Function at 0x4cab40
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520e0b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x26a0
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x4cab99
cmp word [0x5675be], 0
je 0x4cabf8
cmp dword [0x5ae1f4], 0
je 0x4cabf8
xor eax, eax
mov word [0x5675be], ax
jmp 0x4cabf8
push 1
call fcn.004d0a10
mov dword [0x56a708], 3
mov dword [0x559c00], 0
mov dword [0x559c04], 0
mov al, byte [0x558b34]
test al, al
jne 0x4cacdf
push 0
push 0x570afc
mov ecx, 0x57de98
call fcn.00447140
cmp byte [0x57eeda], 0
je 0x4cabf8
cmp dword [0x570b14], 1
jbe 0x4cabf8
mov dword [0x56a704], 4
mov al, byte [0x558b34]
test al, al
jne 0x4cacdf
cmp word [0x56fafa], 0
jne 0x4cacdf
mov byte [ebp + 8], al
push 0x800
push 0x56fafa
push dword [0x56caa0]
call fcn.004d0530
push 0x800
push 0x52452c
lea eax, [ebp - 0x1014]
push eax
push str.DefFolder
push 0x5249ac
call fcn.004ae6d0
cmp word [ebp - 0x1014], 0
jne 0x4cac79
cmp byte [0x57eeda], 0
je 0x4cacb6
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.00441040
cmp word [ebp - 0x1014], 0
je 0x4cacb6
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.004836c0
push 0x800
push 0x56fafa
lea eax, [ebp - 0x1014]
push eax
call fcn.0049ce50
push 0x800
lea eax, [ebp - 0x1014]
push eax
push 0x56fafa
call fcn.0049ce90
push dword [0x56caa0]
cmp word [0x5655b8], 0
setne al
movzx eax, al
push eax
push 0x800
push 0x56fafa
call fcn.004d4130
mov al, byte [0x558b34]
cmp dword [0x56a704], 0
jne 0x4cacf2
mov dword [0x56a704], 2
test al, al
je 0x4cae63
mov esi, dword [0x57b20c]
test esi, esi
je 0x4cad3b
cmp esi, 1
je 0x4cad3b
cmp dword [0x56a6d4], 3
je 0x4cb250
push 0x30
push 0x65
call fcn.00496b20
push eax
push 0x1fd
call fcn.00496b20
push eax
push dword [0x558aa8]
call fcn.004d6c50
jmp 0x4cb250
push 0x800
push 0x56fafa
mov ecx, 0x57b208
call fcn.00406070
push 0x800
push 0x5685d0
mov ecx, 0x57b208
call fcn.004066d0
cmp word [0x5685d0], 0
je 0x4cad7c
push 0x800
push 0x5685d0
call fcn.004836c0
mov byte [0x56a761], 0
lea eax, [ebp - 0x1664]
push eax
mov ecx, 0x57b208
call fcn.004066f0
mov eax, dword [ebp - 0x1524]
mov dword [0x56caa0], eax
mov dword [ebp - 0x169c], 0
mov dword [ebp - 0x1698], 0
mov dword [ebp - 0x1694], 0
mov dword [ebp - 0x1690], 0
mov dword [ebp - 0x168c], 0
mov dword [ebp - 0x1688], 0
push 0
lea eax, [ebp - 0x26ac]
push eax
push 0x56fafa
call fcn.00475a80
test al, al
je 0x4cae04
cmp dword [ebp - 0x16ac], 0x18
jne 0x4cae04
cmp dword [ebp - 0x16a8], 0
je 0x4cae24
cmp dword [ebp - 0x1524], 0
jne 0x4cae1d
cmp byte [ebp - 0x15e4], 0
mov byte [0x56a74c], 1
jne 0x4cae24
mov byte [0x56a74c], 0
test esi, esi
jne 0x4cae30
cmp dword [ebp - 0x149c], esi
je 0x4cae3c
movzx eax, byte [ebp - 0x152a]
mov dword [0x56a6f4], eax
cmp dword [ebp - 0x1530], 0
je 0x4cae5b
push 0x800
push 0x524704
push 0x5655b8
call fcn.0049ce90
jmp 0x4cae63
xor eax, eax
mov word [0x5655b8], ax
push dword [0x558aa8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x558aa8]
push 0
push dword [ebp + 8]
push eax
call fcn.004cdce0
test al, al
je 0x4cb231
movzx eax, byte [0x5ae20f]
neg eax
sbb eax, eax
and eax, dword [0x5ae210]
mov dword [0x56a6e8], eax
mov eax, dword [0x5ae1f4]
test eax, eax
je 0x4caeb3
push eax
call fcn.004d4a60
jmp 0x4caed7
cmp byte [0x558b34], 0
je 0x4caed7
cmp dword [ebp - 0x1530], 0
je 0x4caed7
cmp word [0x5655b8], 0x2a
jne 0x4caed7
xor eax, eax
mov word [0x5655b8], ax
cmp dword [0x570b14], 0
jne 0x4caf05
push 0x30
push 0x65
call fcn.00496b20
push eax
push 0x14b
call fcn.00496b20
push eax
push dword [0x558aa8]
call fcn.004d6c50
jmp 0x4cb231
cmp word [0x5675be], 0
je 0x4cafdb
cmp dword [0x5685c0], 0
jne 0x4cafdb
push 0x526a10
push 0x5675be
call fcn.00475430
mov edi, eax
test edi, edi
je 0x4cafdb
push edi
push 0x400
push 1
lea eax, [ebp - 0x1414]
push eax
call fcn.0050d63f
mov esi, eax
push edi
call fcn.00509ce0
add esp, 0x14
cmp esi, 0x3ff
jae 0x4caf6f
mov eax, esi
cmp esi, 0x400
jb 0x4caf74
call fcn.00502eb2
mov eax, 0x3ff
mov byte [ebp + eax - 0x1414], 0
mov dword [ebp - 0x26b0], 0x30c
test esi, esi
je 0x4cafaf
lea eax, [ebp - 0x26b0]
push eax
push esi
lea eax, [ebp - 0x1414]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4cafaf
mov dword [0x5685c0], 3
jmp 0x4cafdb
lea eax, [ebp - 0x1414]
push eax
call fcn.0049c710
cmp eax, 2
jne 0x4cafcc
mov dword [0x5685c0], 4
jmp 0x4cafdb
cmp eax, 1
jne 0x4cafdb
mov dword [0x5685c0], 2
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.0049cee0
mov byte [ebp - 4], 1
mov ecx, 0x570afc
call fcn.0049d1c0
jmp 0x4cb000
mov ecx, 0x570afc
call fcn.0049cfe0
mov esi, eax
test esi, esi
je 0x4cb101
push 0x800
lea eax, [ebp - 0x1014]
push eax
push esi
mov ecx, 0x57de98
call fcn.00447a80
cmp word [esi], 0x40
jne 0x4cb086
lea eax, [ebp - 0x1014]
push eax
call fcn.00474160
test al, al
jne 0x4cb086
push 0x800
lea eax, [ebp - 0x1014]
push eax
lea eax, [esi + 2]
push eax
mov ecx, 0x57de98
call fcn.00447a80
push 1
push 1
push 1
push dword [0x5685c4]
push 0
push 0
lea eax, [ebp - 0x1474]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.00475500
test al, al
jne 0x4cb000
push 0x25
push esi
call fcn.005042eb
add esp, 8
test eax, eax
je 0x4cb0ea
push 0x25
add eax, 2
push eax
call fcn.005042eb
add esp, 8
test eax, eax
je 0x4cb0ea
lea eax, [ebp - 0x1014]
push eax
call fcn.00474160
test al, al
jne 0x4cb0ea
push 0x800
lea eax, [ebp - 0x2664]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x4cb0ea
push 0x800
lea eax, [ebp - 0x2664]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.0049ce90
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1474]
call fcn.0049cf80
jmp 0x4cb000
lea eax, [ebp - 0x1474]
push eax
mov ecx, 0x570afc
call fcn.00410c10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.00404c50
mov dword [ebp - 4], 0xffffffff
push 0x800
push 0x56fafa
push 0x56fafa
mov ecx, 0x57de98
call fcn.00447a80
mov al, byte [0x5696d0]
mov byte [0x57da94], al
mov ecx, 0x57da68
call fcn.004b6480
cmp byte [0x56eac5], 0
je 0x4cb175
call fcn.004cba10
jmp 0x4cb187
movzx eax, byte [0x56eaab]
push eax
mov ecx, 0x57b208
call fcn.00404e30
cmp dword [0x5ae1f4], 0
je 0x4cb19a
push 0x5675be
call fcn.00473d60
cmp dword [0x558bac], 1
je 0x4cb231
cmp byte [0x558b34], 0
je 0x4cb1bc
mov ecx, 0x57de98
call fcn.0044b6b0
jmp 0x4cb231
cmp byte [0x56a74a], 0
je 0x4cb1cf
mov ecx, 0x559c34
call fcn.004bc100
push 0x800
lea eax, [ebp - 0x1014]
push eax
mov ecx, 0x57de98
call fcn.00446fa0
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cb1f0
sub ecx, edx
sar ecx, 1
push ecx
push 0x56fafa
lea eax, [ebp - 0x1014]
push eax
call fcn.004a0630
test eax, eax
jne 0x4cb221
push 0x56fafa
call fcn.00485280
jmp 0x4cb226
mov eax, 0x52452c
push eax
mov ecx, 0x57de98
call fcn.0044ab10
push dword [0x5ae1f4]
call fcn.005030dd
add esp, 4
mov byte [0x57da94], 0
mov ecx, 0x57da68
call fcn.004b6480
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00502f8e
mov esp, ebp
pop ebp
ret 8