Function at 0x408148
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x429077
call fcn.00428180
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x2c], ebx
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x10]
push eax
mov dword [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_3
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString_1
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
mov edi, str.SystemRoot
push ebx
push edi
mov byte [ebp - 4], 6
call esi
cmp eax, ebx
jle 0x4081ee
inc eax
push eax
mov dword [ebp - 0x1c], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x28], eax
push dword [ebp - 0x1c]
push eax
push edi
call esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator
push str.System32
lea ecx, [ebp - 0x18]
call fcn.00427ebe
push dword [ebp - 0x28]
call sub.MFC42.DLL_operatordelete
pop ecx
push ebx
mov edi, str.WinDir
push ebx
push edi
call esi
cmp eax, ebx
jle 0x408225
inc eax
push eax
mov dword [ebp - 0x1c], eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x28], eax
push dword [ebp - 0x1c]
push eax
push edi
call esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::operator
push dword [ebp - 0x28]
call sub.MFC42.DLL_operatordelete
pop ecx
push ebx
mov edi, str.ProgramFiles
push ebx
push edi
call esi
cmp eax, ebx
jle 0x40825b
lea ebx, [eax + 1]
push ebx
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x28], eax
push ebx
push eax
push edi
call esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::operator
push dword [ebp - 0x28]
call sub.MFC42.DLL_operatordelete
pop ecx
xor ebx, ebx
push ebx
mov edi, str.TEMP
push ebx
push edi
call esi
cmp eax, ebx
jle 0x40828f
lea ebx, [eax + 1]
push ebx
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 0x28], eax
push ebx
push eax
push edi
call esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator
push dword [ebp - 0x28]
call sub.MFC42.DLL_operatordelete
pop ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::MakeUpper
mov esi, str._WINDIR_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x4082b5
push dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov esi, str._TEMP_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x4082d3
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov esi, str._TMP_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x4082f1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov esi, str._PROGRAMFILES_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40830f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov esi, str._SYSTEM32_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40832d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov esi, str._INSTALL_SRC_DIR_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40834e
push dword [0x4351cc]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov esi, str._INSTALL_DST_DIR_
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40836f
push dword [0x4351c8]
lea ecx, [ebp - 0x10]
push esi
call sub.MFC42.DLL_CString::Replace
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00427e82
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00427e82
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00427e82
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00427e82
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00427e82
and byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00427e82
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8