Function at 0x401e5e
Capabilities:
Check if file exists
Get file attributes
Get file size
Query environment variable
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3fc
pushal
mov dword [ebp - 0xc04], 0
mov byte [0x407cf5], 0
push 0x400
push 0x4074dc
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov esi, 0x4074dc
jmp 0x401eae
lodsb al, byte [esi]
cmp al, 0x25
jne 0x401eae
push 0x4074dc
call fcn.00405160
push eax
push 0x4074dc
call sub.kernel32.dll_lstrcpyA
jmp 0x401eb3
cmp byte [esi], 0
jne 0x401e92
mov edi, 0x4074dc
cmp byte [edi + 1], 0x3a
je 0x401f0d
push 0x400
lea eax, [ebp - 0xc00]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0xc00]
push eax
call fcn.00401c90
cmp byte [edi], 0x5c
je 0x401ef3
push 0x4070fb
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0xc00]
push eax
push edi
call sub.kernel32.dll_lstrcpyA
push 0x4074dc
call sub.kernel32.dll_GetFileAttributesA
mov dword [0x407cdc], eax
test eax, 1
je 0x401f31
xor eax, 1
push eax
push 0x4074dc
call sub.kernel32.dll_SetFileAttributesA
push 0x4074dc
call fcn.00401d27
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x4074dc
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4020db
cmp byte [0x408127], 0
jne 0x4020d6
push 0x4074dc
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x40204e
push 0x4074dc
call fcn.00405160
cmp word [eax], 0x2e2a
je 0x401fce
cmp word [eax], 0
je 0x401fce
push 0x400
push 0x40a94c
push 0x10
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x34
push 0x4074dc
push 0x40a94c
push dword [0x407476]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4020d6
lea esi, [ebp - 0x400]
mov edi, 0x4074dc
cmp byte [edi + 1], 0x3a
jne 0x401fe7
push edi
call fcn.00405160
mov edi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
push esi
call fcn.00405050
cmp eax, 0
jbe 0x401ffa
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
pop eax
add esi, eax
push 0x2e
push str.Exe_Files__.exe_
push esi
call sub.kernel32.dll_RtlMoveMemory
pop esi
lea ebx, [ebp - 0x800]
push 0x4074dc
push ebx
call sub.kernel32.dll_lstrcpyA
push ebx
call fcn.00401c90
push dword [0x407476]
push ebx
push esi
push 0x4074dc
call fcn.00405100
cmp eax, 1
jne 0x402049
jmp 0x401f0d
jmp 0x4020d6
test dword [ebp + 0x10], 2
je 0x40209e
cmp byte [0x407cf5], 0
jne 0x4020d6
push 0x4074dc
call fcn.00401e0c
cmp eax, 1
jne 0x40209c
mov byte [0x407cf5], 1
push 0x400
push 0x40ad4c
push 0x11
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x40ad4c
call fcn.00401ce6
jmp 0x401f0d
jmp 0x4020d6
push 0x400
push 0x40b14c
push 0x12
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x34
push 0x4074dc
push 0x40b14c
push dword [0x407476]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4020d6
jmp 0x401f0d
jmp 0x4021f2
mov dword [0x407ce0], eax
push 0x400
push 0x40b54c
push 0x13
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x40b54c
call fcn.00401ce6
push 0x4074dc
call fcn.00401ce6
push 0
push dword [0x407ce0]
call sub.kernel32.dll_GetFileSize
mov dword [0x407ce4], eax
cmp dword [ebp + 0xc], 0
jne 0x402126
mov dword [ebp + 0xc], eax
test dword [ebp + 0x10], 4
je 0x402148
add eax, 0x23b
add eax, dword [0x407450]
push 0x100
push eax
call fcn.004051a0
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x407cf0]
push 0
push dword [0x407cf0]
push 0
push 4
push 0
push dword [0x407ce0]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x402191
push 0x400
push 0x40b94c
push 0x14
push dword [0x407472]
call sub.user32.dll_LoadStringA
push 0x40b94c
call fcn.00401ce6
jmp 0x4021f2
mov dword [0x407cec], eax
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x4021aa
jmp 0x40216e
mov dword [0x407ce8], eax
mov dword [ebp - 0xc04], eax
push 0x4074dc
push str.dup2_last_file
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x4074dc
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0xc00]
push eax
call fcn.00401c90
lea eax, [ebp - 0xc00]
push eax
push str.dup2_last_path
call sub.kernel32.dll_SetEnvironmentVariableA
popal
mov eax, dword [ebp - 0xc04]
leave
ret 0xc