Function at 0x4112af
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x5f2e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
lea eax, [ebp - 0x10f]
mov edi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], ebx
mov byte [ebp - 0x110], 0
call fcn.005306b0
add esp, 0xc
push esi
lea eax, [ebp - 0x31f]
push 0
push eax
mov byte [ebp - 0x320], 0
call fcn.005306b0
add esp, 0xc
push esi
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.005306b0
add esp, 0xc
push esi
xor esi, esi
lea eax, [ebp - 0x427]
push esi
push eax
mov byte [ebp - 0x428], 0
call fcn.005306b0
add esp, 0xc
cmp dword [ebp + 8], esi
jne 0x41134b
mov dword [ebp + 8], 0x27
cmp edi, esi
jne 0x411362
push 0x54f278
push esi
call fcn.004ce595
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
push str.ALLUSERSPROFILE
call edi
test eax, eax
je 0x411450
cmp eax, esi
jae 0x411450
lea edx, [ebp - 0x110]
call fcn.004ccc0d
test eax, eax
jne 0x411450
lea eax, [ebp - 0x110]
call fcn.004cd7d5
mov edx, ebx
call fcn.004ccc0d
test eax, eax
jne 0x4113c2
mov ecx, ebx
lea ebx, [ebp - 0x110]
call fcn.004cd3c9
lea eax, [ebp - 0x110]
call fcn.004cd338
test byte [ebp + 8], 0x10
je 0x4113ef
lea eax, [ebp - 0x110]
push eax
call fcn.00432310
test eax, eax
pop ecx
jne 0x4113ef
lea eax, [ebp - 0x110]
call fcn.004ccb8b
test byte [ebp + 8], 0x20
je 0x41146c
lea edx, [ebp - 0x110]
call fcn.004ccc0d
test eax, eax
jne 0x41146c
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
lea eax, [ebp - 0x428]
call fcn.004ccc3f
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.004cd3c9
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.004343aa
test eax, eax
pop ecx
pop ecx
jne 0x411443
lea eax, [ebp - 0x110]
call fcn.004ccb8b
lea eax, [ebp - 0x428]
call fcn.004314ff
jmp 0x41146c
push str._GetLastError_
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__ALLUSERSPROFILE___FAILED:__s
call fcn.0042b70b
pop ecx
pop ecx
lea eax, [ebp - 0x110]
call fcn.004ccb8b
push esi
lea eax, [ebp - 0x320]
push eax
push str.PUBLIC
call edi
test eax, eax
je 0x411557
cmp eax, esi
jae 0x411557
lea edx, [ebp - 0x320]
call fcn.004ccc0d
test eax, eax
jne 0x411557
lea eax, [ebp - 0x320]
call fcn.004cd7d5
mov edx, dword [ebp - 0x430]
call fcn.004ccc0d
test eax, eax
jne 0x4114c9
mov ecx, dword [ebp - 0x430]
lea ebx, [ebp - 0x320]
call fcn.004cd3c9
lea eax, [ebp - 0x320]
call fcn.004cd338
test byte [ebp + 8], 0x10
je 0x4114f6
lea eax, [ebp - 0x320]
push eax
call fcn.00432310
test eax, eax
pop ecx
jne 0x4114f6
lea eax, [ebp - 0x320]
call fcn.004ccb8b
test byte [ebp + 8], 0x20
je 0x411562
lea edx, [ebp - 0x320]
call fcn.004ccc0d
test eax, eax
jne 0x411562
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x428]
call fcn.004ccc3f
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.004cd3c9
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.004343aa
test eax, eax
pop ecx
pop ecx
jne 0x41154a
lea eax, [ebp - 0x320]
call fcn.004ccb8b
lea eax, [ebp - 0x428]
call fcn.004314ff
jmp 0x411562
lea eax, [ebp - 0x320]
call fcn.004ccb8b
push esi
lea eax, [ebp - 0x218]
push eax
push str.USERPROFILE
call edi
test eax, eax
je 0x41164d
cmp eax, esi
jae 0x41164d
lea edx, [ebp - 0x218]
call fcn.004ccc0d
test eax, eax
jne 0x41164d
lea eax, [ebp - 0x218]
call fcn.004cd7d5
mov edx, dword [ebp - 0x430]
call fcn.004ccc0d
test eax, eax
jne 0x4115bf
mov ecx, dword [ebp - 0x430]
lea ebx, [ebp - 0x218]
call fcn.004cd3c9
lea eax, [ebp - 0x218]
call fcn.004cd338
test byte [ebp + 8], 0x10
je 0x4115ec
lea eax, [ebp - 0x218]
push eax
call fcn.00432310
test eax, eax
pop ecx
jne 0x4115ec
lea eax, [ebp - 0x218]
call fcn.004ccb8b
test byte [ebp + 8], 0x20
je 0x411669
lea edx, [ebp - 0x218]
call fcn.004ccc0d
test eax, eax
jne 0x411669
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
lea eax, [ebp - 0x428]
call fcn.004ccc3f
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.004cd3c9
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.004343aa
test eax, eax
pop ecx
pop ecx
jne 0x411640
lea eax, [ebp - 0x218]
call fcn.004ccb8b
lea eax, [ebp - 0x428]
call fcn.004314ff
jmp 0x411669
push str._GetLastError_
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__USERPROFILE___FAILED:__s
call fcn.0042b70b
pop ecx
pop ecx
lea eax, [ebp - 0x218]
call fcn.004ccb8b
lea eax, [ebp - 0x320]
push eax
call fcn.00432310
test eax, eax
pop ecx
je 0x41168f
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.004ccc3f
pop ecx
mov al, byte [ebp + 8]
test al, 1
je 0x41170c
test al, 2
je 0x411716
test al, 8
je 0x4116d9
lea eax, [ebp - 0x218]
push eax
call fcn.00432310
test eax, eax
pop ecx
je 0x4116b7
lea eax, [ebp - 0x218]
jmp 0x41171c
lea eax, [ebp - 0x110]
push eax
call fcn.00432310
test eax, eax
pop ecx
jne 0x411716
lea edx, [ebp - 0x218]
call fcn.004ccc0d
test eax, eax
jne 0x411716
jmp 0x4116af
lea eax, [ebp - 0x110]
push eax
call fcn.00432310
test eax, eax
pop ecx
jne 0x411716
lea eax, [ebp - 0x218]
push eax
call fcn.00432310
test eax, eax
pop ecx
jne 0x4116af
lea edx, [ebp - 0x110]
call fcn.004ccc0d
test eax, eax
je 0x411716
jmp 0x4116af
test al, 2
lea eax, [ebp - 0x218]
jne 0x41171c
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x42c]
mov ecx, esi
call fcn.004ccc3f
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005317e7
leave
ret