Function at 0x9e9290
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0xa890e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8dc
push ebx
mov ebx, dword [esp + 0x8f0]
push ebp
push esi
push edi
push ebx
push str.sprof_full_dll_path__s_d_d_d_n
lea ecx, [esp + 0x20]
call fcn.00a4fb80
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
xor esi, esi
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x8f4], edx
cmp ecx, 2
jb 0x9e9304
cmp byte [ebx + 1], 0x3a
jne 0x9e9302
mov al, byte [ebx]
cmp al, 0x61
jl 0x9e92f3
cmp al, 0x7a
jle 0x9e92fb
cmp al, 0x41
jl 0x9e9302
cmp al, 0x5a
jg 0x9e9302
mov esi, 1
jmp 0x9e9304
xor esi, esi
mov al, byte [ebx]
xor ecx, ecx
cmp al, 0x5c
sete cl
or esi, ecx
mov ecx, ebx
test al, al
je 0x9e9332
cmp al, 0x2f
je 0x9e9328
cmp al, 0x5c
je 0x9e9328
cmp al, 0x2e
jne 0x9e932a
mov ebp, 1
jmp 0x9e932a
xor ebp, ebp
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x9e9315
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
cmp ebp, edx
mov byte [esp + 0x8f4], 2
jne 0x9e9367
mov edx, dword [esp + 0x904]
lea eax, [esp + 0x10]
push edx
push ebx
push str._s_s
push eax
call fcn.009e3960
mov ebx, dword [esp + 0x20]
add esp, 0x10
xor edx, edx
cmp esi, edx
jne 0x9e9909
lea ecx, [esp + 0x24]
push edx
push ecx
push ebx
call fcn.009e5070
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
test al, al
jne 0x9e9391
push ebx
call esi
mov dword [esp + 0x24], eax
jmp 0x9e9395
mov eax, dword [esp + 0x24]
xor ebp, ebp
cmp eax, ebp
je 0x9e9402
lea edx, [esp + 0x3d0]
push 0x104
push edx
push eax
call fcn.009e54d0
mov ecx, dword [esp + 0x900]
lea eax, [esp + 0x3d0]
push eax
call fcn.009e36f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x8f4], 1
call fcn.009e3750
lea ecx, [esp + 0x10]
mov byte [esp + 0x8f4], 0
call fcn.009e3750
lea ecx, [esp + 0x18]
mov dword [esp + 0x8f4], 0xffffffff
call fcn.00a4fbe0
mov eax, 1
jmp 0x9e9a48
mov eax, dword [esp + 0x90c]
cmp eax, ebp
je 0x9e94c0
test byte [esp + 0x908], 8
je 0x9e94c0
mov dword [esp + 0x1c], ebp
push eax
mov byte [esp + 0x8f8], 5
call fcn.009e3b60
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x20]
push ebp
lea edx, [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x904], 6
call fcn.009ef4c0
add esp, 0x10
lea ecx, [esp + 0x20]
mov byte [esp + 0x8f4], 5
call fcn.009e3750
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x900]
cmp eax, ebp
je 0x9e94af
push ebx
push eax
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e94af
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
lea ecx, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0x8f4], 2
call fcn.009e3750
jmp 0x9e99c2
mov byte [esp + 0x8f4], 2
lea ecx, [esp + 0x1c]
jmp 0x9e9598
mov dword [esp + 0x1c], ebp
mov eax, dword [0xab4ff0]
mov byte [esp + 0x8f4], 3
cmp eax, ebp
je 0x9e94ea
lea eax, [esp + 0x1c]
push ebp
push eax
push 0xab4ff0
call fcn.009ef4c0
add esp, 0xc
jmp 0x9e953e
lea ecx, [esp + 0x3d0]
push 0x104
push ecx
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x3d0]
push edx
call fcn.009e3b60
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push ebp
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x904], 4
call fcn.009ef4c0
add esp, 0x10
lea ecx, [esp + 0x20]
mov byte [esp + 0x8f4], 3
call fcn.009e3750
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x900]
cmp eax, ebp
je 0x9e958c
push ebx
push eax
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e958c
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
lea ecx, [esp + 0x1c]
mov esi, eax
mov byte [esp + 0x8f4], 2
call fcn.009e3750
jmp 0x9e99c2
mov byte [esp + 0x8f4], 2
lea ecx, [esp + 0x1c]
call fcn.009e3750
lea edx, [esp + 0x4d4]
push edx
push 0x104
call fcn.009eb400
add esp, 8
cmp eax, 0x104
jae 0x9e967b
cmp eax, ebp
je 0x9e967b
lea eax, [esp + 0x4d4]
push eax
call fcn.00a7e07a
add esp, 4
cmp word [esp + eax*2 + 0x4d2], 0x5c
je 0x9e95fb
lea ecx, [esp + 0x4d4]
push ecx
call fcn.00a7e07a
add esp, 4
cmp word [esp + eax*2 + 0x4d2], 0x2f
jne 0x9e9613
lea edx, [esp + 0x4d4]
push edx
call fcn.00a7e07a
add esp, 4
mov word [esp + eax*2 + 0x4d2], bp
lea eax, [esp + 0x4d4]
lea ecx, [esp + 0x1c0]
push eax
call fcn.00a152e0
push ebx
mov ecx, eax
mov byte [esp + 0x8f8], 7
call fcn.00a15680
push eax
push 0xa9edcc
push esi
call fcn.009e3960
add esp, 0x10
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x8f4], 2
call fcn.00a155e0
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 4
test al, al
je 0x9e967b
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
jmp 0x9e99c2
lea ecx, [esp + 0x28]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x28]
push ebx
push edx
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e96bd
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
jmp 0x9e99c2
lea eax, [esp + 0x12c]
mov dword [esp + 0x12c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x13c], 2
jne 0x9e9731
mov al, byte [esp + 0x28]
xor edi, edi
test al, al
lea ecx, [esp + 0x28]
je 0x9e96fc
cmp al, 0x5c
jne 0x9e96f4
mov edi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x9e96ee
lea ecx, [esp + 0x28]
push ebx
push ecx
push str._sSYSTEM_s
push esi
mov byte [edi], 0
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e9731
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
jmp 0x9e99c2
lea edx, [esp + 0x28]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x28]
push ebx
push eax
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e9773
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
jmp 0x9e99c2
lea ecx, [esp + 0x28]
push ecx
push 0x104
call fcn.009f5790
lea edx, [esp + 0x28]
push ebx
push edx
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
je 0x9e97b4
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
jmp 0x9e99c2
lea eax, [esp + 0x28]
push 1
push eax
push 0xa9e2d4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, ebp
je 0x9e9a10
lea edi, [eax + 1]
push edi
call fcn.009ef3b0
mov ebp, eax
add esp, 4
mov dword [esp + 0x1c], ebp
push edi
push ebp
push 0xa9e2d4
mov byte [esp + 0x900], 8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, ebp
mov edi, ebp
mov dword [esp + 0x20], eax
cmp byte [edi], 0x3b
jne 0x9e9834
mov cl, byte [edi - 1]
mov byte [edi], 0
cmp cl, 0x5c
jne 0x9e9811
mov byte [edi - 1], 0
push ebx
push eax
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e9871
inc edi
mov dword [esp + 0x20], edi
jmp 0x9e9862
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x9e9862
cmp byte [edi - 1], 0x5c
jne 0x9e9846
mov byte [edi - 1], 0
push ebx
push eax
push 0xa9edcc
push esi
call fcn.009e3960
mov eax, dword [esi]
push eax
call fcn.009e8ae0
add esp, 0x14
test al, al
jne 0x9e988c
cmp byte [edi], 0
je 0x9e98eb
mov eax, dword [esp + 0x20]
jmp 0x9e97fd
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
test ebp, ebp
mov byte [esp + 0x8f4], 2
je 0x9e98ae
jmp 0x9e98a5
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
mov esi, eax
test ebp, ebp
mov byte [esp + 0x8f4], 2
je 0x9e98ae
push ebp
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x14]
mov byte [esp + 0x8f4], 1
call fcn.009e3750
lea ecx, [esp + 0x10]
mov byte [esp + 0x8f4], 0
call fcn.009e3750
lea ecx, [esp + 0x18]
mov dword [esp + 0x8f4], 0xffffffff
call fcn.00a4fbe0
mov eax, esi
jmp 0x9e9a48
test ebp, ebp
mov byte [esp + 0x8f4], 2
je 0x9e9a10
push ebp
call fcn.009ef440
add esp, 4
jmp 0x9e9a10
lea ecx, [esp + 0x1c0]
call fcn.00a155c0
push ebx
lea ecx, [esp + 0x6e0]
mov byte [esp + 0x8f8], 9
call fcn.00a15040
lea ecx, [esp + 0x1c0]
push 0
push ecx
mov ecx, eax
mov byte [esp + 0x8fc], 0xa
call fcn.00a15640
push eax
call fcn.009ef8b0
add esp, 0xc
lea ecx, [esp + 0x6dc]
test al, al
sete bl
mov byte [esp + 0x8f4], 9
call fcn.00a155e0
test bl, bl
jne 0x9e99fc
lea ecx, [esp + 0x1c0]
call fcn.00a15640
push eax
call fcn.009e8b00
add esp, 4
test al, al
je 0x9e99fc
lea ecx, [esp + 0x1c0]
call fcn.00a15680
mov esi, dword [esp + 0x900]
push eax
mov ecx, esi
call fcn.009e36f0
mov esi, dword [esi]
push esi
call fcn.009e8ac0
add esp, 4
lea ecx, [esp + 0x1c0]
mov esi, eax
mov byte [esp + 0x8f4], 2
call fcn.00a155e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x8f4], 1
call fcn.009e3750
lea ecx, [esp + 0x10]
mov byte [esp + 0x8f4], 0
call fcn.009e3750
lea ecx, [esp + 0x18]
mov dword [esp + 0x8f4], 0xffffffff
call fcn.00a4fbe0
mov eax, esi
jmp 0x9e9a48
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x8f4], 2
call fcn.00a155e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x8f4], 1
call fcn.009e3750
lea ecx, [esp + 0x10]
mov byte [esp + 0x8f4], 0
call fcn.009e3750
lea ecx, [esp + 0x18]
mov dword [esp + 0x8f4], 0xffffffff
call fcn.00a4fbe0
xor eax, eax
mov ecx, dword [esp + 0x8ec]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8e8
ret