Function at 0x404240
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436e70
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x47700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x478768]
cmp eax, dword [ecx + 4]
jle 0x4042e6
push 0x478768
call fcn.0043592c
add esp, 4
cmp dword [0x478768], 0xffffffff
jne 0x4042e6
push 0x4388e0
mov dword [0x478964], 0
mov dword [0x478968], 0
mov dword [0x47896c], 0
mov dword [0x478970], 0
mov byte [0x478974], 0
mov dword [0x478978], 0
call fcn.00435d86
add esp, 4
push 0x478768
call fcn.004358e2
add esp, 4
call fcn.00401a20
push 0xffffffffffffffff
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x478978], 0
jne 0x404660
push 1
push 1
push 1
push 0x400
mov ecx, 0x478964
call fcn.00407f20
push 1
push 1
push 1
push 0x400
lea ecx, [ebp - 0x50]
call fcn.00408260
push 1
push 1
push 1
push pe_nt_image_headers32
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00408260
mov byte [ebp - 4], 1
call fcn.00401d80
mov edi, dword [ebp - 0x24]
push eax
push str._s.tmp
push dword [ebp - 0x38]
push edi
call fcn.004012c0
push 0x457edc
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, dword [ebp - 0x3c]
add esp, 0x14
mov ebx, dword [ebp - 0x50]
test eax, eax
jne 0x404397
push str.TEMP
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
call fcn.00401f00
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4043da
push eax
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push str.C:WINNTTemp
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push str.C:WINDOWSTemp
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push str.C:Temp
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push 0x457f18
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push str.D:WINNTTemp
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push str.D:WINDOWSTemp
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push str.D:Temp
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
push 0x457f44
push 0x439450
push dword [0x478964]
push dword [0x478978]
call fcn.004012c0
push edi
push 0x5c
push dword [0x478978]
push str._s_c_s
push ebx
push esi
call fcn.004012c0
add esp, 0x28
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
jne 0x404631
mov eax, dword [0x478978]
mov byte [eax], 0
lea eax, [ebx - 1]
push eax
push edi
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov edx, 0x4579d4
mov ecx, esi
call fcn.00404110
test eax, eax
je 0x404685
mov ecx, eax
call fcn.004020a0
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
cmp byte [ebp - 0x28], 0
jne 0x404651
push edi
call fcn.0043575c
add esp, 4
cmp byte [ebp - 0x40], 0
jne 0x404660
push esi
call fcn.0043575c
add esp, 4
call fcn.00401a20
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x478978]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
lea ecx, [edx + 7]
call fcn.00401b00
lea eax, [ebp - 0x20]
push str.cimg::temporary_path__:_Failed_to_locate_path_for_writing_temporary_files._n
push eax
call fcn.00401780
add esp, 8
lea eax, [ebp - 0x20]
push 0x47569c
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3