Function at 0x1008cb1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1010004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x10102ec], edi
je 0x1008d2e
mov al, byte [0x10102f0]
cmp al, 4
jae 0x1008ce0
test al, al
jne 0x1008d2e
mov eax, dword [0x10102d8]
mov ecx, dword [0x10102dc]
mov edx, 0x10000
mov ebx, 0x80000000
and eax, edx
and ecx, ebx
or eax, ecx
je 0x1008d2e
mov eax, dword [0x10102e0]
mov esi, dword [0x10102e4]
mov ecx, eax
and ecx, edx
mov edx, esi
and edx, ebx
cmp ecx, eax
jne 0x1008d2e
cmp edx, esi
jne 0x1008d2e
push 0x10014b8
push dword [0x10102c4]
push dword [0x10102c0]
call fcn.01008a1f
lea eax, [ebp - 0x418]
push eax
push 0x1001e8c
push 0x17
push edi
push 0x1002af4
mov dword [ebp - 0x418], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
cmp ebx, edi
jl 0x1008ebd
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
cmp ebx, edi
jl 0x1008ebd
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
lea edx, [ebp - 0x424]
push edx
push eax
call dword [ecx + 0x2c]
mov ebx, eax
cmp ebx, edi
jl 0x1008ebd
mov eax, dword [ebp - 0x418]
lea edx, [ebp - 0x41c]
push edx
push dword [ebp - 0x424]
mov dword [ebp - 0x41c], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov ebx, eax
cmp ebx, edi
jl 0x1008eab
mov eax, dword [ebp - 0x41c]
cmp eax, edi
je 0x1008ebd
lea edx, [ebp - 0x420]
push edx
push 0xffffffffffffffff
mov dword [ebp - 0x420], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
mov ebx, eax
cmp ebx, edi
jl 0x1008e9f
push dword [ebp - 0x420]
mov esi, 0x80000001
push 0x1001e58
push 0x1001cb8
push esi
call fcn.0100d063
mov ebx, eax
cmp ebx, edi
jl 0x1008e9f
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
push 0x1001fc4
push 0x1001f60
push esi
call fcn.0100d03f
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jl 0x1008e68
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
test eax, eax
jne 0x1008e4b
call fcn.010081a4
test eax, eax
jl 0x1008e68
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push 0x40
lea edx, [ebp - 0x20c]
push edx
push 0
push eax
call dword [ecx + 0x50]
mov ebx, eax
test ebx, ebx
jge 0x1008e9f
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x1001ee8
call esi
test eax, eax
jne 0x1008e86
call fcn.010081a4
mov ebx, eax
test ebx, ebx
jl 0x1008e9f
mov eax, dword [ebp - 0x418]
mov ecx, dword [eax]
push 0x40
lea edx, [ebp - 0x20c]
push edx
push 0
push eax
call dword [ecx + 0x50]
mov ebx, eax
push dword [ebp - 0x420]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x41c]
xor edi, edi
cmp eax, edi
je 0x1008ebd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0x10102ec], edi
je 0x1008f20
mov al, byte [0x10102f0]
cmp al, 4
jae 0x1008ed2
test al, al
jne 0x1008f20
mov eax, dword [0x10102d8]
mov ecx, dword [0x10102dc]
mov edx, 0x10000
mov edi, 0x80000000
and eax, edx
and ecx, edi
or eax, ecx
je 0x1008f20
mov eax, dword [0x10102e0]
mov esi, dword [0x10102e4]
mov ecx, eax
and ecx, edx
mov edx, esi
and edx, edi
cmp ecx, eax
jne 0x1008f20
cmp edx, esi
jne 0x1008f20
push 0x10014c8
push dword [0x10102c4]
push dword [0x10102c0]
call fcn.01008a1f
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x1008f30
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01009ac9
leave
ret