Function at 0x409cfb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x5005d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.004a7110
add esp, 0xc
push esi
lea eax, [ebp - 0x31f]
push ebx
push eax
mov byte [ebp - 0x320], bl
call fcn.004a7110
add esp, 0xc
push esi
lea eax, [ebp - 0x427]
push ebx
push eax
mov byte [ebp - 0x428], bl
call fcn.004a7110
add esp, 0xc
push esi
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], bl
call fcn.004a7110
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add esp, 0xc
inc esi
push esi
lea eax, [ebp - 0x110]
push eax
push str.ALLUSERSPROFILE
call edi
cmp eax, ebx
je 0x409e3b
cmp eax, esi
jae 0x409e3b
lea edx, [ebp - 0x110]
call fcn.00475851
test eax, eax
jne 0x409e3b
lea eax, [ebp - 0x110]
call fcn.0047625d
mov ebx, str.Application_Data
mov edx, ebx
call fcn.00475851
test eax, eax
jne 0x409dd5
mov ecx, ebx
lea ebx, [ebp - 0x110]
call fcn.00475fd3
lea eax, [ebp - 0x110]
call fcn.00475f77
lea edx, [ebp - 0x110]
call fcn.00475851
test eax, eax
jne 0x409e46
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
lea eax, [ebp - 0x218]
call fcn.00475883
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.00475fd3
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0041a4eb
test eax, eax
pop ecx
pop ecx
jne 0x409e2e
lea eax, [ebp - 0x110]
call fcn.004757d4
lea eax, [ebp - 0x218]
call fcn.004189f3
jmp 0x409e46
lea eax, [ebp - 0x110]
call fcn.004757d4
push esi
lea eax, [ebp - 0x320]
push eax
push str.PUBLIC
call edi
test eax, eax
je 0x409f06
cmp eax, esi
jae 0x409f06
lea edx, [ebp - 0x320]
call fcn.00475851
test eax, eax
jne 0x409f06
lea eax, [ebp - 0x320]
call fcn.0047625d
mov ebx, str.Application_Data
mov edx, ebx
call fcn.00475851
test eax, eax
jne 0x409ea0
mov ecx, ebx
lea ebx, [ebp - 0x320]
call fcn.00475fd3
lea eax, [ebp - 0x320]
call fcn.00475f77
lea edx, [ebp - 0x320]
call fcn.00475851
test eax, eax
jne 0x409f11
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x218]
call fcn.00475883
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.00475fd3
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0041a4eb
test eax, eax
pop ecx
pop ecx
jne 0x409ef9
lea eax, [ebp - 0x320]
call fcn.004757d4
lea eax, [ebp - 0x218]
call fcn.004189f3
jmp 0x409f11
lea eax, [ebp - 0x320]
call fcn.004757d4
push esi
lea eax, [ebp - 0x428]
push eax
push str.USERPROFILE
call edi
test eax, eax
je 0x409fd1
cmp eax, esi
jae 0x409fd1
lea edx, [ebp - 0x428]
call fcn.00475851
test eax, eax
jne 0x409fd1
lea eax, [ebp - 0x428]
call fcn.0047625d
mov edi, str.Application_Data
mov edx, edi
call fcn.00475851
test eax, eax
jne 0x409f6b
mov ecx, edi
lea ebx, [ebp - 0x428]
call fcn.00475fd3
lea eax, [ebp - 0x428]
call fcn.00475f77
lea edx, [ebp - 0x428]
call fcn.00475851
test eax, eax
jne 0x409fdc
lea eax, [ebp - 0x428]
push eax
mov ecx, esi
lea eax, [ebp - 0x218]
call fcn.00475883
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.00475fd3
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0041a4eb
test eax, eax
pop ecx
pop ecx
jne 0x409fc4
lea eax, [ebp - 0x428]
call fcn.004757d4
lea eax, [ebp - 0x218]
call fcn.004189f3
jmp 0x409fdc
lea eax, [ebp - 0x428]
call fcn.004757d4
lea eax, [ebp - 0x320]
push eax
call fcn.00418f1c
test eax, eax
pop ecx
je 0x40a002
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.00475883
pop ecx
lea eax, [ebp - 0x110]
push eax
call fcn.00418f1c
test eax, eax
pop ecx
je 0x40a01b
lea eax, [ebp - 0x110]
jmp 0x40a047
lea eax, [ebp - 0x428]
push eax
call fcn.00418f1c
test eax, eax
pop ecx
jne 0x40a041
lea edx, [ebp - 0x110]
call fcn.00475851
test eax, eax
lea eax, [ebp - 0x110]
je 0x40a047
lea eax, [ebp - 0x428]
push eax
mov ecx, esi
mov eax, 0x602858
call fcn.00475883
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a69f5
leave
ret