Function at 0x9e8b20
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xa89016
push eax
mov dword fs:[0], esp
sub esp, 0x2a4
xor edx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c4]
push edi
xor edi, edi
mov al, byte [esi]
mov ecx, esi
test al, al
je 0x9e8b73
cmp al, 0x5c
je 0x9e8b65
cmp al, 0x2f
je 0x9e8b65
cmp al, 0x2e
jne 0x9e8b67
mov edx, 1
jmp 0x9e8b67
xor edx, edx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x9e8b52
cmp edx, edi
jne 0x9e8b7e
mov eax, dword [esp + 0x2cc]
cmp eax, edi
jne 0x9e8b83
mov eax, 0xab4cd8
push eax
push esi
lea eax, [esp + 0x1c]
push str._s_s
push eax
call fcn.009e3530
add esp, 0x10
mov dword [esp + 0x2bc], edi
mov dword [esp + 0x10], edi
mov ebp, dword [esp + 0x14]
mov byte [esp + 0x2bc], 1
cmp byte [ebp + 1], 0x3a
je 0x9e8e1a
cmp byte [ebp], 0x5c
je 0x9e8e1a
mov eax, dword [esp + 0x2c4]
mov esi, dword [esp + 0x2d0]
cmp eax, edi
je 0x9e8be8
cmp byte [eax], 0
je 0x9e8be8
push eax
lea ecx, [esp + 0x14]
call fcn.009e36f0
jmp 0x9e8da2
lea ecx, [esp + 0x10]
push edi
push ecx
push 0xab4ff0
call fcn.009ef4c0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push ebp
push edx
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [eax]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e8d1e
lea eax, [esp + 0x1b0]
push eax
push 0x104
call fcn.009f5790
lea ecx, [esp + 0x1b0]
push ebp
push ecx
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [eax]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e8d1e
lea edx, [esp + 0x18]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x18]
push ebp
push eax
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e8d1e
lea ecx, [esp + 0x11c]
mov dword [esp + 0x11c], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x12c], 2
jne 0x9e8cee
mov al, byte [esp + 0x18]
xor edx, edx
test al, al
lea ecx, [esp + 0x18]
je 0x9e8ccb
cmp al, 0x5c
jne 0x9e8cc3
mov edx, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x9e8cbd
mov byte [edx], 0
lea edx, [esp + 0x18]
push ebp
push edx
push str._sSYSTEM_s
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e8d1e
lea eax, [esp + 0x18]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x18]
push ebp
push ecx
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e8d5a
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
lea ecx, [esp + 0x10]
test eax, eax
setne bl
mov byte [esp + 0x2bc], 0
call fcn.009e3750
lea ecx, [esp + 0x14]
mov dword [esp + 0x2bc], 0xffffffff
call fcn.009e3750
mov al, bl
jmp 0x9e8e84
lea edx, [esp + 0x18]
push 1
push edx
push 0xa9e2d4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, edi
je 0x9e8e5d
lea ebx, [eax + 1]
push ebx
call fcn.009ef3b0
add esp, 4
mov edi, eax
push ebx
push edi
push 0xa9e2d4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push edi
lea ecx, [esp + 0x14]
call fcn.009e36f0
push edi
call fcn.009ef440
add esp, 4
mov edi, dword [esp + 0x10]
mov ebx, edi
cmp byte [edi], 0x3b
jne 0x9e8dd5
push ebp
push ebx
push 0xa9edcc
push esi
mov byte [edi], 0
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e8d1e
inc edi
mov ebx, edi
jmp 0x9e8e13
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x9e8da8
mov al, byte [edi - 1]
cmp al, 0x5c
je 0x9e8ded
cmp al, 0x2f
mov eax, 0xa9ec94
jne 0x9e8df2
mov eax, 0xab4cd8
push ebp
push eax
push ebx
push str._s_s_s
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x18
test al, al
jne 0x9e8d1e
cmp byte [edi], 0
je 0x9e8e5d
jmp 0x9e8da8
push ebp
call fcn.009e8ae0
add esp, 4
test al, al
je 0x9e8e5d
mov ecx, dword [esp + 0x2d0]
push ebp
call fcn.009e36f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2bc], 0
call fcn.009e3750
lea ecx, [esp + 0x14]
mov dword [esp + 0x2bc], 0xffffffff
call fcn.009e3750
mov al, 1
jmp 0x9e8e84
lea ecx, [esp + 0x10]
mov byte [esp + 0x2bc], 0
call fcn.009e3750
lea ecx, [esp + 0x14]
mov dword [esp + 0x2bc], 0xffffffff
call fcn.009e3750
xor al, al
mov ecx, dword [esp + 0x2b4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2b0
ret