Function at 0x1003eb90
Capabilities:
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1fc
mov eax, dword [0x106499c8]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push esi
push edi
push 1
push sym.php5.dll_config_zval_dtor
xor esi, esi
xor ebx, ebx
and dword [esp + 0x1c], ebx
push esi
mov edi, 0x106605f8
push edi
mov dword [esp + 0x20], ebx
call sym.php5.dll__zend_hash_init
add esp, 0x10
cmp eax, 0xffffffff
je 0x103adeb4
mov eax, dword [0x10667c44]
test eax, eax
jne 0x1003ef50
push 1
mov edi, sym.php5.dll_free_estring
push edi
push 4
push 0x10660620
call sym.php5.dll_zend_llist_init
push 1
push edi
push 4
push 0x1066063c
call sym.php5.dll_zend_llist_init
mov edi, dword [0x10667c10]
mov eax, dword [0x1066767c]
add esp, 0x20
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x103adebc
cmp dword [0x10667c28], ebx
jne 0x1003ed87
mov esi, str.PHPRC
push esi
call dword [sym.imp.MSVCR110.dll_getenv]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x103adeca
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1003ec4a
sub edi, ecx
add edi, 0x414
push edi
call sym.php5.dll__emalloc
mov esi, eax
pop ecx
mov byte [esi], 0
cmp byte [ebx], 0
mov dword [esp + 0x14], 1
je 0x1003ec81
push edi
push ebx
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
mov dword [esp + 0x10], ebx
call fcn.1003efc0
mov ebx, eax
test ebx, ebx
jne 0x103adf25
cmp dword [0x10667c2c], 0
jne 0x1003ecbc
cmp byte [esi], 0
je 0x1003ecad
push edi
push 0x1053c5cc
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push edi
push 0x10547d10
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
mov eax, dword [0x10667684]
test eax, eax
je 0x1003ed0a
push eax
call sym.php5.dll__estrdup
pop ecx
mov ebx, eax
push 0x5c
push ebx
call dword [sym.imp.MSVCR110.dll_strrchr]
pop ecx
pop ecx
test eax, eax
je 0x1003ece4
cmp eax, ebx
je 0x1003ece4
mov byte [eax], 0
cmp byte [esi], 0
je 0x1003ecf8
push edi
push 0x1053c5cc
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push edi
push ebx
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push ebx
call sym.php5.dll__efree
pop ecx
push 0x105
call sym.php5.dll__emalloc
mov ebx, eax
mov dword [esp], 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1003ed47
cmp byte [esi], 0
je 0x1003ed3c
push edi
push 0x1053c5cc
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push edi
push ebx
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x1003ed76
cmp byte [esi], 0
je 0x1003ed6b
push edi
push 0x1053c5cc
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push edi
push ebx
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push ebx
call sym.php5.dll__efree
mov edi, dword [0x10667c10]
mov ebx, dword [esp + 0x14]
pop ecx
and dword [0x1066767c], 0
push 0x3c
lea eax, [esp + 0x34]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
cmp dword [0x10667c28], 0
jne 0x103adf50
test ebx, ebx
je 0x1003ee0f
cmp byte [ebx], 0
je 0x1003ee0f
push 0
lea eax, [esp + 0xac]
push eax
push ebx
call sym.php5.dll_php_sys_stat_ex
add esp, 0xc
test eax, eax
jne 0x1003ee0f
mov eax, dword [esp + 0xae]
and eax, 0xf000
mov ecx, 0x4000
cmp ax, cx
je 0x1003ee0f
push 0x1054724c
push ebx
call dword [sym.imp.MSVCR110.dll_fopen]
pop ecx
pop ecx
mov dword [esp + 0x3c], eax
test eax, eax
je 0x103adf61
push 0
push ebx
call sym.php5.dll_expand_filepath
pop ecx
pop ecx
mov dword [sym.php5.dll_php_ini_opened_path], eax
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x3c]
test edx, edx
je 0x103adf61
xor ebx, ebx
cmp dword [esp + 0x14], 0
je 0x1003ee2f
push esi
call sym.php5.dll__efree
mov edx, dword [esp + 0x40]
pop ecx
mov eax, dword [esp + 0x1c]
mov dword [0x1066767c], eax
test edx, edx
je 0x1003eeed
mov esi, 0x106605f8
push esi
push 0x10063f40
push ebx
lea eax, [esp + 0x3c]
push 1
push eax
mov dword [esp + 0x44], 2
mov dword [0x106605f4], ebx
mov dword [0x10660238], ebx
call sym.php5.dll_zend_parse_ini_file
mov ecx, dword [esp + 0x48]
add esp, 0x14
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003ee76
sub ecx, edx
push ecx
push dword [esp + 0x38]
mov dword [esp + 0xb4], ecx
call sym.php5.dll_zend_strndup
push 1
push ebx
push 0x10
mov dword [esp + 0xbc], eax
lea eax, [esp + 0xbc]
push eax
push 0xe
push str.cfg_file_path
push esi
mov byte [esp + 0xd8], 6
mov dword [esp + 0xd4], ebx
call sym.php5.dll__zend_hash_add_or_update
mov eax, dword [sym.php5.dll_php_ini_opened_path]
add esp, 0x24
test eax, eax
je 0x1003eed3
push eax
call sym.php5.dll__efree
pop ecx
push dword [esp + 0xac]
push dword [esp + 0xac]
call sym.php5.dll_zend_strndup
pop ecx
pop ecx
mov dword [sym.php5.dll_php_ini_opened_path], eax
push str.PHP_INI_SCAN_DIR
call dword [sym.imp.MSVCR110.dll_getenv]
pop ecx
mov ecx, 0x1053ac9c
test eax, eax
cmovne ecx, eax
mov dword [sym.php5.dll_php_ini_scanned_path], ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003ef0c
sub ecx, edx
cmp dword [0x10667c28], 0
jne 0x1003ef26
test ecx, ecx
jne 0x103adfe4
mov dword [sym.php5.dll_php_ini_scanned_path], ebx
mov eax, dword [0x10667c4c]
test eax, eax
jne 0x103ae2fa
xor eax, eax
mov ecx, dword [esp + 0x204]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10311bec
mov esp, ebp
pop ebp
ret
push edi
call eax
pop ecx
jmp 0x1003ebe5
or eax, 0xffffffff
jmp 0x1003ef3b
and dword [esp + 0x14], 0
mov ebx, edi
mov esi, edi
jmp 0x1003ed87
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea eax, [esp + 0x1f]
push eax
push esi
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x103adf1b
test esi, esi
je 0x103adf1b
push esi
lea eax, [esp + 0xfc]
push eax
push str.PHPRC
call edi
mov ebx, 0x1053ac9c
lea ecx, [esp + 0xf8]
test eax, eax
cmovne ebx, ecx
jmp 0x1003ec45
mov ebx, 0x1053ac9c
jmp 0x1003ec45
cmp byte [esi], 0
je 0x103adf39
push edi
push 0x1053c5cc
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push edi
push ebx
push esi
call sym.php5.dll_php_strlcat
add esp, 0xc
push ebx
call sym.php5.dll__efree
pop ecx
jmp 0x1003ec90
test edi, edi
jne 0x1003edac
mov edx, dword [esp + 0x3c]
jmp 0x1003ee1b
push dword [sym.php5.dll_sapi_module]
xor ebx, ebx
push str.php__s.ini
lea eax, [esp + 0x18]
push ebx
push eax
call sym.php5.dll_spprintf
mov edi, sym.php5.dll_php_ini_opened_path
push edi
push esi
push 0x1054724c
push dword [esp + 0x2c]
call sym.php5.dll_php_fopen_with_path
push dword [esp + 0x30]
mov dword [esp + 0x60], eax
call sym.php5.dll__efree
mov edx, dword [esp + 0x60]
add esp, 0x24
test edx, edx
je 0x103adfb4
mov eax, dword [sym.php5.dll_php_ini_opened_path]
mov dword [esp + 0x34], eax
jmp 0x1003ee1d
push edi
push esi
push 0x1054724c
push str.php.ini
call sym.php5.dll_php_fopen_with_path
mov ecx, dword [esp + 0x44]
mov edx, eax
add esp, 0x10
test edx, edx
cmovne ecx, dword [sym.php5.dll_php_ini_opened_path]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], ecx
jmp 0x1003ee1d
push 1
push sym.php5.dll_free_estring
lea eax, [esp + 0xb0]
push 4
push eax
mov dword [esp + 0x24], ebx
call sym.php5.dll_zend_llist_init
push 0x3c
lea eax, [esp + 0x80]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0x1c
push dword [sym.php5.dll_php_ini_scanned_path]
call sym.php5.dll__estrdup
pop ecx
mov dword [esp + 0x24], eax
mov esi, eax
test eax, eax
je 0x103ae23a
push 0x3b
push esi
call dword [sym.imp.MSVCR110.dll_strchr]
mov ebx, eax
pop ecx
pop ecx
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x103ae049
mov byte [ebx], 0
inc ebx
mov dword [esp + 0x10], ebx
cmp byte [esi], 0
mov ecx, 0x1053ac9c
cmovne ecx, esi
mov edi, ecx
mov dword [esp + 0x28], ecx
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x103ae05d
sub edi, edx
test edi, edi
jle 0x103ae228
push sym.php5.dll_php_alphasort
push 0
lea eax, [esp + 0x24]
push eax
push ecx
call sym.php5.dll_php_scandir
add esp, 0x10
mov dword [esp + 0x20], eax
test eax, eax
jle 0x103ae228
mov ebx, dword [esp + 0x1c]
xor esi, esi
test eax, eax
jle 0x103ae21c
mov eax, dword [ebx + esi*4]
add eax, 0xa
push 0x2e
push eax
call dword [sym.imp.MSVCR110.dll_strrchr]
pop ecx
pop ecx
test eax, eax
je 0x103ae207
push 5
push str..ini
push eax
call sub.MSVCR110.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x103ae207
mov ecx, dword [esp + 0x28]
and dword [0x106605f4], eax
and dword [0x10660238], eax
mov al, byte [edi + ecx - 1]
cmp al, 0x2f
je 0x103ae110
cmp al, 0x5c
je 0x103ae110
mov eax, dword [ebx + esi*4]
add eax, 0xa
push eax
push 0x5c
push ecx
push str._s_c_s
lea eax, [esp + 0x108]
push 0x104
push eax
call sym.php5.dll_ap_php_snprintf
add esp, 0x18
jmp 0x103ae132
mov eax, dword [ebx + esi*4]
add eax, 0xa
push eax
push ecx
push str._s_s
lea eax, [esp + 0x104]
push 0x104
push eax
call sym.php5.dll_ap_php_snprintf
add esp, 0x14
push 0
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x100]
push eax
call sym.php5.dll_php_sys_stat_ex
add esp, 0xc
test eax, eax
jne 0x103ae207
mov eax, dword [esp + 0xda]
and eax, 0xf000
mov ecx, 0x8000
cmp ax, cx
jne 0x103ae207
lea eax, [esp + 0xf8]
push 0x1054724c
push eax
call dword [sym.imp.MSVCR110.dll_fopen]
pop ecx
pop ecx
mov dword [esp + 0x78], eax
test eax, eax
je 0x103ae207
push 0x106605f8
push 0x10063f40
lea eax, [esp + 0x100]
push 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x78]
push 1
push eax
mov dword [esp + 0x80], 2
call sym.php5.dll_zend_parse_ini_file
add esp, 0x14
test eax, eax
jne 0x103ae207
lea ecx, [esp + 0xf8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x103ae1ca
mov eax, dword [esp + 0x14]
sub ecx, edx
add eax, 2
add eax, ecx
mov dword [esp + 0x14], eax
push ecx
lea eax, [esp + 0xfc]
push eax
call sym.php5.dll__estrndup
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0xb4]
push eax
call sym.php5.dll_zend_llist_add_element
add esp, 0x10
push dword [ebx + esi*4]
call dword [sym.imp.MSVCR110.dll_free]
inc esi
pop ecx
cmp esi, dword [esp + 0x20]
jl 0x103ae09d
push ebx
call dword [sym.imp.MSVCR110.dll_free]
mov ebx, dword [esp + 0x14]
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x103ae02c
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
push eax
call sym.php5.dll__efree
pop ecx
test ebx, ebx
je 0x103ae2e5
mov edx, dword [sym.php5.dll_php_ini_scanned_files]
test edx, edx
je 0x103ae266
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x103ae258
sub ecx, esi
lea edi, [ecx + 1]
jmp 0x103ae268
xor edi, edi
add ebx, edi
lea eax, [ebx + 1]
push eax
push edx
call dword [sym.imp.MSVCR110.dll_realloc]
pop ecx
pop ecx
mov dword [sym.php5.dll_php_ini_scanned_files], eax
test edi, edi
jne 0x103ae288
mov byte [eax], 0
mov eax, dword [sym.php5.dll_php_ini_scanned_files]
mov esi, dword [esp + 0xa8]
test esi, esi
je 0x103ae2e5
test edi, edi
je 0x103ae2ab
push ebx
push 0x10622d90
push eax
call sym.php5.dll_php_strlcat
mov eax, dword [sym.php5.dll_php_ini_scanned_files]
add esp, 0xc
push ebx
push dword [esi + 8]
push eax
call sym.php5.dll_php_strlcat
add esp, 0xc
cmp dword [esi], 0
mov ecx, 0x105494a0
mov eax, 0x10622d90
cmove eax, ecx
push ebx
push eax
push dword [sym.php5.dll_php_ini_scanned_files]
call sym.php5.dll_php_strlcat
mov esi, dword [esi]
add esp, 0xc
test esi, esi
je 0x103ae2e5
mov eax, dword [sym.php5.dll_php_ini_scanned_files]
jmp 0x103ae293
lea eax, [esp + 0xa8]
push eax
call sym.php5.dll_zend_llist_destroy
pop ecx
xor ebx, ebx
jmp 0x1003ef2c
push 0x106605f8
push 0x10063f40
push ebx
push 1
push eax
mov dword [0x106605f4], ebx
mov dword [0x10660238], ebx
call sym.php5.dll_zend_parse_ini_string
add esp, 0x14
jmp 0x1003ef39