Function at 0x4223d1
Capabilities:
Create directory
Query environment variable

Disassembly:
mov eax, 0x442476
call fcn.0043e4e0
mov eax, 0x1978
call fcn.0043e690
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x2744], 0
jne 0x422ae3
xor edi, edi
lea ecx, [ebp - 0x890]
push edi
call fcn.0040d26e
push edi
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 4], edi
call fcn.00418e5d
push edi
lea ecx, [ebp - 0xac4]
mov byte [ebp - 4], 1
call fcn.0042af2e
push edi
lea ecx, [ebp - 0xe18]
mov byte [ebp - 4], 2
call fcn.00419770
push edi
lea ecx, [ebp - 0x1984]
mov byte [ebp - 4], 3
call fcn.0041aa04
push edi
lea ecx, [ebp - 0xc60]
mov byte [ebp - 4], 4
call fcn.0042c4a8
push edi
lea ecx, [ebp - 0x1478]
mov byte [ebp - 4], 5
call fcn.0040676c
push edi
lea ecx, [ebp - 0x1080]
mov byte [ebp - 4], 6
call fcn.00403ed5
push edi
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.0040b74b
lea eax, [esi + 0x17cc]
push 4
push eax
lea eax, [ebp - 0x35c]
lea ebx, [esi + 0x16b8]
push eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x360], ebx
call sub.MSVCRT.dll_memcpy
lea eax, [esi + 0x3e8]
push 0xe001
mov dword [ebp - 0xa5c], eax
lea eax, [esi + 0x89c]
mov dword [ebp - 0xa58], eax
lea eax, [esi + 0x1204]
mov dword [ebp - 0xe5c], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xdb4], ebx
mov dword [ebp - 0x1920], ebx
mov dword [ebp - 0x1084], ebx
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 0xa60], ebx
mov dword [ebp - 0x20], ebx
call fcn.00429029
add esp, 0x14
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 9
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe05b
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0xe18]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xa
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe02a
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0xc60]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xb
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe021
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x1984]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xc
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe039
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x1478]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xd
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe057
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x1080]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xe
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe00c
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0xac4]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0xf
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x10]
push 0xe03c
push eax
call fcn.00429029
pop ecx
pop ecx
mov eax, dword [eax]
push edi
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], 0x10
call fcn.0040d958
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
call fcn.00422af4
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [eax + 0x7c]
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x890]
call fcn.00422b68
lea eax, [ebp - 0x14]
push 0xe01c
push eax
call fcn.00429029
pop ecx
mov dword [ebp - 0x10], eax
pop ecx
mov byte [ebp - 4], 0x11
call fcn.00422af4
push dword [eax + 0x7c]
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_3
push ecx
mov byte [ebp - 4], 0x12
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
push eax
push ecx
call sub.MFC42.DLL_operator_2
lea ecx, [ebp - 0x890]
call fcn.00422b31
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
push 1
mov ecx, esi
mov byte [esi + 0x2744], 1
call fcn.004221c8
lea ecx, [ebp - 0x890]
call sub.MFC42.DLL_CDialog::DoModal
and byte [esi + 0x2744], 0
cmp eax, 1
jne 0x422a18
cmp byte [esi + 0x1805], 0
je 0x4227b0
mov al, byte [0x4550cc]
push 0x40
mov byte [ebp - 0x188], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x187]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x188]
push 0x102
push eax
lea eax, [esi + 0x1808]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x42279e
lea eax, [ebp - 0x188]
mov ecx, 0x4558c4
push eax
call sub.MFC42.DLL_CString::operator_2
push 0
push dword [0x4558c4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edi, edi
jmp 0x4227bf
push 0x4558c8
mov ecx, 0x4558c4
call sub.MFC42.DLL_CString::operator_1
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push 0x448fb0
push 0x4558c4
push eax
call sub.MFC42.DLL_operator_4
mov byte [ebp - 4], 8
call fcn.00414496
mov ecx, eax
call fcn.00422b9f
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
push 0x448fb8
push 0x4558c4
push eax
call sub.MFC42.DLL_operator_4
mov ecx, dword [esi + 0x60]
call fcn.00422afd
lea eax, [ebp - 0x35c]
push 4
push eax
lea eax, [esi + 0x17cc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp byte [esi + 0x17dc], 0
je 0x422841
cmp byte [esi + 0x17e8], 0
jne 0x422841
push dword [esi + 0x1a14]
push 0x4550cc
call fcn.0042817c
pop ecx
pop ecx
jmp 0x422846
call fcn.00428249
cmp dword [0x455aa4], edi
je 0x422863
movzx eax, byte [esi + 0x17e1]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [0x455aa4]
mov eax, dword [esi + 0x2768]
cmp eax, edi
je 0x422877
movzx ecx, byte [esi + 0x17e1]
push ecx
call eax
mov eax, dword [esi + 0x275c]
cmp eax, edi
je 0x42288b
movzx ecx, byte [esi + 0x17de]
push ecx
call eax
mov eax, dword [esi + 0x2760]
cmp eax, edi
je 0x42289f
movzx ecx, byte [esi + 0x17ef]
push ecx
call eax
cmp byte [esi + 0x17e4], 0
je 0x4228c9
test dword [esi + 0x17cc], 0xffff7fff
jne 0x4228c9
push 0xffffffffffffffff
push 0x40
push 0xe027
call sub.MFC42.DLL_AfxMessageBox_1
and byte [esi + 0x17e4], 0
cmp byte [esi + 0x17e2], 0
je 0x4228f2
mov ecx, esi
call fcn.004232c4
test eax, eax
jne 0x4228eb
push 0xffffffffffffffff
push 0x10
push 0xe020
call sub.MFC42.DLL_AfxMessageBox_1
and byte [esi + 0x17e2], 0
cmp byte [esi + 0x17e3], 0
je 0x42291b
mov ecx, esi
call fcn.004233ea
test eax, eax
jne 0x422914
push 0xffffffffffffffff
push 0x10
push 0xe01f
call sub.MFC42.DLL_AfxMessageBox_1
and byte [esi + 0x17e3], 0
push 0xe
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
cmp byte [esi + 0x17c9], 0
je 0x422940
push edi
push 0xea60
push 0xe
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x11
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
cmp byte [esi + 0x1a18], 0
je 0x422965
push edi
push 0xea60
push 0x11
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0xf
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
cmp byte [esi + 0x17e5], 0
je 0x42299b
mov eax, dword [esi + 0x1d3c]
push edi
imul eax, eax, 0x3c
add eax, dword [esi + 0x1d40]
imul eax, eax, 0x3e8
push eax
push 0xf
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push dword [esi + 0x2738]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ChangeClipboardChain]
cmp byte [esi + 0x1d38], 0
mov dword [esi + 0x2738], edi
je 0x4229c8
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [esi + 0x2738], eax
cmp byte [esi + 0x17f9], 0
mov ecx, dword [esi + 0x60]
je 0x4229e1
cmp byte [ecx + 0x44], 0
jne 0x4229ec
call fcn.0040f0eb
jmp 0x4229ec
cmp byte [ecx + 0x44], 0
je 0x4229ec
call fcn.0040f11f
push 0x448ffc
lea eax, [ebp - 0x14]
push 0x4558c8
push eax
call sub.MFC42.DLL_operator_4
push dword [eax]
mov ecx, ebx
mov byte [ebp - 4], 0x14
call fcn.0040bc5c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
push 1
mov ecx, esi
call fcn.00422006
cmp dword [esi + 0x2728], edi
jne 0x422a5c
cmp byte [esi + 0x17dc], 0
je 0x422a5c
push edi
lea ecx, [ebp - 0x200]
call fcn.00414067
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 0x15
call sub.MFC42.DLL_CDialog::DoModal
lea ecx, [ebp - 0x200]
mov byte [ebp - 4], 8
call fcn.004140e9
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.0040e7e0
lea ecx, [ebp - 0x1080]
mov byte [ebp - 4], 6
call fcn.00404007
lea ecx, [ebp - 0x1478]
mov byte [ebp - 4], 5
call fcn.00406845
lea ecx, [ebp - 0xc60]
mov byte [ebp - 4], 4
call fcn.00422c65
lea ecx, [ebp - 0x1984]
mov byte [ebp - 4], 3
call fcn.0041aa8d
lea ecx, [ebp - 0xe18]
mov byte [ebp - 4], 2
call fcn.004197fa
lea ecx, [ebp - 0xac4]
mov byte [ebp - 4], 1
call fcn.00422bd3
and byte [ebp - 4], 0
lea ecx, [ebp - 0x3c4]
call fcn.00418ed0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call fcn.0040d3f6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4