Function at 0x40a6bd
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x5025d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.004a8c80
add esp, 0xc
push esi
lea eax, [ebp - 0x31f]
push ebx
push eax
mov byte [ebp - 0x320], bl
call fcn.004a8c80
add esp, 0xc
push esi
lea eax, [ebp - 0x427]
push ebx
push eax
mov byte [ebp - 0x428], bl
call fcn.004a8c80
add esp, 0xc
push esi
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.004a8c80
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0xc
inc esi
push esi
lea eax, [ebp - 0x110]
push eax
push str.ALLUSERSPROFILE
call edi
cmp eax, ebx
je 0x40a7fd
cmp eax, esi
jae 0x40a7fd
lea edx, [ebp - 0x110]
call fcn.00477a16
test eax, eax
jne 0x40a7fd
lea eax, [ebp - 0x110]
call fcn.00478422
mov ebx, str.Application_Data
mov edx, ebx
call fcn.00477a16
test eax, eax
jne 0x40a797
mov ecx, ebx
lea ebx, [ebp - 0x110]
call fcn.00478198
lea eax, [ebp - 0x110]
call fcn.0047813c
lea edx, [ebp - 0x110]
call fcn.00477a16
test eax, eax
jne 0x40a808
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
lea eax, [ebp - 0x218]
call fcn.00477a48
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.00478198
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0041b499
test eax, eax
pop ecx
pop ecx
jne 0x40a7f0
lea eax, [ebp - 0x110]
call fcn.00477999
lea eax, [ebp - 0x218]
call fcn.004199a1
jmp 0x40a808
lea eax, [ebp - 0x110]
call fcn.00477999
push esi
lea eax, [ebp - 0x320]
push eax
push str.PUBLIC
call edi
test eax, eax
je 0x40a8c8
cmp eax, esi
jae 0x40a8c8
lea edx, [ebp - 0x320]
call fcn.00477a16
test eax, eax
jne 0x40a8c8
lea eax, [ebp - 0x320]
call fcn.00478422
mov ebx, str.Application_Data
mov edx, ebx
call fcn.00477a16
test eax, eax
jne 0x40a862
mov ecx, ebx
lea ebx, [ebp - 0x320]
call fcn.00478198
lea eax, [ebp - 0x320]
call fcn.0047813c
lea edx, [ebp - 0x320]
call fcn.00477a16
test eax, eax
jne 0x40a8d3
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x218]
call fcn.00477a48
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.00478198
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0041b499
test eax, eax
pop ecx
pop ecx
jne 0x40a8bb
lea eax, [ebp - 0x320]
call fcn.00477999
lea eax, [ebp - 0x218]
call fcn.004199a1
jmp 0x40a8d3
lea eax, [ebp - 0x320]
call fcn.00477999
push esi
lea eax, [ebp - 0x428]
push eax
push str.USERPROFILE
call edi
test eax, eax
je 0x40a993
cmp eax, esi
jae 0x40a993
lea edx, [ebp - 0x428]
call fcn.00477a16
test eax, eax
jne 0x40a993
lea eax, [ebp - 0x428]
call fcn.00478422
mov edi, str.Application_Data
mov edx, edi
call fcn.00477a16
test eax, eax
jne 0x40a92d
mov ecx, edi
lea ebx, [ebp - 0x428]
call fcn.00478198
lea eax, [ebp - 0x428]
call fcn.0047813c
lea edx, [ebp - 0x428]
call fcn.00477a16
test eax, eax
jne 0x40a99e
lea eax, [ebp - 0x428]
push eax
mov ecx, esi
lea eax, [ebp - 0x218]
call fcn.00477a48
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.00478198
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0041b499
test eax, eax
pop ecx
pop ecx
jne 0x40a986
lea eax, [ebp - 0x428]
call fcn.00477999
lea eax, [ebp - 0x218]
call fcn.004199a1
jmp 0x40a99e
lea eax, [ebp - 0x428]
call fcn.00477999
lea eax, [ebp - 0x320]
push eax
call fcn.00419eca
test eax, eax
pop ecx
je 0x40a9c4
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.00477a48
pop ecx
lea eax, [ebp - 0x110]
push eax
call fcn.00419eca
test eax, eax
pop ecx
je 0x40a9dd
lea eax, [ebp - 0x110]
jmp 0x40aa09
lea eax, [ebp - 0x428]
push eax
call fcn.00419eca
test eax, eax
pop ecx
jne 0x40aa03
lea edx, [ebp - 0x110]
call fcn.00477a16
test eax, eax
lea eax, [ebp - 0x110]
je 0x40aa09
lea eax, [ebp - 0x428]
push eax
mov ecx, esi
mov eax, 0x604858
call fcn.00477a48
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8565
leave
ret