Function at 0x4031f7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
test byte [ebp + 0x10], 1
mov dword [ebp - 4], edi
je 0x403324
push 0x40
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x40
push eax
call fcn.00402057
mov esi, eax
test esi, esi
js 0x40343d
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x403279
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40325d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403264
mov esi, 0x80004005
push esi
push 0x108
push str.c:_agent_work18_swix_srclibsdutilpathutil.cpp
call fcn.00403953
jmp 0x40343d
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x4032e6
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.00402057
mov esi, eax
test esi, esi
js 0x40343d
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x4032d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4032c1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4032c8
mov esi, 0x80004005
push esi
push 0x113
jmp 0x40326a
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x4032e6
mov eax, 0x8007007a
push eax
mov esi, eax
push pe_nt_image_headers32
jmp 0x40326a
cmp eax, 0x104
jbe 0x403321
lea eax, [ebp - 4]
push eax
call fcn.00403705
lea esi, [eax + 0x7ff8ffa9]
neg esi
sbb esi, esi
and esi, eax
jl 0x40343d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.004028bf
mov esi, eax
test esi, esi
js 0x40343d
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
test byte [ebp + 0x10], 2
je 0x403422
and dword [ebp - 0x10], 0
test edi, edi
jne 0x403339
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
ja 0x403341
push 0x40
pop ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00402057
mov esi, eax
test esi, esi
js 0x40343d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x403391
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40337f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403386
mov esi, 0x80004005
push esi
push 0x139
jmp 0x40326a
cmp ebx, eax
jae 0x403407
mov ebx, eax
cmp eax, 0x104
jb 0x4033a1
lea ebx, [eax + 7]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00402057
mov esi, eax
test esi, esi
js 0x40343d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x4033f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4033df
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4033e6
mov esi, 0x80004005
push esi
push 0x144
jmp 0x40326a
cmp ebx, eax
jae 0x403407
mov eax, 0x8007007a
push eax
mov esi, eax
push 0x149
jmp 0x40326a
cmp eax, 0x104
jbe 0x40341d
lea eax, [ebp - 8]
push eax
call fcn.00403705
mov esi, eax
test esi, esi
js 0x40343d
mov edi, dword [ebp - 8]
jmp 0x403429
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
test edi, edi
jne 0x403430
mov edi, dword [ebp + 0xc]
push 0
push edi
push dword [ebp + 8]
call fcn.00402315
mov esi, eax
cmp dword [ebp - 8], 0
je 0x40344b
push dword [ebp - 8]
call fcn.004027da
cmp dword [ebp - 4], 0
je 0x403459
push dword [ebp - 4]
call fcn.004027da
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc