Function at 0x1000721e
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x420
mov eax, 0x100dc654
call fcn.10001af6
mov ebx, ecx
cmp dword [0x1017ca30], 0
jne 0x1000746e
push 0x1017bde0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [0x1017ca30], 0
jne 0x10007463
push ecx
lea ecx, [ebp - 0x42c]
call fcn.10001e74
and dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
test eax, eax
jle 0x10007285
cmp eax, edi
jb 0x10007299
push 0xffffffffffffffff
push 0x100f6a24
lea eax, [ebp - 0x218]
push edi
push eax
call esi
add esp, 0x10
push edi
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x100072dd
cmp eax, edi
jae 0x100072dd
lea esi, [ebp + eax - 0x115]
cmp byte [esi], 0x5c
je 0x100072da
lea eax, [ebp - 0x114]
cmp esi, eax
jbe 0x100072d5
cmp byte [esi], 0x2e
jne 0x100072cf
mov byte [esi], 0
dec esi
cmp byte [esi], 0x5c
jne 0x100072bd
cmp byte [esi], 0x5c
jne 0x100072f7
inc esi
jmp 0x100072f7
push 0xffffffffffffffff
push 0x100f6a28
lea eax, [ebp - 0x114]
push edi
push eax
call esi
add esp, 0x10
lea esi, [ebp - 0x114]
push edi
lea eax, [ebp - 0x420]
push eax
push 0x100f6a2c
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
cmp dword [0x1017ca10], 0
mov edi, eax
push 4
je 0x1000731f
pop ecx
call fcn.1000b2b4
jmp 0x10007326
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
test eax, eax
je 0x10007339
mov dword [eax], 0x1017c79c
lock inc dword [0x1017c790]
jmp 0x1000733b
xor eax, eax
lea ecx, [ebp - 0x218]
mov dword [0x1017ca30], eax
push ecx
mov ecx, eax
call fcn.1000b2b4
test esi, esi
lea ecx, [ebp - 0x424]
mov eax, 0x100ea6e8
cmovne eax, esi
push eax
call fcn.1000b2b4
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x424]
mov ecx, dword [0x1017ca30]
push dword [esi - 4]
mov eax, dword [ecx]
push esi
push 0
push dword [eax - 4]
call fcn.1000b2b4
lea ecx, [esi - 0xc]
mov byte [ebp - 4], 0
call sym.fpsrvutl.dll_Ordinal_5727
mov ecx, dword [0x1017ca30]
push 0
mov eax, dword [ecx]
push dword [eax - 4]
push eax
call sym.fpsrvutl.dll_Ordinal_1496
test edi, edi
je 0x100073f3
cmp edi, 0x104
je 0x100073f3
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x424]
call sym.fpsrvutl.dll_Ordinal_150
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x424]
mov ecx, dword [0x1017ca30]
push dword [eax - 4]
mov edx, dword [ecx]
push eax
push 0
push dword [edx - 4]
call fcn.1000b2b4
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
push str..log
lea ecx, [ebp - 0x428]
call fcn.1000b2b4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x428]
mov eax, dword [ebp - 0x428]
push 0
push dword [eax - 4]
push eax
call sym.fpsrvutl.dll_Ordinal_1496
mov eax, dword [ebp - 0x428]
mov ecx, dword [0x1017ca30]
push dword [eax - 4]
push eax
mov eax, dword [ecx]
push 0
push dword [eax - 4]
call fcn.1000b2b4
mov eax, dword [ebx]
push str.Microsoft_SharePoint_Foundation_log_file
push 3
push ebx
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x428]
add esp, 0xc
lea ecx, [ecx - 0xc]
call sym.fpsrvutl.dll_Ordinal_5727
lea ecx, [ebp - 0x42c]
call fcn.1000221e
push 0x1017bde0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10001b2d
ret