Function at 0x10ab3c0
Capabilities:
Delete file
Query environment variable
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10b1058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x118], edi
jl 0x10ab773
cmp ebx, 3
jae 0x10ab773
test edi, edi
je 0x10ab773
mov eax, ebx
imul eax, eax, 0x34
lea esi, [eax + 0x10b9260]
cmp dword [esi], 0
mov dword [ebp - 0x114], esi
je 0x10ab41f
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x10ab776
mov esi, 0x10a5dd0
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x10ab445
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x10ab445
push 0xfffffffffffffff5
jmp 0x10ab775
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10a5dc0
push edi
call esi
push 0x10a5dac
push edi
mov dword [0x10b9308], eax
call esi
push 0x10a5d94
push edi
mov dword [0x10b930c], eax
call esi
xor ecx, ecx
cmp dword [0x10b9308], ecx
mov dword [0x10b9310], eax
je 0x10ab43e
cmp dword [0x10b930c], ecx
je 0x10ab43e
cmp eax, ecx
je 0x10ab43e
mov edi, dword [ebx*4 + 0x10b8ca4]
push 2
mov dword [ebp - 0x10c], ecx
mov esi, 0x10a5b94
pop ebx
mov eax, dword [esi]
mov ecx, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10ab4bf
test dl, dl
je 0x10ab4bb
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10ab4bf
add eax, ebx
add ecx, ebx
test dl, dl
jne 0x10ab4a1
xor eax, eax
jmp 0x10ab4c4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10ab4d9
inc dword [ebp - 0x10c]
add esi, 0x20
cmp esi, 0x10a5d74
jl 0x10ab49d
cmp dword [ebp - 0x10c], 0xf
jne 0x10ab4e9
push 0xfffffffffffffffb
jmp 0x10ab775
push 0x10a5d8c
call dword [sym.imp.msvcrt.dll_getenv]
mov edi, eax
test edi, edi
pop ecx
je 0x10ab43e
push 1
push edi
call fcn.010ab0d2
test eax, eax
jne 0x10ab776
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab514
sub eax, edx
inc eax
mov esi, 0x104
cmp eax, esi
jae 0x10ab538
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab52c
sub eax, edx
inc eax
jmp 0x10ab53a
mov eax, esi
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, edi
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10ab550
sub eax, ecx
inc eax
cmp eax, esi
jae 0x10ab56f
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab563
sub eax, edx
lea esi, [eax + 1]
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x109], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10ab580
sub eax, ecx
mov edi, 0x103
mov ecx, edi
sub ecx, eax
cmp ecx, ebx
jbe 0x10ab59a
mov ecx, ebx
jmp 0x10ab5b0
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab5a3
sub eax, edx
mov ecx, edi
sub ecx, eax
push ecx
lea eax, [ebp - 0x108]
push 0x10a5d84
push eax
call dword [sym.imp.msvcrt.dll_strncat]
mov esi, dword [ebp - 0x10c]
shl esi, 5
mov eax, dword [esi + 0x10a5b94]
add esp, 0xc
test eax, eax
jne 0x10ab5dd
xor ecx, ecx
jmp 0x10ab5eb
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab5e0
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x108]
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10ab5f4
sub eax, ebx
mov edx, edi
sub edx, eax
inc ecx
cmp ecx, edx
jae 0x10ab621
mov eax, dword [esi + 0x10a5b94]
test eax, eax
je 0x10ab61c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab613
sub eax, edx
lea ecx, [eax + 1]
jmp 0x10ab637
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10ab62a
sub eax, edx
mov ecx, edi
sub ecx, eax
push ecx
push dword [esi + 0x10a5b94]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll_strncat]
add esp, 0xc
push 0x10a5d88
lea eax, [ebp - 0x108]
push eax
call fcn.010ab299
mov edi, eax
test edi, edi
je 0x10ab43e
push edi
push dword [esi + 0x10a5b98]
push 1
push dword [esi + 0x10a5ba8]
call dword [sym.imp.msvcrt.dll_fwrite]
push edi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
push 0
lea eax, [ebp - 0x108]
push eax
call dword [0x10b9310]
mov edi, eax
push edi
call dword [sym.imp.msvcrt.dll_malloc]
and dword [ebp - 0x10c], 0
mov ebx, eax
test ebx, ebx
pop ecx
je 0x10ab727
push ebx
push edi
push 0
lea eax, [ebp - 0x108]
push eax
call dword [0x10b930c]
test eax, eax
je 0x10ab727
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x10a5d84
push ebx
call dword [0x10b9308]
test eax, eax
je 0x10ab727
push dword [esi + 0x10a5ba0]
call fcn.010aaf28
mov ecx, dword [ebp - 0x110]
mov edi, dword [ebp - 0x114]
mov dword [ecx + 0x30], eax
mov eax, edx
push 0xd
sar eax, 0x1f
mov eax, dword [ebp - 0x110]
mov dword [eax + 0x2c], edx
mov esi, dword [ebp - 0x110]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x110]
mov edi, dword [ebp - 0x118]
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10ab731
mov dword [ebp - 0x10c], 0xfffffff5
test ebx, ebx
mov esi, dword [sym.imp.msvcrt.dll_free]
je 0x10ab73f
push ebx
call esi
pop ecx
lea eax, [ebp - 0x108]
push eax
call fcn.010aabe5
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov ebx, eax
je 0x10ab764
push edi
call esi
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10c]
jmp 0x10ab776
push 0xfffffffffffffffe
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010a919f
leave
ret 8