Function at 0x40f699
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
lea eax, [ebp - 0x10f]
mov edi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], ebx
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
push esi
lea eax, [ebp - 0x31f]
push 0
push eax
mov byte [ebp - 0x320], 0
call fcn.005117f0
add esp, 0xc
push esi
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.005117f0
add esp, 0xc
push esi
xor esi, esi
lea eax, [ebp - 0x427]
push esi
push eax
mov byte [ebp - 0x428], 0
call fcn.005117f0
add esp, 0xc
cmp dword [ebp + 8], esi
jne 0x40f735
mov dword [ebp + 8], 0x27
cmp edi, esi
jne 0x40f74c
push 0x530248
push esi
call fcn.004c5467
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
push str.ALLUSERSPROFILE
call edi
test eax, eax
je 0x40f83a
cmp eax, esi
jae 0x40f83a
lea edx, [ebp - 0x110]
call fcn.004c3b34
test eax, eax
jne 0x40f83a
lea eax, [ebp - 0x110]
call fcn.004c46fc
mov edx, ebx
call fcn.004c3b34
test eax, eax
jne 0x40f7ac
mov ecx, ebx
lea ebx, [ebp - 0x110]
call fcn.004c42f0
lea eax, [ebp - 0x110]
call fcn.004c425f
test byte [ebp + 8], 0x10
je 0x40f7d9
lea eax, [ebp - 0x110]
push eax
call fcn.0042adad
test eax, eax
pop ecx
jne 0x40f7d9
lea eax, [ebp - 0x110]
call fcn.004c3ab2
test byte [ebp + 8], 0x20
je 0x40f856
lea edx, [ebp - 0x110]
call fcn.004c3b34
test eax, eax
jne 0x40f856
lea eax, [ebp - 0x110]
push eax
mov ecx, esi
lea eax, [ebp - 0x428]
call fcn.004c3b66
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.004c42f0
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0042c9fd
test eax, eax
pop ecx
pop ecx
jne 0x40f82d
lea eax, [ebp - 0x110]
call fcn.004c3ab2
lea eax, [ebp - 0x428]
call fcn.0042a76b
jmp 0x40f856
push str._GetLastError_
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__ALLUSERSPROFILE___FAILED:__s
call fcn.004265da
pop ecx
pop ecx
lea eax, [ebp - 0x110]
call fcn.004c3ab2
push esi
lea eax, [ebp - 0x320]
push eax
push str.PUBLIC
call edi
test eax, eax
je 0x40f941
cmp eax, esi
jae 0x40f941
lea edx, [ebp - 0x320]
call fcn.004c3b34
test eax, eax
jne 0x40f941
lea eax, [ebp - 0x320]
call fcn.004c46fc
mov edx, dword [ebp - 0x430]
call fcn.004c3b34
test eax, eax
jne 0x40f8b3
mov ecx, dword [ebp - 0x430]
lea ebx, [ebp - 0x320]
call fcn.004c42f0
lea eax, [ebp - 0x320]
call fcn.004c425f
test byte [ebp + 8], 0x10
je 0x40f8e0
lea eax, [ebp - 0x320]
push eax
call fcn.0042adad
test eax, eax
pop ecx
jne 0x40f8e0
lea eax, [ebp - 0x320]
call fcn.004c3ab2
test byte [ebp + 8], 0x20
je 0x40f94c
lea edx, [ebp - 0x320]
call fcn.004c3b34
test eax, eax
jne 0x40f94c
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x428]
call fcn.004c3b66
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.004c42f0
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0042c9fd
test eax, eax
pop ecx
pop ecx
jne 0x40f934
lea eax, [ebp - 0x320]
call fcn.004c3ab2
lea eax, [ebp - 0x428]
call fcn.0042a76b
jmp 0x40f94c
lea eax, [ebp - 0x320]
call fcn.004c3ab2
push esi
lea eax, [ebp - 0x218]
push eax
push str.USERPROFILE
call edi
test eax, eax
je 0x40fa37
cmp eax, esi
jae 0x40fa37
lea edx, [ebp - 0x218]
call fcn.004c3b34
test eax, eax
jne 0x40fa37
lea eax, [ebp - 0x218]
call fcn.004c46fc
mov edx, dword [ebp - 0x430]
call fcn.004c3b34
test eax, eax
jne 0x40f9a9
mov ecx, dword [ebp - 0x430]
lea ebx, [ebp - 0x218]
call fcn.004c42f0
lea eax, [ebp - 0x218]
call fcn.004c425f
test byte [ebp + 8], 0x10
je 0x40f9d6
lea eax, [ebp - 0x218]
push eax
call fcn.0042adad
test eax, eax
pop ecx
jne 0x40f9d6
lea eax, [ebp - 0x218]
call fcn.004c3ab2
test byte [ebp + 8], 0x20
je 0x40fa53
lea edx, [ebp - 0x218]
call fcn.004c3b34
test eax, eax
jne 0x40fa53
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
lea eax, [ebp - 0x428]
call fcn.004c3b66
pop ecx
mov ecx, str.__TestFile_PleaseDelete__.txt
mov ebx, eax
call fcn.004c42f0
mov eax, ebx
push str.This_file_should_not_exist.__Please_delete.
push eax
call fcn.0042c9fd
test eax, eax
pop ecx
pop ecx
jne 0x40fa2a
lea eax, [ebp - 0x218]
call fcn.004c3ab2
lea eax, [ebp - 0x428]
call fcn.0042a76b
jmp 0x40fa53
push str._GetLastError_
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__USERPROFILE___FAILED:__s
call fcn.004265da
pop ecx
pop ecx
lea eax, [ebp - 0x218]
call fcn.004c3ab2
lea eax, [ebp - 0x320]
push eax
call fcn.0042adad
test eax, eax
pop ecx
je 0x40fa79
lea eax, [ebp - 0x320]
push eax
mov ecx, esi
lea eax, [ebp - 0x110]
call fcn.004c3b66
pop ecx
mov al, byte [ebp + 8]
test al, 1
je 0x40faf6
test al, 2
je 0x40fb00
test al, 8
je 0x40fac3
lea eax, [ebp - 0x218]
push eax
call fcn.0042adad
test eax, eax
pop ecx
je 0x40faa1
lea eax, [ebp - 0x218]
jmp 0x40fb06
lea eax, [ebp - 0x110]
push eax
call fcn.0042adad
test eax, eax
pop ecx
jne 0x40fb00
lea edx, [ebp - 0x218]
call fcn.004c3b34
test eax, eax
jne 0x40fb00
jmp 0x40fa99
lea eax, [ebp - 0x110]
push eax
call fcn.0042adad
test eax, eax
pop ecx
jne 0x40fb00
lea eax, [ebp - 0x218]
push eax
call fcn.0042adad
test eax, eax
pop ecx
jne 0x40fa99
lea edx, [ebp - 0x110]
call fcn.004c3b34
test eax, eax
je 0x40fb00
jmp 0x40fa99
test al, 2
lea eax, [ebp - 0x218]
jne 0x40fb06
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x42c]
mov ecx, esi
call fcn.004c3b66
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret