Function at 0x4cb2ae
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x524], eax
test edi, edi
je 0x4cb2e4
cmp word [edi], si
jne 0x4cb2e9
mov edi, str._TEMP_ConEmu
test ebx, ebx
je 0x4cb2f2
cmp word [ebx], si
jne 0x4cb2f7
mov ebx, str.ConEmu.tmp
push 0x25
push edi
call fcn.004f5617
pop ecx
pop ecx
test eax, eax
lea eax, [ebp - 0x518]
push 0x104
je 0x4cb342
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4cb323
cmp eax, 0x104
jb 0x4cb34a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CreateTempFile.ExpandEnvironmentStrings__s__failed__code_u
mov ecx, dword [ebp - 0x520]
call fcn.004cd3a7
xor eax, eax
jmp 0x4cb5a0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x518]
push 0x3a
push eax
call fcn.004f5617
pop ecx
pop ecx
test eax, eax
je 0x4cb37e
add eax, 2
push 0x3a
push eax
call fcn.004f5617
pop ecx
pop ecx
test eax, eax
je 0x4cb37e
push esi
lea eax, [ebp - 0x518]
push eax
push str.Invalid_download_path____TEMP___variable___n_s
jmp 0x4cb330
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x4cb398
push esi
push edi
push str.CreateTempFile.asDir__s__failed__path_is_null
jmp 0x4cb330
lea ecx, [ebp - 0x518]
push 0x5c
lea ecx, [ecx + eax*2]
pop edx
mov dword [ebp - 0x528], ecx
cmp word [ecx - 2], dx
je 0x4cb3d8
lea eax, [eax*2 + 2]
mov word [ecx], dx
cmp eax, 0x414
jae 0x4cb60c
lea ecx, [ebp - 0x518]
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x528], eax
mov word [eax], cx
lea eax, [ebp - 0x518]
push esi
push eax
call fcn.004e230a
push ebx
mov dword [ebp - 0x530], eax
call fcn.004e5a5b
add esp, 0xc
mov ebx, eax
push 0x2e
pop eax
test ebx, ebx
je 0x4cb40a
movzx ecx, word [ebx]
test cx, cx
je 0x4cb40a
cmp cx, ax
jne 0x4cb40f
mov ebx, 0x5242d0
push ebx
call fcn.004e5a3d
pop ecx
test eax, eax
mov ecx, str..tmp
push 0x70
cmovne ecx, eax
lea eax, [ebp - 0x104]
push ebx
push eax
mov dword [ebp - 0x534], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x104]
push 0x2e
push eax
call fcn.004f6844
pop ecx
pop ecx
test eax, eax
je 0x4cb44f
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [ebp - 0x528]
mov dword [ebp - 0x52c], esi
mov dword [ebp - 0x51c], esi
lea eax, [ebp - 0x104]
push eax
push 0x104
push ebx
call fcn.00401a0b
mov edx, dword [ebp - 0x51c]
test edx, edx
je 0x4cb4af
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x528], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4cb488
sub ecx, dword [ebp - 0x528]
push edx
sar ecx, 1
push 0x565240
push 0x10
lea eax, [ebx + ecx*2]
push eax
call fcn.004e22e7
add esp, 0x10
push dword [ebp - 0x534]
push 0x104
push ebx
call fcn.004019cd
push esi
push 0x180
xor ecx, ecx
mov dword [ebp - 0x540], 0xc
inc ecx
mov dword [ebp - 0x53c], esi
push ecx
lea eax, [ebp - 0x540]
mov dword [ebp - 0x538], ecx
push eax
push ecx
push 0x40000000
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x524]
mov dword [ecx], eax
test eax, eax
je 0x4cb50b
cmp eax, 0xffffffff
jne 0x4cb53e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x52c], edx
cmp edx, 3
jne 0x4cb54c
test eax, eax
jne 0x4cb54c
push dword [ebp - 0x530]
call fcn.004ee21a
pop ecx
test al, al
je 0x4cb5b1
mov ecx, dword [ebp - 0x524]
mov edx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x51c]
jmp 0x4cb552
mov ecx, dword [ebp - 0x524]
cmp dword [ecx], esi
je 0x4cb55b
cmp dword [ecx], 0xffffffff
jne 0x4cb5c5
inc eax
mov dword [ebp - 0x51c], eax
cmp eax, 0x270f
jbe 0x4cb461
mov ecx, dword [ebp - 0x520]
lea eax, [ebp - 0x518]
push edx
push eax
push str.Cant_create_temp_file__s___code_u
call fcn.004cd3a7
mov eax, dword [ebp - 0x524]
mov dword [eax], esi
mov eax, dword [ebp - 0x530]
test eax, eax
je 0x4cb59e
push eax
call fcn.004e1bea
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 0xc
mov ecx, dword [ebp - 0x520]
push esi
push edi
push str.CreateTempFile.asDir__s__failed
call fcn.004cd3a7
jmp 0x4cb58d
lea eax, [ebp - 0x518]
push esi
push eax
call fcn.004e230a
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4cb608
mov ebx, dword [ebp - 0x524]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x518]
mov dword [ebx], esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x520]
push eax
push str.Cant_allocate_memory___i_bytes_
call fcn.004cd426
mov esi, edi
jmp 0x4cb58d
call fcn.004f4963
int3