Function at 0x408e60
Capabilities:
Access peb ldr_data
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40d5f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::CFile
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0x88]
mov ebx, 1
cmp eax, ebx
mov byte [esp + 0x38], 1
jne 0x408eb1
push str.windir
jmp 0x408eb6
push str.SystemRoot
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
lea ecx, [esp + 0xc]
push eax
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x408f29
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x412098
push edx
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esi + 0x60]
mov eax, dword [esp + 0x1c]
mov ebx, 3
add esp, 0xc
mov edx, dword [ecx + 0x2c]
mov dword [esp + 0x14], eax
cmp edx, ebx
jg 0x408f1b
mov edx, dword [ecx]
lea esi, [esp + 0x18]
push esi
push eax
push ebx
call dword [edx]
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x10]
jmp 0x408fb0
cmp dword [esi + 0x88], ebx
jne 0x408f38
push str._secscwb.dat
jmp 0x408f3d
push str._system32_secscwb.dat
lea ecx, [esp + 0x10]
call fcn.0040c9dc
mov eax, dword [esp + 0xc]
push 0
push 0x9001
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x408fe7
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
mov ebx, 3
push 0x412058
push edx
mov byte [esp + 0x44], bl
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esi + 0x60]
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x14], eax
cmp dword [ecx + 0x2c], ebx
jg 0x408fa7
mov edx, dword [ecx]
lea esi, [esp + 0x18]
push esi
push eax
push ebx
call dword [edx]
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040cb50
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push 2
lea eax, [esp + 0xe]
push 0x41206c
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
mov eax, dword [esi + 0xd0]
add esp, 0xc
lea ecx, [esp + 0xa]
mov dword [esp + 0x18], ebx
push 2
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], eax
call sub.MFC42.DLL_CFile::Write
lea edx, [esp + 0x18]
push 4
push edx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFile::Write
lea eax, [esp + 0x1c]
push 4
push eax
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFile::Write
mov esi, dword [esi + 0xc8]
mov byte [esp + 9], 0x57
test esi, esi
je 0x409097
push edi
mov eax, esi
mov esi, dword [esi]
lea edx, [esp + 0xd]
push ebx
mov ecx, dword [eax + 8]
lea edi, [eax + 8]
push edx
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], eax
call sub.MFC42.DLL_CFile::Write
lea eax, [esp + 0x18]
push 4
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFile::Write
mov ecx, dword [esp + 0x18]
push ecx
push 0
mov ecx, edi
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFile::Write
test esi, esi
jne 0x40904a
pop edi
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040cb50
mov ecx, dword [esp + 0x30]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret