Function at 0x10003720
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021cb3
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push esi
push edi
mov eax, dword [0x1002b024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0x88]
xor edi, edi
push ecx
mov dword [ebp - 4], edi
call fcn.10004180
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x10003ad0
cmp dword [ebp + 0xc], edi
je 0x10003ad0
mov byte [ebp - 4], 2
xor edx, edx
mov ecx, eax
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x5c], edi
mov word [ebp - 0x6c], dx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x10003797
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x70]
call fcn.100020c0
mov eax, esi
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.1000ea40
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x58], 8
mov esi, eax
jb 0x100037dc
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.10012c74
add esp, 4
cmp esi, edi
je 0x10003820
mov eax, dword [ebp - 0x78]
mov ecx, eax
sub ecx, dword [ebp - 0x7c]
je 0x10003820
cmp ecx, edi
ja 0x100037f6
call fcn.1001346d
mov eax, dword [ebp - 0x78]
mov ebx, dword [ebp - 0x7c]
sub eax, ebx
mov edi, eax
lea eax, [esi - 1]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
cmp eax, 0xa
ja case.0x1000380f.6
jmp dword [eax*4 + 0x10003b18]
mov edi, ebx
lea esi, [ebp - 0x2c]
call fcn.10003220
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
xor edi, edi
mov word [ebp - 0x2c], di
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], esi
mov eax, dword [ebp - 0x7c]
xor esi, esi
cmp eax, esi
je 0x10003852
push eax
call fcn.10012c74
add esp, 4
mov ecx, dword [ebp - 0x88]
push ecx
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
call fcn.10012c74
add esp, 4
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, ebx
lea esi, [ebp - 0x2c]
call fcn.10003220
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test esi, esi
jbe 0x10003820
lea edx, [ebp - 0x54]
lea edi, [esi + 1]
push edx
lea ebx, [ebp + 8]
mov dword [ebp + 8], 0
call fcn.100041e0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 1
jne 0x100038d5
call fcn.1001346d
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10003902
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 1
jne 0x100038f7
call fcn.1001346d
mov edi, dword [ebp - 0x48]
lea esi, [ebp - 0x2c]
call fcn.10003220
mov eax, dword [ebp - 0x48]
xor esi, esi
cmp eax, esi
je 0x10003914
push eax
call fcn.10012c74
add esp, 4
mov ecx, dword [ebp - 0x54]
push ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
call fcn.10012c74
add esp, 4
jmp 0x10003820
cmp word [ebp - 0x2c], 0x13
mov esi, dword [ebx]
je 0x10003954
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x1000394b
push eax
call fcn.1001cb90
mov eax, 0x13
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x24], esi
jmp 0x10003820
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
push ecx
push edx
lea esi, [ebp - 0x2c]
call fcn.10003260
jmp 0x10003820
mov eax, edi
lea esi, [ebp + 8]
call fcn.10003e20
mov bl, 5
mov byte [ebp - 4], bl
xor esi, esi
cmp esi, edi
jae 0x100039cb
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x7c]
cmp esi, eax
jb 0x10003994
call fcn.1001346d
mov ecx, dword [ebp - 0x7c]
mov al, byte [ecx + esi]
mov edx, 0x11
mov word [ebp - 0x3c], dx
mov byte [ebp - 0x34], al
lea eax, [ebp - 0x3c]
push eax
mov eax, esi
lea edi, [ebp + 8]
mov byte [ebp - 4], 6
call fcn.100032e0
lea ecx, [ebp - 0x3c]
push ecx
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, dword [ebp - 0x18]
inc esi
jmp 0x10003981
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [ebp + 8]
mov eax, 0x200c
mov word [ebp - 0x4c], ax
push ecx
call dword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x4c]
lea edi, [ebp - 0x2c]
mov dword [ebp + 8], 0
mov dword [ebp - 0x44], eax
call fcn.100032a0
lea esi, [ebp + 8]
call fcn.10003e70
jmp 0x10003820
xor eax, eax
lea esi, [ebp + 8]
call fcn.10003e20
mov byte [ebp - 4], 7
mov edi, ebx
lea ecx, [ecx]
cmp word [edi], 0
je 0x10003a65
lea esi, [ebp - 0x64]
call fcn.100031f0
push eax
lea eax, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.10003ea0
mov edx, esi
push edx
mov byte [ebp - 4], 7
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003a50
sub eax, edx
sar eax, 1
lea edi, [edi + eax*2 + 2]
jmp 0x10003a20
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, dword [ebp + 8]
mov ecx, 0x200c
mov word [ebp - 0x4c], cx
push edx
jmp 0x100039e2
push 0x10026b2c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0xffffffff
call fcn.10014cdc
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x10003aaa
push eax
call fcn.1001cb90
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov eax, 0x10003840
ret
mov eax, dword [ebp - 0x7c]
cmp eax, edi
je 0x10003ae0
push eax
call fcn.10012c74
add esp, 4
mov eax, dword [ebp - 0x88]
push eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
call fcn.10012c74
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8