Function at 0x1002c3a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acfe4
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x100d65e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
mov dword [ebp - 4], 1
xor eax, eax
cmp eax, str._tmp_
jne 0x1002c44e
xor ecx, ecx
lea edx, [ecx + 1]
jmp 0x1002c430
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c430
sub ecx, edx
jne 0x1002c44e
lea eax, [ebp - 0x440]
push eax
mov ecx, ebx
call fcn.1000fc40
jmp 0x1002c910
push 0x3ff
lea eax, [ebp - 0x40f]
push 0
push eax
mov byte [ebp - 0x410], 0
call fcn.1007f340
add esp, 0xc
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x494], 0
call fcn.1002a230
mov esi, eax
mov byte [ebp - 4], 2
cmp dword [esi + 0x10], 0
jne 0x1002c885
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x474], 8
jb 0x1002c4b3
push dword [ebp - 0x488]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x474], 7
mov dword [ebp - 0x478], 0
mov word [ebp - 0x488], ax
test edi, edi
je 0x1002c850
push 0xc
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
push str.Wtsapi32.dll
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x45c], 7
mov dword [ebp - 0x460], eax
mov word [ebp - 0x470], ax
call fcn.1000f9f0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x460], 0
je 0x1002c558
cmp dword [ebp - 0x45c], 8
lea eax, [ebp - 0x470]
cmovae eax, dword [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
jne 0x1002c55a
cmp dword [ebp - 0x45c], 8
lea eax, [ebp - 0x470]
cmovae eax, dword [ebp - 0x470]
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x1002c55a
xor ebx, ebx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x45c], 8
jb 0x1002c575
push dword [ebp - 0x470]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x45c], 7
mov dword [ebp - 0x460], 0
mov word [ebp - 0x470], ax
test ebx, ebx
je 0x1002c84a
push 0xb
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], eax
push str.Userenv.dll
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], eax
mov word [ebp - 0x458], ax
call fcn.1000f9f0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x448], 0
je 0x1002c62a
cmp dword [ebp - 0x444], 8
lea eax, [ebp - 0x458]
cmovae eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov dword [ebp - 0x490], esi
test esi, esi
jne 0x1002c632
cmp dword [ebp - 0x444], 8
lea eax, [ebp - 0x458]
cmovae eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x490], esi
test esi, esi
jne 0x1002c632
xor esi, esi
mov dword [ebp - 0x490], esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x444], 8
jb 0x1002c64d
push dword [ebp - 0x458]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], ax
test esi, esi
je 0x1002c84a
push 0xc
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
push str.advapi32.dll
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x414], 7
mov dword [ebp - 0x418], eax
mov word [ebp - 0x428], ax
call fcn.1000f9f0
mov byte [ebp - 4], 5
cmp dword [ebp - 0x418], 0
je 0x1002c6f6
cmp dword [ebp - 0x414], 8
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x1002c6f8
cmp dword [ebp - 0x414], 8
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x1002c6f8
xor esi, esi
mov byte [ebp - 4], 1
cmp dword [ebp - 0x414], 8
jb 0x1002c713
push dword [ebp - 0x428]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x414], 7
mov dword [ebp - 0x418], 0
mov word [ebp - 0x428], ax
test esi, esi
je 0x1002c84a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100bdbe0
push edi
call esi
mov dword [ebp - 0x49c], eax
test eax, eax
je 0x1002c84a
push 0x100bdc00
push ebx
call esi
mov edi, eax
test edi, edi
je 0x1002c84a
push str.ExpandEnvironmentStringsForUserA
push dword [ebp - 0x490]
call esi
mov esi, eax
test esi, esi
je 0x1002c84a
push 0xe
xor eax, eax
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
push str.SeTcbPrivilege
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x414], 7
mov dword [ebp - 0x418], 0
mov word [ebp - 0x428], ax
call fcn.1000f9f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x428]
call fcn.10030120
mov byte [ebp - 4], 1
cmp dword [ebp - 0x414], 8
jb 0x1002c7ea
push dword [ebp - 0x428]
call fcn.1007d9ed
add esp, 4
xor eax, eax
mov dword [ebp - 0x414], 7
mov dword [ebp - 0x418], 0
mov word [ebp - 0x428], ax
call dword [ebp - 0x49c]
lea ecx, [ebp - 0x494]
push ecx
push eax
call edi
test eax, eax
je 0x1002c84a
push 0x400
lea eax, [ebp - 0x410]
push eax
push str._tmp_
push dword [ebp - 0x494]
call esi
test eax, eax
je 0x1002c84a
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
call fcn.10004b40
mov ebx, dword [ebp - 0x48c]
cmp dword [ebp - 0x430], 0
jne 0x1002c8ec
push 0x400
lea eax, [ebp - 0x410]
push eax
push str._tmp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1002c8ec
cmp byte [ebp - 0x410], 0
jne 0x1002c8c2
xor ecx, ecx
jmp 0x1002c8d9
cmp dword [esi + 0x14], 8
jb 0x1002c88f
mov eax, dword [esi]
jmp 0x1002c891
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x1002c492
cmp dword [esi + 0x14], 8
jb 0x1002c8aa
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call esi
mov edi, eax
test edi, edi
jne 0x1002c498
jmp 0x1002c498
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
jmp 0x1002c8d0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c8d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
call fcn.10010240
push dword [ebp - 0x494]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x440]
push eax
mov ecx, ebx
mov dword [ebp - 0x494], 0
call fcn.1000fc40
mov dword [ebp - 0x498], 1
mov byte [ebp - 4], 0
cmp dword [ebp - 0x42c], 0x10
jb 0x1002c935
push dword [ebp - 0x440]
call fcn.1007d9ed
add esp, 4
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007e654
mov esp, ebp
pop ebp
ret 8