Function at 0x40319c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
test byte [ebp + 0x10], 1
mov dword [ebp - 4], edi
je 0x4032c7
push 0x40
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x40
push eax
call fcn.0040200b
mov esi, eax
test esi, esi
js 0x4033e0
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x403220
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403204
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40320b
mov esi, 0x80004005
push esi
push 0x108
push str.c:_agent_work138_s_srclibsdutilpathutil.cpp
call fcn.004038f5
jmp 0x4033e0
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x403289
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.0040200b
mov esi, eax
test esi, esi
js 0x4033e0
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x403273
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403264
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40326b
mov esi, 0x80004005
push esi
push 0x113
jmp 0x403211
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x403289
mov eax, 0x8007007a
push eax
mov esi, eax
push pe_nt_image_headers32
jmp 0x403211
cmp eax, 0x104
jbe 0x4032c4
lea eax, [ebp - 4]
push eax
call fcn.004036a8
lea esi, [eax + 0x7ff8ffa9]
neg esi
sbb esi, esi
and esi, eax
jl 0x4033e0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.00402872
mov esi, eax
test esi, esi
js 0x4033e0
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
test byte [ebp + 0x10], 2
je 0x4033c5
and dword [ebp + 0x10], 0
test edi, edi
jne 0x4032dc
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
ja 0x4032e4
push 0x40
pop ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0040200b
mov esi, eax
test esi, esi
js 0x4033e0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x403334
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403322
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403329
mov esi, 0x80004005
push esi
push 0x139
jmp 0x403211
cmp ebx, eax
jae 0x4033aa
mov ebx, eax
cmp eax, 0x104
jb 0x403344
lea ebx, [eax + 7]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0040200b
mov esi, eax
test esi, esi
js 0x4033e0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x403394
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403382
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403389
mov esi, 0x80004005
push esi
push 0x144
jmp 0x403211
cmp ebx, eax
jae 0x4033aa
mov eax, 0x8007007a
push eax
mov esi, eax
push 0x149
jmp 0x403211
cmp eax, 0x104
jbe 0x4033c0
lea eax, [ebp - 8]
push eax
call fcn.004036a8
mov esi, eax
test esi, esi
js 0x4033e0
mov edi, dword [ebp - 8]
jmp 0x4033cc
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
test edi, edi
jne 0x4033d3
mov edi, dword [ebp + 0xc]
push 0
push edi
push dword [ebp + 8]
call fcn.004022c9
mov esi, eax
cmp dword [ebp - 8], 0
je 0x4033ee
push dword [ebp - 8]
call fcn.0040278d
cmp dword [ebp - 4], 0
je 0x4033fc
push dword [ebp - 4]
call fcn.0040278d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc