]
push eax
call fcn.100088c7
or edi, 1
mov dword [ebp - 0x83c], edi
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x838]
lea ecx, [ecx - 0x10]
call fcn.100078bc
mov eax, dword [ebp - 0x84c]
call fcn.1012b658
ret 0xc
push 0x80070057
call fcn.100074e1
int3