Function at 0x403109
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
test byte [ebp + 0x10], 1
mov dword [ebp - 4], edi
je 0x403234
push 0x40
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x40
push eax
call fcn.00401f5b
mov esi, eax
test esi, esi
js 0x40334d
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x40318d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403178
mov esi, 0x80004005
push esi
push 0x108
push str.pathutil.cpp
call fcn.00403858
jmp 0x40334d
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x4031f6
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.00401f5b
mov esi, eax
test esi, esi
js 0x40334d
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x4031e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4031d1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4031d8
mov esi, 0x80004005
push esi
push 0x113
jmp 0x40317e
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x4031f6
mov eax, 0x8007007a
push eax
mov esi, eax
push pe_nt_image_headers32
jmp 0x40317e
cmp eax, 0x104
jbe 0x403231
lea eax, [ebp - 4]
push eax
call fcn.00403616
lea esi, [eax + 0x7ff8ffa9]
neg esi
sbb esi, esi
and esi, eax
jl 0x40334d
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.004027df
mov esi, eax
test esi, esi
js 0x40334d
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
test byte [ebp + 0x10], 2
je 0x403332
and dword [ebp + 0x10], 0
test edi, edi
jne 0x403249
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
ja 0x403251
push 0x40
pop ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00401f5b
mov esi, eax
test esi, esi
js 0x40334d
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x4032a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40328f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403296
mov esi, 0x80004005
push esi
push 0x139
jmp 0x40317e
cmp ebx, eax
jae 0x403317
mov ebx, eax
cmp eax, 0x104
jb 0x4032b1
lea ebx, [eax + 7]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00401f5b
mov esi, eax
test esi, esi
js 0x40334d
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x403301
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4032ef
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4032f6
mov esi, 0x80004005
push esi
push 0x144
jmp 0x40317e
cmp ebx, eax
jae 0x403317
mov eax, 0x8007007a
push eax
mov esi, eax
push 0x149
jmp 0x40317e
cmp eax, 0x104
jbe 0x40332d
lea eax, [ebp - 8]
push eax
call fcn.00403616
mov esi, eax
test esi, esi
js 0x40334d
mov edi, dword [ebp - 8]
jmp 0x403339
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
test edi, edi
jne 0x403340
mov edi, dword [ebp + 0xc]
push 0
push edi
push dword [ebp + 8]
call fcn.0040221f
mov esi, eax
cmp dword [ebp - 8], 0
je 0x40335b
push dword [ebp - 8]
call fcn.004026e8
cmp dword [ebp - 4], 0
je 0x403369
push dword [ebp - 4]
call fcn.004026e8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc