Function at 0x4af900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
test edi, edi
je 0x4af91c
cmp word [edi], 0
jne 0x4af926
mov dword [ebp + 8], str._TEMP_ConEmu
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4af933
cmp word [esi], 0
jne 0x4af938
mov esi, str.ConEmu.tmp
push 0x25
push edi
call fcn.004c9bca
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
add esp, 8
push 0x104
test eax, eax
je 0x4af98b
lea eax, [ebp - 0x528]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4af96b
cmp eax, 0x104
jb 0x4af995
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
push eax
push edi
push str.CreateTempFile.ExpandEnvironmentStrings__s__failed__code_u
call fcn.004aece0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
lea ecx, [ebp - 0x528]
push ecx
call ebx
lea edx, [ebp - 0x528]
push 0x3a
push edx
call fcn.004c9bca
add esp, 8
test eax, eax
je 0x4af9dd
add eax, 2
push 0x3a
push eax
call fcn.004c9bca
add esp, 8
test eax, eax
je 0x4af9dd
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 0x528]
push eax
push str.Invalid_download_path____TEMP___variable___n_s
call fcn.004aece0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x528]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x4afa09
mov ecx, dword [ebp - 4]
push 0
push edi
push str.CreateTempFile.asDir__s__failed__path_is_null
call fcn.004aece0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp word [ebp + eax*2 - 0x52a], 0x5c
lea edi, [ebp + eax*2 - 0x528]
je 0x4afa30
mov edx, 0x5c
inc eax
mov word [edi], dx
lea edi, [ebp + eax*2 - 0x528]
xor eax, eax
mov word [edi], ax
lea ecx, [ebp - 0x528]
push 0
push ecx
call fcn.0044c570
push esi
mov dword [ebp - 0xc], eax
call fcn.004c62c0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4afa5e
movzx eax, word [esi]
test ax, ax
je 0x4afa5e
cmp ax, 0x2e
jne 0x4afa63
mov esi, 0x4e5ea4
push esi
call fcn.004c62f0
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x4afa7a
mov dword [ebp + 0xc], str..tmp
push 0x70
push esi
lea edx, [ebp - 0x114]
push edx
call ebx
lea eax, [ebp - 0x114]
push 0x2e
push eax
call fcn.004ca94c
xor esi, esi
add esp, 8
cmp eax, esi
je 0x4afaa2
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x114]
sub eax, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
jmp 0x4afac0
mov edx, 0x104
mov eax, edi
jmp 0x4afad0
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x4afaf3
mov ecx, dword [ebp - 0x14]
movzx ecx, word [ecx + eax]
test cx, cx
je 0x4afaf3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4afad0
jmp 0x4afaf7
test edx, edx
jne 0x4afafa
sub eax, 2
xor edx, edx
mov word [eax], dx
test esi, esi
je 0x4afb32
mov eax, edi
lea edx, [eax + 2]
jmp 0x4afb10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4afb10
sub eax, edx
sar eax, 1
push esi
lea eax, [edi + eax*2]
push 0x5058f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
push edi
call fcn.004017b0
push 0
push 0x180
push 1
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x528]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
test eax, eax
je 0x4afb6b
cmp eax, 0xffffffff
jne 0x4afb8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp eax, 3
jne 0x4afb8d
test esi, esi
jne 0x4afb8d
mov eax, dword [ebp - 0xc]
push eax
call fcn.004c5c00
add esp, 4
test al, al
je 0x4afbdf
mov eax, dword [ebx]
test eax, eax
je 0x4afb98
cmp eax, 0xffffffff
jne 0x4afbf4
inc esi
cmp esi, 0x270f
jbe 0x4afac0
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x528]
push eax
push str.Cant_create_temp_file__s___code_u
call fcn.004aece0
mov dword [ebx], 0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4afbd3
push eax
call fcn.0044c4f0
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push 0
push ecx
mov ecx, dword [ebp - 4]
push str.CreateTempFile.asDir__s__failed
call fcn.004aece0
jmp 0x4afbc3
lea edx, [ebp - 0x528]
push 0
push edx
call fcn.0044c570
mov esi, eax
add esp, 8
test esi, esi
jne 0x4afc31
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x528]
push ecx
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
push eax
push str.Cant_allocate_memory___i_bytes_
call fcn.004aec80
mov dword [ebp - 8], esi
jmp 0x4afbc3