Function at 0x4ad04796
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4ad33b78]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov eax, 0x4ad34880
push edi
push eax
mov dword [ebp - 0x48], ebx
mov dword [0x4ad2fa78], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.4ad01eed
push 1
push 0x4ad10a6b
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.4ad01673
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push ebx
mov dword [0x4ad2b0d0], eax
call fcn.4ad0499b
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
test eax, eax
mov esi, 0x4ad250a0
je 0x4ad04805
call edi
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
push esi
call fcn.4ad02292
push 0
mov edi, str.C:Documents_and_SettingsPat
push edi
call fcn.4ad01550
call fcn.4ad053a7
push esi
push ebx
call fcn.4ad051d7
cmp word [str.C:Documents_and_SettingsPat], 0x5c
je 0x4ad1409c
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0x4ad33ba0
push eax
mov dword [0x4ad2b9ec], eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
call fcn.4ad05494
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 0x20c
push ebx
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
push ebx
xor ebx, ebx
push ebx
mov dword [0x4ad2fa80], eax
call esi
push eax
call edi
cmp dword [0x4ad2fa80], ebx
mov dword [0x4ad2fa84], eax
je 0x4ad048c1
cmp eax, ebx
je 0x4ad048c1
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x4ad140e0
mov ecx, dword [0x4ad2fa80]
cmp ecx, ebx
je 0x4ad048c1
mov eax, dword [0x4ad2fa84]
cmp eax, ebx
je 0x4ad048c1
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [0x4ad2fabc], ebx
je 0x4ad11443
mov edi, dword [ebp - 0x48]
cmp dword [edi + 8], ebx
je 0x4ad11510
push 0x4ad0497c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ad04970
push eax
mov dword [0x4ad34848], eax
call esi
push 0x4ad0495c
push dword [0x4ad34848]
mov dword [0x4ad2fa6c], eax
call esi
push 0x4ad04944
push dword [0x4ad34848]
mov dword [0x4ad2fa70], eax
call esi
mov dword [0x4ad2fa74], eax
cmp dword [edi], ebx
jne 0x4ad04932
cmp dword [edi + 4], ebx
jne 0x4ad04932
cmp dword [edi + 8], ebx
je 0x4ad1141b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 4
xor eax, eax
jmp 0x4ad04935
push 1
call fcn.4ad05b41
test eax, eax
je 0x4ad048cd
cmp word [0x4ad2fa88], bx
jne 0x4ad11489
lea eax, [ebp - 0x60]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4ad1147c
mov ax, word [ebp - 0x58]
mov word [0x4ad2fa88], ax
cmp word [0x4ad2fa88], bx
je 0x4ad048cd
xor eax, eax
mov ax, word [0x4ad2fa88]
push eax
call fcn.4ad114a1
jmp 0x4ad048cd
push 0x20
lea eax, [ebp - 0x44]
push eax
call fcn.4ad1155a
lea eax, [ebp - 0x44]
push eax
push 1
push 0x2350
call fcn.4ad0bfae
push 0x4ad34b78
call fcn.4ad05e00
push ebx
push 0x2334
call fcn.4ad0bfae
add esp, 0x18
cmp byte [0x4ad3484c], 0
jne 0x4ad048d9
jmp 0x4ad140f5