Function at 0x4012a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
mov eax, dword [0x405038]
test eax, eax
je 0x401551
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FDICreate
push eax
call esi
mov dword [0x40502c], eax
push str.FDIDestroy
push dword [0x405038]
call esi
mov dword [0x405034], eax
push str.FDICopy
push dword [0x405038]
call esi
mov ecx, eax
mov dword [0x405030], eax
xor eax, eax
cmp dword [0x40502c], 0
je 0x401534
cmp dword [0x405034], 0
je 0x401534
test ecx, ecx
je 0x401534
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebx + eax*2]
test eax, eax
jle 0x401334
cmp word [esi], 0x5c
je 0x401334
add esi, 0xfffffffe
cmp esi, ebx
ja 0x401327
xor eax, eax
cmp esi, ebx
je 0x401510
add esi, 2
sub esp, 0x20
mov dword [esp + 0x1c], eax
movaps xmm0, xmmword [0x404330]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], esi
mov dword [ebp - 0x10], 0
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4013a4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4013a4
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push 0xffffffffffffffff
push esi
push ecx
push 0xfde9
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x10], edi
sub esi, ebx
mov eax, esi
sar eax, 1
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 8], ebx
mov dword [ebp - 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x401514
mov edi, eax
xor eax, eax
cmp esi, 0xfffffffe
setne al
add edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x401514
xor edx, edx
push edx
push edx
push edi
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x18]
push ebx
push edx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp esi, 0xfffffffe
je 0x401427
mov eax, dword [ebp - 0x14]
mov byte [edi + eax - 1], 0
xor ebx, ebx
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x4014fa
lea esi, [ebp - 0x24]
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov ecx, dword [0x40502c]
call dword [section..00cfg]
push esi
push 0xffffffffffffffff
push 0x401620
push 0x401640
push 0x401660
push 0x4016a0
push 0x4016e0
push 0x4017b0
push 0x4017d0
call ecx
add esp, 0x24
test eax, eax
je 0x4014f7
mov edi, eax
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x238]
mov dword [esi - 4], eax
mov ecx, esi
call fcn.00401b10
mov byte [esi + 0x210], 0
mov ecx, dword [0x405030]
call dword [section..00cfg]
lea esi, [ebp - 0x23c]
xor eax, eax
push esi
push eax
push 0x4017f0
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edi
call ecx
add esp, 0x1c
mov ecx, dword [0x405034]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
cmp byte [esi + 0x214], 0
setne bl
lea esi, [ebp - 0x238]
mov ecx, esi
je 0x40153f
call fcn.00401c90
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, esi
call fcn.00401b30
mov esi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
jmp 0x40151e
xor eax, eax
jmp 0x401534
xor ebx, ebx
mov eax, 0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x401534
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add esp, 0x230
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00401bf0
test al, al
je 0x4014f0
mov ecx, esi
call fcn.00401c00
jmp 0x4014f0
lea esi, [ebp - 0x23c]
push 0x208
push 0
push esi
call fcn.00401020
add esp, 0xc
mov edi, 0x104
push edi
push esi
push str._WINDIR__system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, edi
jb 0x401585
mov eax, dword [0x405038]
jmp 0x401595
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x405038], eax
test eax, eax
jne 0x4012b9
mov word [ebp - 0x23c], 0
push edi
push esi
push str._SYSTEMROOT__system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, edi
jb 0x4015bf
mov eax, dword [0x405038]
jmp 0x4015cf
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x405038], eax
test eax, eax
jne 0x4012b9
mov word [ebp - 0x23c], 0
push edi
push esi
push str.C:Windows_system32cabinet.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, edi
jb 0x4015f9
mov eax, dword [0x405038]
jmp 0x401609
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x405038], eax
test eax, eax
jne 0x4012b9
mov ecx, dword [0x405030]
jmp 0x4012f2