Function at 0x1027ca9
Capabilities:
Query environment variable

Disassembly:
push 0x14
mov eax, 0x104260e
call fcn.010017d1
and dword [ebp - 0x10], 0
mov edi, 0x104d19c
push edi
lea ecx, [ebp - 0x18]
call fcn.01003395
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
and dword [ebp - 4], 0
test eax, eax
jle 0x1027cf9
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.01009243
push 0x5c
push eax
mov dword [ebp - 0x10], ebx
call fcn.0100498c
test al, al
je 0x1027cf9
mov bl, bl
jmp 0x1027cfb
xor bl, bl
test byte [ebp - 0x10], 1
je 0x1027d10
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x10], 0xfffffffe
add ecx, 0xfffffff0
call fcn.01002480
test bl, bl
je 0x1027d44
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0100977f
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0100523a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.01002480
jmp 0x1027d4d
push esi
lea ecx, [ebp - 0x18]
call fcn.0100523a
push edi
lea ecx, [ebp - 0x14]
call fcn.01003395
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jle 0x1027d86
push 1
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.01009243
or dword [ebp - 0x10], 2
push 0x5c
push eax
call fcn.0100498c
test al, al
je 0x1027d86
mov bl, 1
jmp 0x1027d88
xor bl, bl
test byte [ebp - 0x10], 2
je 0x1027d99
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.01002480
test bl, bl
je 0x1027dc9
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.0100977f
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0100523a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.01002480
jmp 0x1027dd2
push esi
lea ecx, [ebp - 0x14]
call fcn.0100523a
and dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.01003af9
test eax, eax
mov ebx, dword [ebp - 0x18]
je 0x1027e2c
jle 0x1027e05
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.01004400
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.01002480
lea ecx, [ebx - 0x10]
call fcn.01002480
mov eax, esi
call fcn.01001740
ret 0x10
mov esi, 0x1000
push edi
lea ecx, [ebp + 0x10]
mov dword [ebp + 0xc], esi
call fcn.01003395
push esi
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 5
call fcn.010034bd
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.0101c7d9
test eax, eax
je 0x1027e7c
jle 0x1027e6d
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.01002480
jmp 0x1027e07
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.0101c9ff
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp + 0x10]
call esi
push edi
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.01003395
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 6
call fcn.010034bd
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push eax
push edi
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.0101c9ff
push dword [ebx - 0xc]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 8]
call fcn.0100977f
push ebx
mov ecx, eax
call fcn.01003b74
mov ecx, dword [ebp - 0x20]
test eax, eax
setne byte [ebp + 0xf]
add ecx, 0xfffffff0
call fcn.01002480
cmp byte [ebp + 0xf], 0
je 0x1027f0c
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.01002480
lea ecx, [edi - 0x10]
call fcn.01002480
xor esi, esi
jmp 0x1027e07
mov esi, dword [ebp + 8]
mov eax, dword [esi - 0xc]
sub eax, dword [ebx - 0xc]
lea ecx, [ebp + 8]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.01009243
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 7
call fcn.01004b90
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.01002480
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
push eax
call fcn.0100755b
test eax, eax
jle 0x1027f64
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov dword [ebp + 0x14], eax
call fcn.01002480
lea ecx, [esi - 0x10]
call fcn.01002480
lea ecx, [edi - 0x10]
call fcn.01002480
mov esi, dword [ebp + 0x14]
jmp 0x1027e07