Function at 0x4f1160
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55321d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x22c4
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x4f11b9
cmp word [0x5a6eee], 0
je 0x4f1218
cmp dword [0x5f43d4], 0
je 0x4f1218
xor eax, eax
mov word [0x5a6eee], ax
jmp 0x4f1218
push 1
call fcn.004f78f0
mov dword [0x5aaf40], 3
mov dword [0x594448], 0
mov dword [0x59444c], 0
cmp byte [0x5933f4], 0
jne 0x4f12fb
push 0
push 0x5b332c
mov ecx, 0x5c5810
call fcn.0045cbf0
cmp byte [0x5c684a], 0
je 0x4f1218
cmp dword [0x5b3340], 1
jbe 0x4f1218
mov dword [0x5aaf3c], 4
cmp byte [0x5933f4], 0
jne 0x4f12fb
cmp word [0x5b232a], 0
jne 0x4f12fb
mov byte [ebp + 8], 0
push 0x800
push 0x5b232a
push dword [0x5ad2c8]
call fcn.004f71a0
push 0x800
push 0x557718
lea eax, [ebp - 0x1014]
push eax
push str.DefFolder
push 0x557bd4
call fcn.004cf7c0
cmp word [ebp - 0x1014], 0
jne 0x4f129a
cmp byte [0x5c684a], 0
je 0x4f12d7
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.00456dd0
cmp word [ebp - 0x1014], 0
je 0x4f12d7
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.004a0eb0
push 0x800
push 0x5b232a
lea eax, [ebp - 0x1014]
push eax
call fcn.004bd030
push 0x800
lea eax, [ebp - 0x1014]
push eax
push 0x5b232a
call fcn.004bd090
push dword [0x5ad2c8]
cmp word [0x5a4ee8], 0
setne al
movzx eax, al
push eax
push 0x800
push 0x5b232a
call fcn.004fb0b0
cmp dword [0x5aaf3c], 0
jne 0x4f130e
mov dword [0x5aaf3c], 2
mov dword [ebp - 0x1164], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 7
xor eax, eax
mov word [ebp - 0x1164], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], eax
mov dword [ebp - 4], 2
cmp byte [0x5933f4], al
je 0x4f1517
mov esi, dword [0x5c2bd4]
test esi, esi
je 0x4f13ef
cmp esi, 1
je 0x4f13ef
cmp dword [0x5aaf04], 3
je 0x4f13a5
push 0x65
call fcn.004b68d0
mov esi, eax
push 0x1fd
call fcn.004b68d0
push 0x30
push esi
push eax
push dword [0x5923dc]
call fcn.004fdf00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1150]
cmp ecx, 8
jb 0x4f190f
lea ecx, [ecx*2 + 2]
mov edx, dword [ebp - 0x1164]
mov eax, edx
cmp ecx, 0x1000
jb 0x4f1905
add ecx, 0x23
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f194a
jmp 0x4f1905
push 0x800
push 0x5b232a
mov ecx, 0x5c2bd0
call fcn.00409950
push 0x800
push 0x5a7f00
mov ecx, 0x5c2bd0
call fcn.0040a170
cmp word [0x5a7f00], 0
je 0x4f1430
push 0x800
push 0x5a7f00
call fcn.004a0eb0
mov byte [0x5aaf89], 0
lea eax, [ebp - 0x1288]
push eax
mov ecx, 0x5c2bd0
call fcn.0040a190
mov eax, dword [ebp - 0x1120]
mov dword [0x5ad2c8], eax
mov dword [ebp - 0x12c0], 0
mov dword [ebp - 0x12bc], 0
mov dword [ebp - 0x12b8], 0
mov dword [ebp - 0x12b4], 0
mov dword [ebp - 0x12b0], 0
mov dword [ebp - 0x12ac], 0
push 0
lea eax, [ebp - 0x22d0]
push eax
push 0x5b232a
call fcn.00492720
test al, al
je 0x4f14b8
cmp dword [ebp - 0x12d0], 0x18
jne 0x4f14b8
cmp dword [ebp - 0x12cc], 0
je 0x4f14d8
cmp dword [ebp - 0x1120], 0
jne 0x4f14d1
cmp byte [ebp - 0x1208], 0
mov byte [0x5aaf70], 1
jne 0x4f14d8
mov byte [0x5aaf70], 0
test esi, esi
jne 0x4f14e4
cmp dword [ebp - 0x1098], esi
je 0x4f14f0
movzx eax, byte [ebp - 0x1126]
mov dword [0x5aaf2c], eax
cmp dword [ebp - 0x112c], 0
je 0x4f150f
push 0x800
push 0x5578cc
push 0x5a4ee8
call fcn.004bd090
jmp 0x4f1517
xor eax, eax
mov word [0x5a4ee8], ax
push dword [0x5923dc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x5923dc]
push 0
push dword [ebp + 8]
push eax
call fcn.004f4490
test al, al
je 0x4f18e1
movzx eax, byte [0x5f43ef]
neg eax
sbb eax, eax
and eax, dword [0x5f43f0]
mov dword [0x5aaf18], eax
mov eax, dword [0x5f43d4]
test eax, eax
je 0x4f1567
push eax
call fcn.004fbae0
jmp 0x4f158b
cmp byte [0x5933f4], 0
je 0x4f158b
cmp dword [ebp - 0x112c], 0
je 0x4f158b
cmp word [0x5a4ee8], 0x2a
jne 0x4f158b
xor eax, eax
mov word [0x5a4ee8], ax
cmp dword [0x5b3340], 0
jne 0x4f15bb
push 0x65
call fcn.004b68d0
mov esi, eax
push 0x14b
call fcn.004b68d0
push 0x30
push esi
push eax
push dword [0x5923dc]
call fcn.004fdf00
jmp 0x4f18e1
cmp word [0x5a6eee], 0
je 0x4f1681
cmp dword [0x5a7ef0], 0
jne 0x4f1681
push 0x55a9fc
push 0x5a6eee
call fcn.00491f50
mov edi, eax
test edi, edi
je 0x4f1681
push edi
push 0x400
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0053bd85
mov esi, eax
push edi
call fcn.005386bd
add esp, 0x14
mov dword [ebp - 0x22d4], 0x30c
cmp esi, 0x3ff
jae 0x4f1649
mov byte [ebp + esi - 0x414], 0
test esi, esi
jne 0x4f164d
lea eax, [ebp - 0x414]
push eax
call fcn.004bc8d0
cmp eax, 2
jne 0x4f1672
mov dword [0x5a7ef0], 4
jmp 0x4f1681
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x22d4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4f162c
mov dword [0x5a7ef0], 3
jmp 0x4f1681
cmp eax, 1
jne 0x4f1681
mov dword [0x5a7ef0], 2
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1070]
call fcn.004bd0e0
mov byte [ebp - 4], 6
mov ecx, 0x5b332c
call fcn.004bd3d0
mov edi, edi
mov ecx, 0x5b332c
call fcn.004bd1e0
mov esi, eax
test esi, esi
je 0x4f17a1
push 0x800
lea eax, [ebp - 0x1014]
push eax
push esi
mov ecx, 0x5c5810
call fcn.0045d540
cmp word [esi], 0x40
jne 0x4f1726
lea eax, [ebp - 0x1014]
push eax
call fcn.00490c30
test al, al
jne 0x4f1726
push 0x800
lea eax, [ebp - 0x1014]
push eax
lea eax, [esi + 2]
push eax
mov ecx, 0x5c5810
call fcn.0045d540
push 1
push 1
push 1
push dword [0x5a7ef4]
push 0
push 0
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.00492010
test al, al
jne 0x4f16a0
push 0x25
push esi
call fcn.00530cd5
add esp, 8
test eax, eax
je 0x4f178a
push 0x25
add eax, 2
push eax
call fcn.00530cd5
add esp, 8
test eax, eax
je 0x4f178a
lea eax, [ebp - 0x1014]
push eax
call fcn.00490c30
test al, al
jne 0x4f178a
push 0x800
lea eax, [ebp - 0x2288]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x4f178a
push 0x800
lea eax, [ebp - 0x2288]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.004bd090
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1070]
call fcn.004bd180
jmp 0x4f16a0
lea eax, [ebp - 0x1070]
push eax
mov ecx, 0x5b332c
call fcn.0040d580
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1070]
call fcn.00407c30
mov dword [ebp - 4], 2
push 0x800
push 0x5b232a
push 0x5b232a
mov ecx, 0x5c5810
call fcn.0045d540
mov al, byte [0x5b3504]
mov byte [0x5c540c], al
mov ecx, 0x5c53e0
call fcn.004d7c60
cmp byte [0x5b12f8], 0
je 0x4f1815
call fcn.004f2070
jmp 0x4f1827
movzx eax, byte [0x5b02d3]
push eax
mov ecx, 0x5c2bd0
call fcn.00408310
cmp dword [0x5f43d4], 0
je 0x4f183a
push 0x5a6eee
call fcn.004906b0
cmp dword [0x5933f8], 1
je 0x4f18e1
cmp byte [0x5933f4], 0
je 0x4f1869
cmp byte [0x5b02f2], 0
jne 0x4f18e1
mov ecx, 0x5c5810
call fcn.00461060
jmp 0x4f18e1
cmp byte [0x5aaf6e], 0
je 0x4f187c
mov ecx, 0x594454
call fcn.004de200
push 0x800
lea eax, [ebp - 0x1014]
push eax
mov ecx, 0x5c5810
call fcn.0045ca50
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
jmp 0x4f18a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f18a0
sub ecx, edx
sar ecx, 1
push ecx
push 0x5b232a
lea eax, [ebp - 0x1014]
push eax
call fcn.004c11b0
test eax, eax
jne 0x4f18d1
push 0x5b232a
call fcn.004a2d90
jmp 0x4f18d6
mov eax, 0x557718
push eax
mov ecx, 0x5c5810
call fcn.00460460
push dword [0x5f43d4]
call fcn.0052f90c
add esp, 4
mov byte [0x5c540c], 0
mov ecx, 0x5c53e0
call fcn.004d7c60
jmp 0x4f13a5
push ecx
push edx
call fcn.0052f4fd
add esp, 8
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 7
xor eax, eax
mov word [ebp - 0x1164], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052f708
mov esp, ebp
pop ebp
ret 8
call fcn.00533acf
int3