Function at 0x403171
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
test byte [ebp + 0x10], 1
mov dword [ebp - 4], edi
je 0x40329c
push 0x40
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 0x40
push eax
call fcn.00401fe0
mov esi, eax
test esi, esi
js 0x4033b5
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x4031f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4031d9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4031e0
mov esi, 0x80004005
push esi
push pe_nt_image_headers32
push str.c:_agent_work66_s_srclibsdutilpathutil.cpp
call fcn.004038ba
jmp 0x4033b5
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x40325e
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.00401fe0
mov esi, eax
test esi, esi
js 0x4033b5
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x403248
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403239
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x403240
mov esi, 0x80004005
push esi
push 0x113
jmp 0x4031e6
mov ebx, dword [ebp - 0xc]
cmp ebx, eax
jae 0x40325e
mov eax, 0x8007007a
push eax
mov esi, eax
push 0x118
jmp 0x4031e6
cmp eax, 0x104
jbe 0x403299
lea eax, [ebp - 4]
push eax
call fcn.0040367d
lea esi, [eax + 0x7ff8ffa9]
neg esi
sbb esi, esi
and esi, eax
jl 0x4033b5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.00402847
mov esi, eax
test esi, esi
js 0x4033b5
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
test byte [ebp + 0x10], 2
je 0x40339a
and dword [ebp + 0x10], 0
test edi, edi
jne 0x4032b1
mov edi, dword [ebp + 0xc]
cmp ebx, 0x40
ja 0x4032b9
push 0x40
pop ebx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00401fe0
mov esi, eax
test esi, esi
js 0x4033b5
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x403309
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4032f7
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4032fe
mov esi, 0x80004005
push esi
push 0x139
jmp 0x4031e6
cmp ebx, eax
jae 0x40337f
mov ebx, eax
cmp eax, 0x104
jb 0x403319
lea ebx, [eax + 7]
push ebx
lea eax, [ebp - 8]
push eax
call fcn.00401fe0
mov esi, eax
test esi, esi
js 0x4033b5
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x403369
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x403357
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40335e
mov esi, 0x80004005
push esi
push 0x144
jmp 0x4031e6
cmp ebx, eax
jae 0x40337f
mov eax, 0x8007007a
push eax
mov esi, eax
push 0x149
jmp 0x4031e6
cmp eax, 0x104
jbe 0x403395
lea eax, [ebp - 8]
push eax
call fcn.0040367d
mov esi, eax
test esi, esi
js 0x4033b5
mov edi, dword [ebp - 8]
jmp 0x4033a1
and dword [ebp - 4], 0
mov dword [ebp - 8], edi
test edi, edi
jne 0x4033a8
mov edi, dword [ebp + 0xc]
push 0
push edi
push dword [ebp + 8]
call fcn.0040229e
mov esi, eax
cmp dword [ebp - 8], 0
je 0x4033c3
push dword [ebp - 8]
call fcn.00402762
cmp dword [ebp - 4], 0
je 0x4033d1
push dword [ebp - 4]
call fcn.00402762
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc