Function at 0x100e8a21
Capabilities:
Get common file path
Link many functions at runtime
Move file
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x704
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101dc9fc]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c4], eax
push 0x208
lea eax, [ebp - 0x290]
mov dword [ebp - 0x6f4], ebx
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x6a0], ebx
mov dword [ebp - 0x698], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x6fc], 3
lea eax, [ebp - 0x290]
mov dword [ebp - 0x700], ebx
mov dword [ebp - 0x69c], ebx
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x100e8ad4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8ab8
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8abf
mov edi, 0x80004005
push 0x1002fed8
push 1
push edi
call fcn.100e7fd5
add esp, 0xc
jmp 0x100e95e6
push esi
lea eax, [ebp - 0x698]
push eax
call fcn.100a7590
mov edi, eax
test edi, edi
jns 0x100e8aee
push 0x1002ff10
jmp 0x100e8ac4
lea ecx, [ebp - 0x698]
call fcn.100b15f5
mov edi, eax
test edi, edi
jns 0x100e8b1a
push dword [ebp - 0x698]
push 0x1002ff44
push 1
push edi
call fcn.100e7fd5
add esp, 0x10
jmp 0x100e95e6
mov ebx, 0x100091e0
lea ecx, [ebp - 0x698]
mov edx, ebx
call fcn.100a8220
mov edi, eax
test edi, edi
jns 0x100e8b39
push 0x1002ff7c
jmp 0x100e8ac4
push dword [ebp - 0x698]
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_LoadLibraryW]
mov esi, 0x101dd310
push eax
mov ecx, esi
call fcn.100b311a
mov eax, dword [0x101dd310]
test eax, eax
jne 0x100e8c2b
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.100a7590
mov edi, eax
test edi, edi
jns 0x100e8b86
lea eax, [ebp - 0x290]
push eax
push 0x1002ffa8
jmp 0x100e8b0a
lea ecx, [ebp - 0x698]
call fcn.100b15f5
mov edi, eax
test edi, edi
js 0x100e8aff
push ebx
mov edx, 0x10008b10
lea ecx, [ebp - 0x698]
call fcn.100a9500
mov edi, eax
test edi, edi
jns 0x100e8bbc
push 0x1002ffe0
jmp 0x100e8ac4
push dword [ebp - 0x698]
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_LoadLibraryW]
push eax
mov ecx, esi
call fcn.100b311a
mov eax, dword [0x101dd310]
test eax, eax
jne 0x100e8c2b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
cmp edi, 0x7e
jne 0x100e8c05
push dword [ebp - 0x698]
xor ebx, ebx
push 0x10030010
inc ebx
push ebx
push ebx
call fcn.100e7fd5
add esp, 0x10
mov edi, ebx
jmp 0x100e962b
test edi, edi
jle 0x100e8c14
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8c1b
mov edi, 0x80004005
push dword [ebp - 0x698]
push 0x10030064
jmp 0x100e8b0a
push 0x10030084
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca38], eax
test eax, eax
jne 0x100e8c68
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8c57
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8c5e
mov edi, 0x80004005
push 0x10030094
jmp 0x100e8ac4
push 0x100300c4
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca34], eax
test eax, eax
jne 0x100e8caa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8c99
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8ca0
mov edi, 0x80004005
push 0x100300dc
jmp 0x100e8ac4
push 0x10030114
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dea70], eax
test eax, eax
jne 0x100e8cec
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8cdb
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8ce2
mov edi, 0x80004005
push 0x10030124
jmp 0x100e8ac4
push 0x10030154
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca30], eax
test eax, eax
jne 0x100e8d2e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8d1d
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8d24
mov edi, 0x80004005
push 0x10030168
jmp 0x100e8ac4
push 0x10008cec
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca2c], eax
test eax, eax
jne 0x100e8d70
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8d5f
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8d66
mov edi, 0x80004005
push 0x1003019c
jmp 0x100e8ac4
push 0x10008cd4
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca28], eax
test eax, eax
jne 0x100e8db2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8da1
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8da8
mov edi, 0x80004005
push 0x100301d0
jmp 0x100e8ac4
push 0x10008cc8
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov dword [0x101dca24], eax
test eax, eax
jne 0x100e8df4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100e8de3
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100e8dea
mov edi, 0x80004005
push 0x10030208
jmp 0x100e8ac4
lea edx, [ebp - 0x694]
lea ecx, [ebp - 0x6f4]
call fcn.100b17da
xor ebx, ebx
mov edi, eax
inc ebx
test edi, edi
jns 0x100e8e1d
push 0x10030238
push ebx
push edi
call fcn.100e7fd5
add esp, 0xc
mov ecx, dword [ebp - 0x6f4]
xor esi, esi
mov eax, ecx
test ecx, ecx
jne 0x100e923a
push 0x400
lea eax, [ebp - 0x690]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x690]
push 0x200
push eax
push 0x10030288
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x1fe
ja 0x100e8e92
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x694]
push eax
call fcn.100a7590
mov edi, eax
test edi, edi
jns 0x100e9242
lea eax, [ebp - 0x690]
push eax
push 0x100302cc
push ebx
jmp 0x100e8b0c
lea edx, [ebp - 0x694]
lea ecx, [ebp - 0x6f4]
call fcn.100e9668
mov edi, eax
test edi, edi
jns 0x100e8eb8
push 0x100302f8
push ebx
push edi
call fcn.100e7fd5
add esp, 0xc
mov ecx, dword [ebp - 0x6f4]
mov eax, ecx
mov dword [ebp - 0x6f0], eax
test ecx, ecx
jne 0x100e923a
lea eax, [ebp - 0x6f0]
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push eax
push 0x10030344
push ebx
mov edx, 0x10008b40
mov ecx, edi
call fcn.100ae0e0
test eax, eax
js 0x100e9219
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f0], eax
test eax, eax
je 0x100e9219
lea eax, [ebp - 0x694]
mov edx, 0x10008678
push eax
push 0x10030358
push ebx
mov ecx, edi
call fcn.100b53d5
test eax, eax
js 0x100e8fa9
mov ecx, dword [ebp - 0x694]
cmp word [ecx], si
je 0x100e8fa9
lea edx, [ebp - 0x69c]
call fcn.100eb4ef
mov edi, eax
test edi, edi
jns 0x100e8f55
push dword [ebp - 0x694]
push 0x10030368
jmp 0x100e8e8c
mov ecx, dword [ebp - 0x69c]
xor edi, edi
mov edx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x100e8f62
sub edx, esi
sar edx, 1
je 0x100e8f88
cmp word [ecx + edx*2 - 2], 0x5c
jne 0x100e8f88
xor eax, eax
mov word [ecx + edx*2 - 2], ax
mov ecx, dword [ebp - 0x69c]
xor esi, esi
call fcn.100ec268
mov edi, eax
test edi, edi
jns 0x100e906d
push dword [ebp - 0x694]
push 0x100304b8
jmp 0x100e8e8c
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x694]
push eax
call fcn.100a7590
mov edi, eax
test edi, edi
jns 0x100e8fd3
lea eax, [ebp - 0x290]
push eax
push 0x1003038c
jmp 0x100e8e8c
lea ecx, [ebp - 0x694]
call fcn.100b15f5
mov edi, eax
test edi, edi
jns 0x100e8ff4
push dword [ebp - 0x694]
push 0x100303cc
jmp 0x100e8e8c
mov edx, 0x10030408
lea ecx, [ebp - 0x694]
call fcn.100a8220
push dword [ebp - 0x694]
mov edi, eax
test edi, edi
jns 0x100e901a
push 0x1003041c
jmp 0x100e8e8c
lea eax, [ebp - 0x69c]
push eax
call fcn.100a7590
mov edi, eax
test edi, edi
jns 0x100e903c
push dword [ebp - 0x694]
push 0x10030450
jmp 0x100e8e8c
mov edx, 0x10030478
lea ecx, [ebp - 0x694]
call fcn.100a8220
mov edi, eax
test edi, edi
jns 0x100e9062
push dword [ebp - 0x694]
push 0x1003048c
jmp 0x100e8e8c
mov ecx, dword [ebp - 0x69c]
jmp 0x100e8f8a
lea edx, [ebp - 0x6b4]
mov dword [ebp - 0x6f8], esi
mov ecx, 0x100304ec
mov dword [ebp - 0x6b4], esi
call fcn.100b0d9f
test eax, eax
js 0x100e9098
mov esi, dword [ebp - 0x6b4]
cmp esi, 0x28
jbe 0x100e909b
push 0xf
pop esi
lea edx, [ebp - 0x6f8]
mov ecx, 0x10030508
call fcn.100b0d9f
test eax, eax
js 0x100e90bf
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x6f8], eax
cmp eax, esi
jae 0x100e90c8
push 0x64
pop eax
mov dword [ebp - 0x6f8], eax
mov ecx, dword [ebp - 0x694]
lea edx, [ebp - 0x6b8]
xor eax, eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], eax
call fcn.100eb9b3
test eax, eax
js 0x100e9232
xor eax, eax
shl esi, 0x14
cmp dword [ebp - 0x6b4], eax
jb 0x100e9232
ja 0x100e910e
cmp dword [ebp - 0x6b8], esi
jbe 0x100e9232
lea eax, [ebp - 0x6fc]
mov edx, 0x1002ba40
push eax
push 0x1002c3c0
push ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100ae0e0
xor esi, esi
test eax, eax
js 0x100e915c
cmp dword [ebp - 0x6fc], 2
jne 0x100e915c
mov eax, dword [ebp - 0x6f8]
shl eax, 0x14
cmp dword [ebp - 0x6b4], esi
jb 0x100e9234
ja 0x100e915c
cmp dword [ebp - 0x6b8], eax
jbe 0x100e9234
lea eax, [ebp - 0x6b0]
push eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTime]
movzx eax, word [ebp - 0x6a4]
push eax
movzx eax, word [ebp - 0x6a6]
push eax
movzx eax, word [ebp - 0x6a8]
push eax
movzx eax, word [ebp - 0x6aa]
push eax
movzx eax, word [ebp - 0x6ae]
push eax
movzx eax, word [ebp - 0x6b0]
push eax
push dword [ebp - 0x69c]
lea eax, [ebp - 0x6a0]
push 0x10030530
push eax
call fcn.100a6b40
add esp, 0x24
test eax, eax
js 0x100e9202
call fcn.100f1aee
push ebx
push dword [ebp - 0x6a0]
push dword [ebp - 0x694]
call dword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
test eax, eax
jne 0x100e9234
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100e91e5
movzx eax, ax
or eax, 0x80070000
push dword [ebp - 0x6a0]
push dword [ebp - 0x694]
push 0x10030588
push ebx
push eax
call fcn.100e7fd5
add esp, 0x14
jmp 0x100e9234
push dword [ebp - 0x694]
push 0x100305c8
push ebx
push eax
call fcn.100e7fd5
add esp, 0x10
jmp 0x100e9234
push 0x10030630
mov edi, 0x80004004
push ebx
push edi
call fcn.100e7fd5
add esp, 0xc
jmp 0x100e95ec
xor esi, esi
mov eax, dword [ebp - 0x6f0]
test eax, eax
je 0x100e959b
mov ecx, dword [ebp - 0x694]
call fcn.100b7fb2
test eax, eax
jne 0x100e92c0
lea edx, [ebp - 0x6fc]
mov dword [ebp - 0x6fc], ebx
mov ecx, 0x10030678
call fcn.100b0d9f
test eax, eax
mov eax, ebx
js 0x100e9273
mov eax, dword [ebp - 0x6fc]
test eax, eax
je 0x100e92c0
mov dword [ebp - 0x6f0], esi
lea ecx, [ebp - 0x6f0]
mov esi, dword [ebp - 0x694]
call fcn.100e85a6
push eax
sub esp, 0x14
mov ecx, esi
call fcn.100eb3b9
mov ecx, dword [ebp - 0x6f0]
call fcn.10094ff1
test al, al
jne 0x100e92c0
push ecx
call dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x100e92b8
push 7
pop ecx
int 0x29
xor eax, eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f4], 0
je 0x100e9317
push dword [ebp - 0x694]
mov esi, dword [0x101dca38]
mov ecx, esi
push 0xb000
push dword [ebp - 0x6c4]
call dword [0x101e07c0]
call esi
test eax, eax
jne 0x100e959b
push dword [ebp - 0x694]
mov edi, 0x8000ffff
push dword [ebp - 0x698]
push 0x10030698
push ebx
push edi
call fcn.100e7fd5
add esp, 0x14
jmp 0x100e95ea
mov esi, dword [0x101dca34]
mov ecx, esi
push 0x8000
push dword [ebp - 0x694]
call dword [0x101e07c0]
call esi
test eax, eax
jne 0x100e935f
test edi, edi
js 0x100e933f
mov edi, 0x80004005
push dword [ebp - 0x694]
push dword [ebp - 0x698]
push 0x100306d8
push ebx
push edi
call fcn.100e7fd5
add esp, 0x14
jmp 0x100e95e6
mov eax, 0x400
xor esi, esi
push 0x80
mov dword [ebp - 0x6f0], eax
lea eax, [ebp - 0x88]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x88]
push 0x40
push eax
push 0x10030718
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x3e
ja 0x100e93d8
push 0x10
lea eax, [ebp - 0x6c4]
mov dword [ebp - 0x6c4], esi
push eax
lea eax, [ebp - 0x88]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_wcstoul
add esp, 0xc
mov dword [ebp - 0x6f0], eax
test eax, eax
jne 0x100e93d8
call sub.api_ms_win_crt_private_l1_1_0.dll__o__errno
cmp dword [eax], 0x22
jne 0x100e93d8
mov eax, 0x400
mov dword [ebp - 0x6f0], eax
mov esi, dword [0x101dea70]
mov ecx, esi
call dword [0x101e07c0]
call esi
mov edx, eax
mov dword [ebp - 0x700], edx
test edx, edx
jne 0x100e9404
push 0x10030760
push ebx
push 0x8000ffff
jmp 0x100e8ac7
mov ecx, dword [ebp - 0x6f0]
cmp ecx, 0x100
je 0x100e9439
cmp ecx, 0x200
je 0x100e9432
xor eax, eax
cmp ecx, 0x400
sete al
dec eax
and eax, 0x5000000
add eax, 0x4000000
jmp 0x100e943b
mov eax, 0x2000000
jmp 0x100e943b
xor eax, eax
mov dword [ebp - 0x6bc], eax
mov ecx, 0x10030780
xor eax, eax
mov dword [ebp - 0x6c0], ecx
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x6d8], ecx
xor ecx, ecx
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x6e8], ecx
mov dword [ebp - 0x6e4], ecx
mov dword [ebp - 0x6e0], ecx
mov dword [ebp - 0x6b8], ebx
mov dword [ebp - 0x6dc], 0x10030788
mov dword [ebp - 0x6d4], 0x10030790
mov dword [ebp - 0x6d0], 0x10030798
mov dword [ebp - 0x6cc], 0x100307a0
mov eax, dword [edx]
push 0x101dea78
mov esi, dword [eax]
lea eax, [ebp - 0x6ec]
push eax
push 0x10030c94
lea eax, [ebp - 0x6dc]
mov ecx, esi
push eax
push 0x10030ca4
lea eax, [ebp - 0x6c0]
push eax
push 0x10030cb4
push edx
call dword [0x101e07c0]
call esi
test eax, eax
jne 0x100e9502
push 0x100307a8
push ebx
push 0x8000ffff
call fcn.100e7fd5
add esp, 0xc
jmp 0x100e95cd
push 0x100307d0
push dword [0x101dd310]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100e9585
push 0x100e8180
push 0x10025980
mov ecx, esi
call dword [0x101e07c0]
call esi
cmp eax, ebx
jne 0x100e9585
mov ecx, dword [ebp - 0x700]
push 0x101dea74
mov eax, dword [ecx]
mov esi, dword [eax]
xor eax, eax
push eax
push 0x10025980
lea eax, [ebp - 0x6dc]
push eax
push 0x10030ca4
lea eax, [ebp - 0x6c0]
push eax
push 0x10030cb4
push ecx
mov ecx, esi
call dword [0x101e07c0]
call esi
test eax, eax
jne 0x100e95a4
push 0x100307e8
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100e95a4
push 0x10030810
xor eax, eax
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp dword [ebp - 0x6f4], 0
jne 0x100e95cd
mov ecx, dword [ebp - 0x69c]
test ecx, ecx
je 0x100e95cd
call fcn.100e8196
mov edi, eax
test edi, edi
jns 0x100e95cd
push 0x1003083c
push ebx
push edi
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp dword [ebp - 0x700], 0
je 0x100e95e6
mov esi, dword [0x101dca30]
mov ecx, esi
call dword [0x101e07c0]
call esi
test edi, edi
jns 0x100e962b
xor esi, esi
mov eax, dword [0x101dd310]
mov dword [0x101dca38], esi
mov dword [0x101dca34], esi
mov dword [0x101dea70], esi
mov dword [0x101dca30], esi
mov dword [0x101dca2c], esi
mov dword [0x101dca28], esi
mov dword [0x101dca24], esi
test eax, eax
je 0x100e962b
push eax
call fcn.100b81ac
mov dword [0x101dd310], esi
lea ecx, [ebp - 0x69c]
call fcn.100b61be
lea ecx, [ebp - 0x698]
call fcn.100b61be
lea ecx, [ebp - 0x6a0]
call fcn.100b61be
lea ecx, [ebp - 0x694]
call fcn.100b61be
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret