Function at 0x41abf0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x320], 0
push 0x103
push 0
lea eax, [ebp - 0x31f]
push eax
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x430], 0
push 0x103
push 0
lea edx, [ebp - 0x42f]
push edx
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x324], 0
cmp dword [ebp + 0x10], 0
jne 0x41ac8e
mov dword [ebp + 0x10], 0x27
cmp dword [ebp + 8], 0
jne 0x41aca6
push 0x64a69c
push 0
call fcn.0040114f
add esp, 8
mov dword [ebp + 8], eax
push 0x104
lea ecx, [ebp - 0x320]
push ecx
push str.ALLUSERSPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x41aceb
cmp dword [ebp - 0x324], 0x104
jae 0x41aceb
lea edx, [ebp - 0x320]
push edx
call fcn.00401389
add esp, 4
test eax, eax
je 0x41ad11
push 0x64a6b0
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__ALLUSERSPROFILE___FAILED:__s
call fcn.00401014
add esp, 8
lea eax, [ebp - 0x320]
push eax
call fcn.00402158
add esp, 4
jmp 0x41adfc
lea ecx, [ebp - 0x320]
push ecx
call fcn.0040237e
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x41ad43
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.00401ec4
add esp, 8
lea edx, [ebp - 0x320]
push edx
call fcn.00402707
add esp, 4
mov eax, dword [ebp + 0x10]
and eax, 0x10
je 0x41ad7c
lea ecx, [ebp - 0x320]
push ecx
call fcn.00401b77
add esp, 4
test eax, eax
jne 0x41ad7c
lea edx, [ebp - 0x320]
push edx
call fcn.00402158
add esp, 4
mov eax, dword [ebp + 0x10]
and eax, 0x20
je 0x41adfc
lea ecx, [ebp - 0x320]
push ecx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x41adfc
push 0x104
lea edx, [ebp - 0x320]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00402725
add esp, 0xc
push 0x64a710
lea ecx, [ebp - 0x110]
push ecx
call fcn.00401ec4
add esp, 8
push 0x64a730
lea edx, [ebp - 0x110]
push edx
call fcn.00402103
add esp, 8
test eax, eax
jne 0x41aded
lea eax, [ebp - 0x320]
push eax
call fcn.00402158
add esp, 4
lea ecx, [ebp - 0x110]
push ecx
call fcn.0040255e
add esp, 4
push 0x104
lea edx, [ebp - 0x218]
push edx
push str.PUBLIC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x41ae41
cmp dword [ebp - 0x324], 0x104
jae 0x41ae41
lea eax, [ebp - 0x218]
push eax
call fcn.00401389
add esp, 4
test eax, eax
je 0x41ae55
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402158
add esp, 4
jmp 0x41af40
lea edx, [ebp - 0x218]
push edx
call fcn.0040237e
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401389
add esp, 4
test eax, eax
jne 0x41ae87
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.00401ec4
add esp, 8
lea eax, [ebp - 0x218]
push eax
call fcn.00402707
add esp, 4
mov ecx, dword [ebp + 0x10]
and ecx, 0x10
je 0x41aec0
lea edx, [ebp - 0x218]
push edx
call fcn.00401b77
add esp, 4
test eax, eax
jne 0x41aec0
lea eax, [ebp - 0x218]
push eax
call fcn.00402158
add esp, 4
mov ecx, dword [ebp + 0x10]
and ecx, 0x20
je 0x41af40
lea edx, [ebp - 0x218]
push edx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x41af40
push 0x104
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402725
add esp, 0xc
push 0x64a764
lea edx, [ebp - 0x110]
push edx
call fcn.00401ec4
add esp, 8
push 0x64a784
lea eax, [ebp - 0x110]
push eax
call fcn.00402103
add esp, 8
test eax, eax
jne 0x41af31
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402158
add esp, 4
lea edx, [ebp - 0x110]
push edx
call fcn.0040255e
add esp, 4
push 0x104
lea eax, [ebp - 0x430]
push eax
push 0x64a7b0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x41af85
cmp dword [ebp - 0x324], 0x104
jae 0x41af85
lea ecx, [ebp - 0x430]
push ecx
call fcn.00401389
add esp, 4
test eax, eax
je 0x41afab
push 0x64a7bc
push str.:5:GetProfilePath___EAP:_GetEnvironmentVariable__USERPROFILE___FAILED:__s
call fcn.00401014
add esp, 8
lea edx, [ebp - 0x430]
push edx
call fcn.00402158
add esp, 4
jmp 0x41b096
lea eax, [ebp - 0x430]
push eax
call fcn.0040237e
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x41afdd
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.00401ec4
add esp, 8
lea ecx, [ebp - 0x430]
push ecx
call fcn.00402707
add esp, 4
mov edx, dword [ebp + 0x10]
and edx, 0x10
je 0x41b016
lea eax, [ebp - 0x430]
push eax
call fcn.00401b77
add esp, 4
test eax, eax
jne 0x41b016
lea ecx, [ebp - 0x430]
push ecx
call fcn.00402158
add esp, 4
mov edx, dword [ebp + 0x10]
and edx, 0x20
je 0x41b096
lea eax, [ebp - 0x430]
push eax
call fcn.00401389
add esp, 4
test eax, eax
jne 0x41b096
push 0x104
lea ecx, [ebp - 0x430]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00402725
add esp, 0xc
push str.__TestFile_PleaseDelete__.txt
lea eax, [ebp - 0x110]
push eax
call fcn.00401ec4
add esp, 8
push str.This_file_should_not_exist.__Please_delete.
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402103
add esp, 8
test eax, eax
jne 0x41b087
lea edx, [ebp - 0x430]
push edx
call fcn.00402158
add esp, 4
lea eax, [ebp - 0x110]
push eax
call fcn.0040255e
add esp, 4
lea ecx, [ebp - 0x218]
push ecx
call fcn.00401b77
add esp, 4
test eax, eax
je 0x41b0c4
push 0x104
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x320]
push eax
call fcn.00402725
add esp, 0xc
mov ecx, dword [ebp + 0x10]
and ecx, 1
je 0x41b1f9
mov edx, dword [ebp + 0x10]
and edx, 2
je 0x41b1f9
mov eax, dword [ebp + 0x10]
and eax, 8
je 0x41b172
lea ecx, [ebp - 0x430]
push ecx
call fcn.00401b77
add esp, 4
test eax, eax
je 0x41b115
push 0x104
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402725
add esp, 0xc
jmp 0x41b16d
lea ecx, [ebp - 0x320]
push ecx
call fcn.00401b77
add esp, 4
test eax, eax
jne 0x41b13b
lea edx, [ebp - 0x430]
push edx
call fcn.00401389
add esp, 4
test eax, eax
je 0x41b155
push 0x104
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402725
add esp, 0xc
jmp 0x41b16d
push 0x104
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402725
add esp, 0xc
jmp 0x41b1f7
lea ecx, [ebp - 0x320]
push ecx
call fcn.00401b77
add esp, 4
test eax, eax
je 0x41b19f
push 0x104
lea edx, [ebp - 0x320]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402725
add esp, 0xc
jmp 0x41b1f7
lea ecx, [ebp - 0x430]
push ecx
call fcn.00401b77
add esp, 4
test eax, eax
jne 0x41b1c5
lea edx, [ebp - 0x320]
push edx
call fcn.00401389
add esp, 4
test eax, eax
je 0x41b1df
push 0x104
lea eax, [ebp - 0x430]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402725
add esp, 0xc
jmp 0x41b1f7
push 0x104
lea edx, [ebp - 0x320]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402725
add esp, 0xc
jmp 0x41b233
mov ecx, dword [ebp + 0x10]
and ecx, 2
je 0x41b21b
push 0x104
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402725
add esp, 0xc
jmp 0x41b233
push 0x104
lea ecx, [ebp - 0x320]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402725
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret