Function at 0x100023e2
Capabilities:
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x105c
call fcn.100087e0
push 0x25
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrA]
test eax, eax
je 0x10002420
push 0x400
lea eax, [ebp - 0xc54]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10002420
lea eax, [ebp - 0xc54]
mov dword [ebp + 8], eax
push dword [ebp + 8]
call fcn.1000710e
pop ecx
push dword [0x1000b200]
call fcn.1000710e
pop ecx
push str..exe
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov dword [ebp - 0xc58], eax
cmp dword [ebp - 0xc58], 0
jne 0x1000245a
push 1
pop eax
jmp 0x1000262e
mov eax, dword [ebp - 0xc58]
add eax, 4
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0xc58]
and byte [eax], 0
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x10002484
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
push dword [0x1000b200]
call fcn.10007148
pop ecx
push eax
push dword [0x1000b200]
push dword [ebp + 8]
call fcn.10007095
add esp, 0xc
test eax, eax
jne 0x100024ae
push 1
pop eax
jmp 0x1000262e
mov eax, dword [0x1000b1fc]
inc eax
mov dword [0x1000b1fc], eax
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x100024cb
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
mov dword [ebp - 0x105c], eax
jmp 0x100024ea
mov eax, dword [ebp - 0x105c]
dec eax
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0
jl 0x10002508
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x105c]
movsx eax, byte [eax]
cmp eax, 0x2e
jne 0x10002506
jmp 0x10002508
jmp 0x100024dd
cmp dword [ebp - 0x105c], 0
jge 0x10002518
xor eax, eax
jmp 0x1000262e
push dword [0x1000b200]
lea eax, [ebp - 0x400]
push eax
call fcn.10007175
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
mov dword [ebp - 0x105c], eax
jmp 0x1000255b
mov eax, dword [ebp - 0x105c]
dec eax
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x105c], 0
jl 0x10002579
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x105c]
movsx eax, byte [eax]
cmp eax, 0x2e
jne 0x10002577
jmp 0x10002579
jmp 0x1000254e
mov eax, dword [ebp - 0x105c]
and byte [ebp + eax - 0x844], 0
push 0x1000a2b8
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x844]
push eax
call fcn.1000301d
pop ecx
test eax, eax
je 0x100025dd
push dword [ebp + 8]
call fcn.10002366
pop ecx
test eax, eax
je 0x100025c7
mov eax, dword [0x1000b1fc]
dec eax
mov dword [0x1000b1fc], eax
push 2
pop eax
jmp 0x1000262e
push dword [ebp + 8]
call fcn.10002e96
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100025f8
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.10001b61
pop ecx
pop ecx
test eax, eax
jne 0x1000261d
push dword [ebp + 8]
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push dword [ebp + 8]
push 0x1000ade8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
pop eax
leave
ret