Function at 0x40599f
Capabilities:
Create directory
Query environment variable

Disassembly:
push 0x28c
push 0x408040
call fcn.00407ad4
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x27c], esi
xor eax, eax
mov word [ebp - 0x6c], ax
push 0x4e
push esi
lea eax, [ebp - 0x6a]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov word [ebp - 0x278], ax
push 0x208
push esi
lea eax, [ebp - 0x276]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x284], esi
xor eax, eax
mov word [ebp - 0x29c], ax
lea edi, [ebp - 0x29a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x28c], 0xa
inc esi
mov dword [ebp - 0x288], esi
xor edi, edi
mov dword [ebp - 0x280], edi
cmp ebx, edi
jne 0x405a2a
mov eax, 0x80070057
jmp 0x405c15
mov dword [ebp - 4], edi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00404d12
mov dword [ebp - 0x27c], eax
cmp eax, edi
jne 0x405be9
cmp dword [ebp - 0x288], edi
jne 0x405a72
mov dword [ebp - 0x27c], esi
jmp 0x405be9
cmp dword [ebp - 0x280], edi
je 0x405a9d
push 4
pop ecx
mov edi, 0x401d60
mov esi, dword [ebp - 0x280]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x405a9d
mov dword [ebp - 0x27c], 1
jmp 0x405be9
push 0x28
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x280]
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, 0x104
push esi
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x405afc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x405ae0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x40900c
call sub.msvcrt.dll__local_unwind4
add esp, 0xc
mov eax, esi
jmp 0x405c15
cmp eax, esi
jbe 0x405b1d
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x40900c
call sub.msvcrt.dll__local_unwind4
add esp, 0xc
mov eax, 0x8007006f
jmp 0x405c15
push dword [ebp - 0x28c]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.004056bb
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov word [ebx + 0x208], ax
movzx eax, word [ebp - 0x290]
push eax
movzx eax, word [ebp - 0x292]
push eax
movzx eax, word [ebp - 0x294]
push eax
movzx eax, word [ebp - 0x296]
push eax
movzx eax, word [ebp - 0x29a]
push eax
movzx eax, word [ebp - 0x29c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x278]
push eax
push 0x4021b0
push esi
push ebx
call fcn.00404296
add esp, 0x2c
mov dword [ebp - 0x27c], eax
test eax, eax
jl 0x405be9
push 0
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x402170
push 0x402154
call fcn.0040589c
add esp, 0x10
mov dword [ebp - 0x27c], eax
test eax, eax
jl 0x405be9
push 0
push ebx
call dword [sym.imp.msvcrt.dll__waccess]
pop ecx
pop ecx
test eax, eax
je 0x405be9
mov dword [ebp - 0x27c], 0x80004005
and dword [ebp - 4], 0
call fcn.00405bf4
jmp 0x405c08
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x27c]
call fcn.00407b1c
ret 4