Function at 0x407ac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41aca7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf00
mov eax, dword [0x421260]
push ebx
push esi
push edi
mov dword [esp + 0xf04], eax
push 0x200
lea eax, [esp + 0x104]
push eax
xor ebx, ebx
push str._USERPROFILE_
mov dword [esp + 0x50], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, 0xf
lea eax, [esp + 0x100]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407b30
sub eax, edx
push eax
lea ecx, [esp + 0x104]
push ecx
lea ecx, [esp + 0x30]
call fcn.00403a30
push str._fancyZDSGGameinstall.inf
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0xec]
push eax
mov dword [esp + 0xf20], ebx
call fcn.00405e60
add esp, 0xc
mov eax, dword [esp + 0x40]
mov esi, 0x10
cmp eax, esi
mov byte [esp + 0xf14], 2
jb 0x407b8e
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0040e74d
add esp, 4
cmp dword [esp + 0xfc], esi
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
jae 0x407bb1
lea eax, [esp + 0xe8]
push ebx
push eax
call fcn.0040f406
add esp, 8
cmp eax, 0xffffffff
je 0x407d8e
push 1
lea ecx, [esp + 0x4c]
call fcn.00406d50
xor eax, eax
mov word [esp + 0x700], bx
mov ecx, 0x1ff
lea edi, [esp + 0x702]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x300], bl
mov ecx, 0xff
lea edi, [esp + 0x301]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [esp + 0xfc], esi
mov eax, dword [esp + 0xe8]
mov byte [esp + 0xf14], 3
jae 0x407c22
lea eax, [esp + 0xe8]
push 0x1b6
push 0x21
push eax
lea ecx, [esp + 0x5c]
call fcn.00403810
test eax, eax
jne 0x407c5b
mov edx, dword [esp + 0x48]
mov ecx, dword [edx + 4]
mov eax, dword [esp + ecx + 0x50]
mov edx, dword [esp + ecx + 0x70]
lea ecx, [esp + ecx + 0x48]
or eax, 2
cmp edx, ebx
jne 0x407c54
or eax, 4
push ebx
push eax
call fcn.0040de7b
push ebx
push ebx
lea ecx, [esp + 0x50]
call fcn.004017f0
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 4]
test byte [esp + ecx + 0x50], 1
jne 0x407c9f
lea esi, [esp + 0x700]
jmp 0x407c80
push 2
push esi
lea ecx, [esp + 0x50]
call fcn.00403550
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 4]
mov cl, byte [esp + eax + 0x50]
add esi, 2
test cl, 1
je 0x407c80
lea ecx, [esp + 0x700]
push ecx
call fcn.00401120
mov esi, eax
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x304]
lea eax, [esp + 0x304]
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407ce0
sub eax, edx
push eax
lea edx, [esp + 0x304]
push edx
lea ecx, [esp + 0x14]
call fcn.00403a30
mov esi, dword [ebp + 8]
push 0x41b360
lea eax, [esp + 0x10]
push eax
push esi
mov byte [esp + 0xf20], 4
call fcn.00405e60
mov eax, dword [esp + 0x30]
mov edi, 0x10
add esp, 0xc
cmp eax, edi
jb 0x407d33
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040e74d
add esp, 4
lea ecx, [esp + 0xac]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov byte [esp + 0xf14], 2
call fcn.00406fd0
lea ecx, [esp + 0xac]
mov dword [esp + 0xac], 0x41b1f0
call fcn.0040dd91
cmp dword [esp + 0xfc], edi
jb 0x407d87
mov edx, dword [esp + 0xe8]
push edx
call fcn.0040e74d
add esp, 4
mov eax, esi
jmp 0x407e1d
lea eax, [esp + 0x100]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x407da4
sub eax, edx
push eax
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x14]
call fcn.00403a30
mov edi, dword [ebp + 8]
push str._fancyZDSGGame_
lea ecx, [esp + 0x10]
push ecx
push edi
mov byte [esp + 0xf20], 5
call fcn.00405e60
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp eax, esi
jb 0x407df2
mov edx, dword [esp + 0x10]
push edx
call fcn.0040e74d
add esp, 4
cmp dword [esp + 0xfc], esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
jb 0x407e1b
mov eax, dword [esp + 0xe8]
push eax
call fcn.0040e74d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0xf0c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xf04]
call fcn.0040e818
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret