Function at 0x4c1890
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51592b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x26a0
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x4c18e9
cmp word [0x55a4de], 0
je 0x4c1948
cmp dword [0x5a130c], 0
je 0x4c1948
xor eax, eax
mov word [0x55a4de], ax
jmp 0x4c1948
push 1
call fcn.004c7510
mov dword [0x55d628], 3
mov dword [0x54cb20], 0
mov dword [0x54cb24], 0
mov al, byte [0x54ba54]
test al, al
jne 0x4c1a2f
push 0
push 0x563a1c
mov ecx, 0x570db0
call fcn.00440ec0
cmp byte [0x571df6], 0
je 0x4c1948
cmp dword [0x563a34], 1
jbe 0x4c1948
mov dword [0x55d624], 4
mov al, byte [0x54ba54]
test al, al
jne 0x4c1a2f
cmp word [0x562a1a], 0
jne 0x4c1a2f
mov byte [ebp + 8], al
push 0x800
push 0x562a1a
push dword [0x55f9c0]
call fcn.004c7020
push 0x800
push 0x51787c
lea eax, [ebp - 0x1414]
push eax
push str.DefFolder
push 0x517cc4
call fcn.004a5ee0
cmp word [ebp - 0x1414], 0
jne 0x4c19c9
cmp byte [0x571df6], 0
je 0x4c1a06
push 0x800
lea eax, [ebp - 0x1414]
push eax
call fcn.0043b770
cmp word [ebp - 0x1414], 0
je 0x4c1a06
push 0x800
lea eax, [ebp - 0x1414]
push eax
call fcn.0047bc90
push 0x800
push 0x562a1a
lea eax, [ebp - 0x1414]
push eax
call fcn.00494790
push 0x800
lea eax, [ebp - 0x1414]
push eax
push 0x562a1a
call fcn.004947d0
push dword [0x55f9c0]
cmp word [0x5584d8], 0
setne al
movzx eax, al
push eax
push 0x800
push 0x562a1a
call fcn.004cab90
mov al, byte [0x54ba54]
cmp dword [0x55d624], 0
jne 0x4c1a42
mov dword [0x55d624], 2
test al, al
je 0x4c1bb3
mov esi, dword [0x56e12c]
test esi, esi
je 0x4c1a8b
cmp esi, 1
je 0x4c1a8b
cmp dword [0x55d5f4], 3
je 0x4c1fb3
push 0x30
push 0x65
call fcn.0048e4c0
push eax
push 0x1fd
call fcn.0048e4c0
push eax
push dword [0x54b9c8]
call fcn.004cd560
jmp 0x4c1fb3
push 0x800
push 0x562a1a
mov ecx, 0x56e128
call fcn.00405080
push 0x800
push 0x55b4f0
mov ecx, 0x56e128
call fcn.00405420
cmp word [0x55b4f0], 0
je 0x4c1acc
push 0x800
push 0x55b4f0
call fcn.0047bc90
mov byte [0x55d680], 0
lea eax, [ebp - 0x1664]
push eax
mov ecx, 0x56e128
call fcn.00405440
mov eax, dword [ebp - 0x1524]
mov dword [0x55f9c0], eax
mov dword [ebp - 0x169c], 0
mov dword [ebp - 0x1698], 0
mov dword [ebp - 0x1694], 0
mov dword [ebp - 0x1690], 0
mov dword [ebp - 0x168c], 0
mov dword [ebp - 0x1688], 0
push 0
lea eax, [ebp - 0x26ac]
push eax
push 0x562a1a
call fcn.0046e3d0
test al, al
je 0x4c1b54
cmp dword [ebp - 0x16ac], 0x18
jne 0x4c1b54
cmp dword [ebp - 0x16a8], 0
je 0x4c1b74
cmp dword [ebp - 0x1524], 0
jne 0x4c1b6d
cmp byte [ebp - 0x15e4], 0
mov byte [0x55d66c], 1
jne 0x4c1b74
mov byte [0x55d66c], 0
test esi, esi
jne 0x4c1b80
cmp dword [ebp - 0x149c], esi
je 0x4c1b8c
movzx eax, byte [ebp - 0x152a]
mov dword [0x55d614], eax
cmp dword [ebp - 0x1530], 0
je 0x4c1bab
push 0x800
push 0x517a54
push 0x5584d8
call fcn.004947d0
jmp 0x4c1bb3
xor eax, eax
mov word [0x5584d8], ax
push dword [0x54b9c8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x54b9c8]
push 0
push dword [ebp + 8]
push eax
call fcn.004c48d0
test al, al
je 0x4c1f94
movzx eax, byte [0x5a1327]
neg eax
sbb eax, eax
and eax, dword [0x5a1328]
mov dword [0x55d608], eax
mov eax, dword [0x5a130c]
test eax, eax
je 0x4c1c03
push eax
call fcn.004cb4c0
jmp 0x4c1c27
cmp byte [0x54ba54], 0
je 0x4c1c27
cmp dword [ebp - 0x1530], 0
je 0x4c1c27
cmp word [0x5584d8], 0x2a
jne 0x4c1c27
xor eax, eax
mov word [0x5584d8], ax
cmp dword [0x563a34], 0
jne 0x4c1c55
push 0x30
push 0x65
call fcn.0048e4c0
push eax
push 0x14b
call fcn.0048e4c0
push eax
push dword [0x54b9c8]
call fcn.004cd560
jmp 0x4c1f94
cmp word [0x55a4de], 0
je 0x4c1d39
cmp dword [0x55b4e0], 0
jne 0x4c1d39
push 0x519c98
push 0x55a4de
call fcn.0046dd80
mov edi, eax
test edi, edi
je 0x4c1d39
push edi
push 0x400
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0050273f
mov esi, eax
push edi
call fcn.004fede7
add esp, 0x14
cmp esi, 0x3ff
jae 0x4c1cbf
mov eax, esi
cmp esi, 0x400
jb 0x4c1cc4
call fcn.004f8260
mov eax, 0x3ff
mov byte [ebp + eax - 0x414], 0
mov dword [ebp - 0x26b0], 0x30c
test esi, esi
je 0x4c1cff
lea eax, [ebp - 0x26b0]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4c1cff
mov dword [0x55b4e0], 3
jmp 0x4c1d39
cmp esi, 3
jbe 0x4c1d39
cmp byte [ebp - 0x414], 0xef
jne 0x4c1d39
cmp byte [ebp - 0x413], 0xbb
jne 0x4c1d39
cmp byte [ebp - 0x412], 0xbf
jne 0x4c1d39
lea eax, [ebp - 0x414]
push eax
call fcn.00497760
test al, al
je 0x4c1d39
mov dword [0x55b4e0], 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.00494820
mov byte [ebp - 4], 1
mov ecx, 0x563a1c
call fcn.00494b00
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop
mov ecx, 0x563a1c
call fcn.00494920
mov esi, eax
test esi, esi
je 0x4c1e5d
push 0x800
lea eax, [ebp - 0x1414]
push eax
push esi
mov ecx, 0x570db0
call fcn.004417b0
cmp word [esi], 0x40
jne 0x4c1de6
lea eax, [ebp - 0x1414]
push eax
call fcn.0046cad0
test al, al
jne 0x4c1de6
push 0x800
lea eax, [ebp - 0x1414]
push eax
lea eax, [esi + 2]
push eax
mov ecx, 0x570db0
call fcn.004417b0
push 1
push 1
push 1
push dword [0x55b4e4]
push 0
push 0
lea eax, [ebp - 0x1474]
push eax
lea eax, [ebp - 0x1414]
push eax
call fcn.0046de50
test al, al
jne 0x4c1d60
push 0x25
push esi
call fcn.004f961b
add esp, 8
test eax, eax
je 0x4c1e46
push 0x25
add eax, 2
push eax
call fcn.004f961b
add esp, 8
test eax, eax
je 0x4c1e46
lea eax, [ebp - 0x1414]
push eax
call fcn.0046cad0
test al, al
jne 0x4c1e46
push 0x800
lea eax, [ebp - 0x2664]
push eax
push esi
call edi
dec eax
cmp eax, 0x7ff
ja 0x4c1e46
push 0x800
lea eax, [ebp - 0x2664]
push eax
lea eax, [ebp - 0x1414]
push eax
call fcn.004947d0
lea eax, [ebp - 0x1414]
push eax
lea ecx, [ebp - 0x1474]
call fcn.004948c0
jmp 0x4c1d60
lea eax, [ebp - 0x1474]
push eax
mov ecx, 0x563a1c
call fcn.0040e430
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.00404180
mov dword [ebp - 4], 0xffffffff
cmp byte [0x5619cd], 0
jne 0x4c1ea6
push 0x800
push 0x562a1a
push 0x562a1a
mov ecx, 0x570db0
call fcn.004417b0
mov al, byte [0x55c5f0]
mov byte [0x5709ac], al
mov ecx, 0x570980
call fcn.004adbd0
cmp byte [0x5619e5], 0
je 0x4c1eda
call fcn.004c2780
jmp 0x4c1eec
movzx eax, byte [0x5619cb]
push eax
mov ecx, 0x56e128
call fcn.004041f0
cmp dword [0x5a130c], 0
je 0x4c1eff
push 0x55a4de
call fcn.0046c6d0
cmp dword [0x54bacc], 1
je 0x4c1f94
cmp byte [0x54ba54], 0
je 0x4c1f21
mov ecx, 0x570db0
call fcn.00445040
jmp 0x4c1f94
cmp byte [0x55d66a], 0
je 0x4c1f34
mov ecx, 0x54cb54
call fcn.004b3790
push 0x800
lea eax, [ebp - 0x1414]
push eax
mov ecx, 0x570db0
call fcn.00440d20
lea ecx, [ebp - 0x1414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c1f53
sub ecx, edx
sar ecx, 1
push ecx
push 0x562a1a
lea eax, [ebp - 0x1414]
push eax
call fcn.00497de0
test eax, eax
jne 0x4c1f84
push 0x562a1a
call fcn.0047d830
jmp 0x4c1f89
mov eax, 0x51787c
push eax
mov ecx, 0x570db0
call fcn.004444e0
push dword [0x5a130c]
call fcn.004f8488
add esp, 4
mov byte [0x5709ac], 0
mov ecx, 0x570980
call fcn.004adbd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f833c
mov esp, ebp
pop ebp
ret 8