Function at 0x100b1640
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], edx
push esi
push edi
test ebx, ebx
je 0x100d4aa4
xor eax, eax
lea ecx, [ebp - 0xc]
mov edi, 0x104
mov dword [ebp - 0xc], eax
mov edx, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
call fcn.100a70d5
mov esi, eax
test esi, esi
js 0x100d4abd
push edi
mov edi, dword [ebp - 0xc]
push edi
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100d4ae1
cmp eax, 0x104
ja 0x100d4b1a
mov edx, 0x104
lea ecx, [ebp - 0x10]
call fcn.100a70d5
mov esi, eax
test esi, esi
js 0x100d4b66
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ebx
push 0x104
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100d4b8a
cmp eax, 0x104
ja 0x100d4bc3
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
xor ebx, ebx
test ebx, ebx
jne 0x100d4c13
test edi, edi
je 0x100b1706
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret
push 0x100313bc
mov edx, 0x13a
mov ecx, 0x10031184
call fcn.100e970f
jmp 0x100b1662
push 0x100313cc
jmp 0x100d4ac9
push 0x10031430
push 1
push esi
push 0x4000000
call fcn.100ab973
mov edi, dword [ebp - 0xc]
add esp, 0x10
jmp 0x100b16f8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100d4af8
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100d4aff
mov esi, 0x80004005
push ebx
push 0x100313f8
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b16f8
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.100a70d5
mov esi, eax
test esi, esi
js 0x100d4ac4
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100d4ae1
cmp esi, eax
jae 0x100b16a8
push 0x10031464
mov eax, 0x8007007a
push 1
push eax
push 0x4000000
mov esi, eax
call fcn.100ab973
add esp, 0x10
jmp 0x100b16f8
push 0x10031494
jmp 0x100d4b72
push 0x100314e4
push 1
push esi
push 0x4000000
call fcn.100ab973
mov ebx, dword [ebp - 0x10]
add esp, 0x10
jmp 0x100b16f0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100d4ba1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100d4ba8
mov esi, 0x80004005
push edi
push 0x100314bc
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b16f0
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.100a70d5
mov esi, eax
test esi, esi
js 0x100d4b6d
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 0xc]
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
test eax, eax
je 0x100d4b8a
cmp dword [ebp - 0xc], eax
jae 0x100b16e9
push 0x10031514
mov eax, 0x8007007a
push 1
push eax
push 0x4000000
mov esi, eax
call fcn.100ab973
add esp, 0x10
jmp 0x100b16f0
lea eax, [ebx - 4]
push eax
call fcn.100b84f9
pop ecx
jmp 0x100b16f8