Function at 0x401244
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x406468
call sub.MSVCRT.dll__EH_prolog
mov eax, 0x2324
call fcn.00405f40
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
xor ebx, ebx
push str.USERPROFILE
and byte [eax], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call esi
pop ecx
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [ebp - 0x10]
push 1
pop edi
mov eax, dword [eax - 8]
cmp eax, edi
jge 0x4012a5
push str.WINDIR
call esi
pop ecx
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
push dword [ebp - 0x10]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x230]
push str._sCookies_
push eax
call esi
push 0x40904c
push 0x409048
lea eax, [ebp - 0x230]
push 0x409044
push eax
lea eax, [ebp - 0x330]
push str._s_s_s_st
push eax
call esi
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.MSVCRT.dll__findfirst]
add esp, 0x2c
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x4014dd
test byte [ebp - 0x130], 0x10
jne 0x401336
lea eax, [ebp - 0x2330]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x230]
push eax
call section..text
add esp, 0xc
cmp eax, edi
jne 0x401336
mov ebx, dword [ebp - 0x124]
mov dword [ebp - 0x18], edi
mov esi, dword [sym.imp.MSVCRT.dll__findnext]
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x14]
call esi
pop ecx
test eax, eax
pop ecx
jne 0x4013aa
test byte [ebp - 0x130], 0x10
jne 0x40139e
lea eax, [ebp - 0x1330]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x230]
push eax
call section..text
add esp, 0xc
cmp eax, edi
jne 0x40139e
cmp dword [ebp - 0x124], ebx
mov dword [ebp - 0x18], edi
jle 0x40139e
mov ebx, dword [ebp - 0x124]
lea eax, [ebp - 0x1330]
push eax
lea eax, [ebp - 0x2330]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x14]
jmp 0x401346
push dword [ebp - 0x14]
call dword [sym.imp.MSVCRT.dll__findclose]
cmp dword [ebp - 0x18], edi
pop ecx
jne 0x4014dd
and byte [ebp - 0x1330], 0
lea eax, [ebp - 0x2330]
push eax
xor esi, esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x4014a6
mov al, byte [ebp + esi - 0x2330]
lea ebx, [ebp + esi - 0x2330]
cmp al, 0x25
jne 0x40143c
mov al, byte [ebp + esi - 0x232f]
push eax
call fcn.004011a2
mov ebx, eax
mov al, byte [ebp + esi - 0x232e]
push eax
shl bl, 4
call fcn.004011a2
add bl, al
lea eax, [ebp - 0x1330]
push eax
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x132f], 0
lea eax, [ebp - 0x1330]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x10
inc esi
mov byte [ebp + eax - 0x1330], bl
inc esi
jmp 0x401490
cmp al, 0x2b
lea eax, [ebp - 0x1330]
push eax
jne 0x40146c
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x132f], 0
lea eax, [ebp - 0x1330]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [ebp + eax - 0x1330], 0x20
pop ecx
jmp 0x401490
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x132f], 0
lea eax, [ebp - 0x1330]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
pop ecx
mov cl, byte [ebx]
mov byte [ebp + eax - 0x1330], cl
lea eax, [ebp - 0x2330]
inc esi
push eax
call sub.MSVCRT.dll_strlen
cmp esi, eax
pop ecx
jb 0x4013db
lea eax, [ebp - 0x1330]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x4014cc
lea eax, [ebp - 0x1330]
push eax
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x1331], 0
pop ecx
lea eax, [ebp - 0x1330]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret