Function at 0x40e04d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x104
push ebx
push 0
push eax
mov dword [ebp - 0x418], esi
call fcn.004e4da0
push ebx
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004e4da0
push ebx
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e4da0
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004e4da0
add esp, 0x30
cmp dword [ebp + 0x10], 0
push 0x27
pop ebx
cmovne ebx, dword [ebp + 0x10]
test esi, esi
jne 0x40e0d5
push 0x50eb14
push esi
call fcn.0049e318
pop ecx
pop ecx
mov dword [ebp - 0x418], eax
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push eax
push str.ALLUSERSPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40e1e6
cmp eax, esi
jae 0x40e1e6
lea eax, [ebp - 0x108]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e1e6
lea eax, [ebp - 0x108]
push eax
call fcn.004a0b9c
push edi
call fcn.0049f486
pop ecx
pop ecx
test eax, eax
jne 0x40e139
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0049d9e2
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call fcn.0049d915
mov esi, ebx
pop ecx
and esi, 0x10
je 0x40e16b
lea eax, [ebp - 0x108]
push eax
call fcn.00429152
pop ecx
test eax, eax
jne 0x40e16b
lea eax, [ebp - 0x108]
push eax
call fcn.0049e2d6
pop ecx
test bl, 0x20
je 0x40e209
lea eax, [ebp - 0x108]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e209
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004a11a5
lea eax, [ebp - 0x414]
push str.__TestFile_PleaseDelete__.txt
push eax
call fcn.0049d9e2
lea eax, [ebp - 0x414]
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0042c20e
add esp, 0x1c
test eax, eax
jne 0x40e1d7
lea eax, [ebp - 0x108]
push eax
call fcn.0049e2d6
pop ecx
lea eax, [ebp - 0x414]
push eax
call fcn.00429e69
pop ecx
jmp 0x40e209
push str._GetLastError_
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__ALLUSERSPROFILE___FAILED:__s
call fcn.004255b9
lea eax, [ebp - 0x108]
push eax
call fcn.0049e2d6
mov esi, ebx
add esp, 0xc
and esi, 0x10
push 0x104
lea eax, [ebp - 0x310]
push eax
push str.PUBLIC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40e310
cmp eax, 0x104
jae 0x40e310
lea eax, [ebp - 0x310]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e310
lea eax, [ebp - 0x310]
push eax
call fcn.004a0b9c
push edi
call fcn.0049f486
pop ecx
pop ecx
test eax, eax
jne 0x40e26f
lea eax, [ebp - 0x310]
push edi
push eax
call fcn.0049d9e2
pop ecx
pop ecx
lea eax, [ebp - 0x310]
push eax
call fcn.0049d915
pop ecx
test esi, esi
je 0x40e29e
lea eax, [ebp - 0x310]
push eax
call fcn.00429152
pop ecx
test eax, eax
jne 0x40e29e
lea eax, [ebp - 0x310]
push eax
call fcn.0049e2d6
pop ecx
test bl, 0x20
je 0x40e31d
lea eax, [ebp - 0x310]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e31d
push 0x104
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004a11a5
lea eax, [ebp - 0x414]
push str.__TestFile_PleaseDelete__.txt
push eax
call fcn.0049d9e2
lea eax, [ebp - 0x414]
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0042c20e
add esp, 0x1c
test eax, eax
jne 0x40e302
lea eax, [ebp - 0x310]
push eax
call fcn.0049e2d6
pop ecx
lea eax, [ebp - 0x414]
push eax
call fcn.00429e69
jmp 0x40e31c
lea eax, [ebp - 0x310]
push eax
call fcn.0049e2d6
pop ecx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40e429
cmp eax, 0x104
jae 0x40e429
lea eax, [ebp - 0x20c]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e429
lea eax, [ebp - 0x20c]
push eax
call fcn.004a0b9c
push edi
call fcn.0049f486
pop ecx
pop ecx
test eax, eax
jne 0x40e383
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0049d9e2
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.0049d915
pop ecx
test esi, esi
je 0x40e3b2
lea eax, [ebp - 0x20c]
push eax
call fcn.00429152
pop ecx
test eax, eax
jne 0x40e3b2
lea eax, [ebp - 0x20c]
push eax
call fcn.0049e2d6
pop ecx
test bl, 0x20
je 0x40e447
lea eax, [ebp - 0x20c]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e447
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.004a11a5
lea eax, [ebp - 0x414]
push str.__TestFile_PleaseDelete__.txt
push eax
call fcn.0049d9e2
lea eax, [ebp - 0x414]
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0042c20e
add esp, 0x1c
test eax, eax
jne 0x40e41a
lea eax, [ebp - 0x20c]
push eax
call fcn.0049e2d6
pop ecx
lea eax, [ebp - 0x414]
push eax
call fcn.00429e69
pop ecx
jmp 0x40e447
push str._GetLastError_
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__USERPROFILE___FAILED:__s
call fcn.004255b9
lea eax, [ebp - 0x20c]
push eax
call fcn.0049e2d6
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
call fcn.00429152
pop ecx
test eax, eax
je 0x40e473
push 0x104
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004a11a5
add esp, 0xc
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x40e4f9
test bl, 8
je 0x40e4b6
lea eax, [ebp - 0x20c]
push eax
call fcn.00429152
pop ecx
test eax, eax
jne 0x40e4f1
lea eax, [ebp - 0x108]
push eax
call fcn.00429152
pop ecx
test eax, eax
jne 0x40e4c7
lea eax, [ebp - 0x20c]
push eax
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40e4c7
jmp 0x40e4f1
lea eax, [ebp - 0x108]
push eax
call fcn.00429152
pop ecx
test eax, eax
je 0x40e4cf
lea eax, [ebp - 0x108]
jmp 0x40e50b
lea eax, [ebp - 0x20c]
push eax
call fcn.00429152
pop ecx
test eax, eax
jne 0x40e4f1
lea eax, [ebp - 0x108]
push eax
call fcn.0049f486
pop ecx
test eax, eax
je 0x40e4c7
lea eax, [ebp - 0x20c]
jmp 0x40e50b
test bl, 2
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x108]
cmove eax, ecx
mov esi, dword [ebp - 0x418]
push 0x104
push eax
push esi
call fcn.004a11a5
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e3632
leave
ret