Function at 0x40bc90
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x414e98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebp
push esi
push edi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Entering_StoreTag...
call fcn.00413dc4
call fcn.0040c2c0
mov ebp, dword [esp + 0xc4]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
push 1
push ebp
stosb byte es:[edi], al
call fcn.0040ad10
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40bd06
mov esi, edi
lea eax, [esp + 0x2c]
xor ecx, ecx
sub esi, eax
lea edx, [esp + ecx + 0x2c]
inc ecx
cmp ecx, 0x80
mov al, byte [esi + edx]
mov byte [edx], al
jl 0x40bcf4
push str.z:hps.dat
lea ecx, [esp + 0x10]
mov byte [edi + 0x80], 0
call fcn.00413dc4
mov dword [esp + 0xb8], 0
call fcn.0040c6b0
test al, al
jne 0x40bdc1
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.IBMShare
call esi
add esp, 4
test eax, eax
jne 0x40bd5d
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.IBMShare_doesnt_exist___not_saving_tag_file
call fcn.00413dc4
jmp 0x40be0d
push str.IBMShare
call esi
add esp, 4
lea ecx, [esp + 0x14]
push eax
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x14]
push str.hps.dat
lea edx, [esp + 0x14]
push ecx
push edx
mov byte [esp + 0xc4], 1
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xbc], 2
call fcn.00413dfa
lea ecx, [esp + 0x10]
mov byte [esp + 0xb8], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0xb8], 0
call sub.MFC42u.DLL_CString::CString
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x20], esp
push ecx
push str.tag_file_location_
push eax
call sub.MFC42u.DLL_operator_2
call fcn.0040c2c0
mov edx, dword [esp + 0x10]
push 0x41e35c
push edx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40be33
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x20], esp
push ecx
push 0x41f0c8
push eax
call sub.MFC42u.DLL_operator_2
call fcn.0040c2c0
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0xb8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 1
jmp 0x40bf63
push esi
push 0x80
lea edx, [esp + 0x34]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
call sub.MFC42u.DLL_AfxGetEmptyString
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], eax
call fcn.00413e78
mov byte [esp + 0xb8], 3
call sub.MFC42u.DLL_AfxGetEmptyString
mov edx, dword [eax]
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edx
call fcn.00413e78
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
push 0x41f0a0
push ecx
mov byte [esp + 0xc4], 4
call sub.MFC42u.DLL_operator_2
push 0x41f09c
lea edx, [esp + 0x28]
push eax
push edx
mov byte [esp + 0xc4], 5
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
mov byte [esp + 0xc4], 6
call sub.MFC42u.DLL_operator_3
push ecx
mov byte [esp + 0xbc], 7
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x41f098
push eax
push ecx
call sub.MFC42u.DLL_operator_1
call fcn.0040c2c0
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0xb8], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0xb8], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0xb8], 4
call sub.MFC42u.DLL_CString::CString
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x18]
mov byte [esp + 0xb8], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0xb8], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0xb8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xb0
ret