Function at 0x420972
Capabilities:
Create directory
Query environment variable

Disassembly:
mov eax, 0x441fba
call fcn.0043e4e0
sub esp, 0x144
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push 0x66
call sub.MFC42.DLL_CDialog::CDialog
xor ebx, ebx
mov dword [esi + 0x6c], 0x44615c
mov dword [ebp - 4], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 1
call fcn.0041ffa7
mov dword [esi + 0x898], ebx
mov dword [esi + 0xd4c], ebx
mov dword [esi + 0x1200], ebx
mov dword [esi + 0x16b4], ebx
lea ecx, [esi + 0x16b8]
mov byte [ebp - 4], 6
call fcn.0040ba17
lea ecx, [esi + 0x2740]
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x276c]
mov byte [ebp - 4], 7
call fcn.00420be7
mov edi, 0x4558c8
push 0x448ffc
lea eax, [ebp + 8]
push edi
push eax
mov byte [ebp - 4], 8
mov dword [esi], 0x4493d8
mov dword [esi + 0x2750], ebx
mov dword [esi + 0x2754], ebx
mov dword [esi + 0x2758], ebx
mov dword [esi + 0x2768], ebx
mov dword [esi + 0x275c], ebx
mov dword [esi + 0x2760], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x2734], ebx
mov byte [esi + 0x274c], bl
mov byte [esi + 0x2744], bl
mov byte [esi + 0x3e4], bl
mov dword [esi + 0x68], ebx
mov dword [esi + 0x64], 1
call sub.MFC42.DLL_operator_4
push dword [eax]
lea ecx, [esi + 0x16b8]
mov byte [ebp - 4], 9
call fcn.0040bbe2
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
cmp byte [esi + 0x1805], bl
je 0x420ad9
mov al, byte [0x4550cc]
push 0x40
mov byte [ebp - 0x150], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x14f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x150]
push 0x102
push eax
lea eax, [esi + 0x1808]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x420ac5
lea eax, [ebp - 0x150]
mov ecx, 0x4558c4
push eax
call sub.MFC42.DLL_CString::operator_2
push ebx
push dword [0x4558c4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, 0x4558c8
jmp 0x420ae4
push edi
mov ecx, 0x4558c4
call sub.MFC42.DLL_CString::operator_1
mov dword [esi + 0x273c], ebx
mov dword [esi + 0x2730], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push str.user32.dll
mov dword [esi + 0x2748], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SendInput
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, esi
mov dword [esi + 0x2764], eax
call fcn.0042211b
push 0x449004
lea eax, [ebp + 8]
push edi
push eax
call sub.MFC42.DLL_operator_4
push dword [eax]
lea ecx, [esi + 0xd50]
mov byte [ebp - 4], 0xa
call fcn.00428731
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea eax, [esi + 0x1d8c]
push eax
lea eax, [esi + 0x1d4c]
push eax
call fcn.0041afa6
pop ecx
cmp eax, ebx
pop ecx
mov dword [esi + 0x2728], eax
jne 0x420b70
call fcn.0041b04d
lea eax, [esi + 0x1dcc]
push 0x3f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x4c]
mov dword [esi + 0x2738], ebx
push eax
push 0x3c
push 0x11
mov dword [esi + 0x74], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x3c], 0x2bc
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esi + 0x6c]
call sub.MFC42.DLL_CGdiObject::Attach
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4