Function at 0x4043f0
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x5c
mov dword [esp + 0x18], ecx
mov dword [esp], str.ACTIVESTATE_HOME
call sub.msvcrt.dll_getenv
mov dword [esp + 0x1c], 0
test eax, eax
mov edi, eax
je 0x4045b4
mov dword [esp], edi
mov ebp, 0x413369
call sub.msvcrt.dll_strlen
mov edx, eax
xor eax, eax
cmp edx, 2
je 0x404694
add eax, edx
mov dword [esi], eax
add eax, 0x14
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 4], edi
mov dword [ebx], eax
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx]
movzx edx, byte [eax]
test dl, dl
jne 0x404481
jmp 0x404495
add eax, 1
movzx edx, byte [eax]
test dl, dl
je 0x404493
cmp dl, 0x2f
jne 0x404477
mov byte [eax], 0x5c
add eax, 1
movzx edx, byte [eax]
test dl, dl
jne 0x404481
mov eax, dword [ebx]
mov edx, dword [esi]
cmp edx, 3
ja 0x404555
mov edx, dword [esp + 0x18]
call fcn.00404300
xor edx, edx
test eax, eax
je 0x40454b
mov edi, dword [ebx]
mov eax, dword [esi]
cmp byte [edi + eax - 1], 0x5c
je 0x4044d0
lea edx, [eax + 1]
mov byte [edi + eax], 0x5c
mov dword [esi], edx
mov edx, dword [ebx]
mov byte [edx + eax + 1], 0
mov edi, dword [ebx]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
add edi, eax
mov dword [edi], 0x69746341
lea eax, [esp + 0x2c]
mov dword [edi + 4], 0x74536576
mov dword [edi + 8], 0x657461
add dword [esi], 0xb
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00410fc0
test eax, eax
je 0x404571
mov eax, dword [esp + 0x70]
test eax, eax
je 0x404580
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
test eax, eax
jne 0x404665
mov edx, dword [esp + 0x18]
mov eax, dword [ebx]
call fcn.00404300
xor edx, edx
test eax, eax
je 0x40454b
mov eax, dword [esi]
mov edx, dword [ebx]
mov byte [edx + eax], 0x5c
lea edx, [eax + 1]
mov dword [esi], edx
mov edx, dword [ebx]
mov byte [edx + eax + 1], 0
mov edx, 1
add esp, 0x5c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [eax + edx - 1], 0x5c
jne 0x4044a0
lea ecx, [edx - 1]
mov dword [esi], ecx
mov byte [eax + edx - 1], 0
mov eax, dword [ebx]
jmp 0x4044a0
test byte [esp + 0x33], 0x40
jne 0x404521
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x40450f
mov dword [esp], 0x800
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov edx, dword [ebx]
mov dword [esp + 4], str.Directory__s_does_not_exist
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
add esp, 0x5c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
call fcn.004033c0
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x4046b1
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
test eax, eax
mov edi, eax
jne 0x40441d
mov dword [esp], str.USERPROFILE
call sub.msvcrt.dll_getenv
test eax, eax
mov edi, eax
jne 0x4046aa
mov dword [esp], str.HOMEDRIVE
call sub.msvcrt.dll_getenv
mov dword [esp], str.HOMEPATH
mov edi, eax
call sub.msvcrt.dll_getenv
test edi, edi
mov ebp, eax
jne 0x404640
mov dword [esp], str.windir
call sub.msvcrt.dll_getenv
test eax, eax
mov edi, eax
jne 0x404640
mov dword [esp], str.Couldnt_find_HOME___USERPROFILE___HOMEDRIVEHOMEPATH___windir
call sub.msvcrt.dll__strdup
mov edx, dword [esp + 0x18]
mov dword [edx], eax
xor edx, edx
jmp 0x40454b
test ebp, ebp
je 0x40441d
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov dword [esp], ebp
mov dword [esp + 0x14], eax
call sub.msvcrt.dll_strlen
mov edx, dword [esp + 0x14]
jmp 0x404437
mov dword [esp], 0x800
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov edx, dword [ebx]
mov dword [esp + 4], str.Could_not_create_directory__s
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_sprintf
xor edx, edx
jmp 0x40454b
xor eax, eax
mov ecx, 0x413367
cmp byte [edi + 1], 0x3a
sete al
cmove ebp, ecx
jmp 0x404437
mov ebp, str.Application_Data
jmp 0x404648
mov edi, dword [esp + 0x1c]
jmp 0x40441d