Function at 0x4e1400
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f2c0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x22a0
call fcn.0051dcc0
mov eax, dword [0x572844]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x4e1459
cmp word [0x58bad6], 0
je 0x4e14b8
cmp dword [0x5d869c], 0
je 0x4e14b8
xor eax, eax
mov word [0x58bad6], ax
jmp 0x4e14b8
push 1
call fcn.004e7970
mov dword [0x58fc28], 3
mov dword [0x57b138], 0
mov dword [0x57b13c], 0
mov al, byte [0x57a0e0]
test al, al
jne 0x4e159f
push 0
push 0x59801c
mov ecx, 0x5a84b0
call fcn.004524c0
cmp byte [0x5a94f2], 0
je 0x4e14b8
cmp dword [0x598034], 1
jbe 0x4e14b8
mov dword [0x58fc24], 4
mov al, byte [0x57a0e0]
test al, al
jne 0x4e159f
cmp word [0x59701a], 0
jne 0x4e159f
mov byte [ebp + 8], al
push 0x800
push 0x59701a
push dword [0x591fc0]
call fcn.004e7370
push 0x800
push 0x54266c
lea eax, [ebp - 0x1014]
push eax
push str.DefFolder
push 0x542b5c
call fcn.004c3190
cmp word [ebp - 0x1014], 0
jne 0x4e1539
cmp byte [0x5a94f2], 0
je 0x4e1576
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.0044c720
cmp word [ebp - 0x1014], 0
je 0x4e1576
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.00493970
push 0x800
push 0x59701a
lea eax, [ebp - 0x1014]
push eax
call fcn.004b0300
push 0x800
lea eax, [ebp - 0x1014]
push eax
push 0x59701a
call fcn.004b0360
push dword [0x591fc0]
cmp word [0x589ad0], 0
setne al
movzx eax, al
push eax
push 0x800
push 0x59701a
call fcn.004eb0d0
mov al, byte [0x57a0e0]
cmp dword [0x58fc24], 0
jne 0x4e15b2
mov dword [0x58fc24], 2
test al, al
je 0x4e1725
mov esi, dword [0x5a57ac]
test esi, esi
je 0x4e15fd
cmp esi, 1
je 0x4e15fd
cmp dword [0x58fbf0], 3
je 0x4e1b00
push 0x65
call fcn.004a9c90
mov esi, eax
push 0x1fd
call fcn.004a9c90
push 0x30
push esi
push eax
push dword [0x57a0c8]
call fcn.004edd90
jmp 0x4e1b00
push 0x800
push 0x59701a
mov ecx, 0x5a57a8
call fcn.00406e80
push 0x800
push 0x58cae8
mov ecx, 0x5a57a8
call fcn.004076a0
cmp word [0x58cae8], 0
je 0x4e163e
push 0x800
push 0x58cae8
call fcn.00493970
mov byte [0x58fc81], 0
lea eax, [ebp - 0x1264]
push eax
mov ecx, 0x5a57a8
call fcn.004076c0
mov eax, dword [ebp - 0x1124]
mov dword [0x591fc0], eax
mov dword [ebp - 0x129c], 0
mov dword [ebp - 0x1298], 0
mov dword [ebp - 0x1294], 0
mov dword [ebp - 0x1290], 0
mov dword [ebp - 0x128c], 0
mov dword [ebp - 0x1288], 0
push 0
lea eax, [ebp - 0x22ac]
push eax
push 0x59701a
call fcn.00485370
test al, al
je 0x4e16c6
cmp dword [ebp - 0x12ac], 0x18
jne 0x4e16c6
cmp dword [ebp - 0x12a8], 0
je 0x4e16e6
cmp dword [ebp - 0x1124], 0
jne 0x4e16df
cmp byte [ebp - 0x11e4], 0
mov byte [0x58fc6c], 1
jne 0x4e16e6
mov byte [0x58fc6c], 0
test esi, esi
jne 0x4e16f2
cmp dword [ebp - 0x109c], esi
je 0x4e16fe
movzx eax, byte [ebp - 0x112a]
mov dword [0x58fc14], eax
cmp dword [ebp - 0x1130], 0
je 0x4e171d
push 0x800
push 0x5428ac
push 0x589ad0
call fcn.004b0360
jmp 0x4e1725
xor eax, eax
mov word [0x589ad0], ax
push dword [0x57a0c8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x57a0c8]
push 0
push dword [ebp + 8]
push eax
call fcn.004e4680
test al, al
je 0x4e1ae1
movzx eax, byte [0x5d86b7]
neg eax
sbb eax, eax
and eax, dword [0x5d86b8]
mov dword [0x58fc04], eax
mov eax, dword [0x5d869c]
test eax, eax
je 0x4e1775
push eax
call fcn.004eba10
jmp 0x4e1799
cmp byte [0x57a0e0], 0
je 0x4e1799
cmp dword [ebp - 0x1130], 0
je 0x4e1799
cmp word [0x589ad0], 0x2a
jne 0x4e1799
xor eax, eax
mov word [0x589ad0], ax
cmp dword [0x598034], 0
jne 0x4e17c9
push 0x65
call fcn.004a9c90
mov esi, eax
push 0x14b
call fcn.004a9c90
push 0x30
push esi
push eax
push dword [0x57a0c8]
call fcn.004edd90
jmp 0x4e1ae1
cmp word [0x58bad6], 0
je 0x4e188f
cmp dword [0x58cad8], 0
jne 0x4e188f
push 0x54599c
push 0x58bad6
call fcn.00484ad0
mov edi, eax
test edi, edi
je 0x4e188f
push edi
push 0x400
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.00529db5
mov esi, eax
push edi
call fcn.00526918
add esp, 0x14
mov dword [ebp - 0x22b0], 0x30c
cmp esi, 0x3ff
jae 0x4e1857
mov byte [ebp + esi - 0x414], 0
test esi, esi
jne 0x4e185b
lea eax, [ebp - 0x414]
push eax
call fcn.004afba0
cmp eax, 2
jne 0x4e1880
mov dword [0x58cad8], 4
jmp 0x4e188f
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x22b0]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4e183a
mov dword [0x58cad8], 3
jmp 0x4e188f
cmp eax, 1
jne 0x4e188f
mov dword [0x58cad8], 2
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1074]
call fcn.004b03b0
mov byte [ebp - 4], 1
mov ecx, 0x59801c
call fcn.004b06a0
nop
mov ecx, 0x59801c
call fcn.004b04b0
mov esi, eax
test esi, esi
je 0x4e19b1
push 0x800
lea eax, [ebp - 0x1014]
push eax
push esi
mov ecx, 0x5a84b0
call fcn.00452e10
cmp word [esi], 0x40
jne 0x4e1936
lea eax, [ebp - 0x1014]
push eax
call fcn.004837b0
test al, al
jne 0x4e1936
push 0x800
lea eax, [ebp - 0x1014]
push eax
lea eax, [esi + 2]
push eax
mov ecx, 0x5a84b0
call fcn.00452e10
push 1
push 1
push 1
push dword [0x58cadc]
push 0
push 0
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.00484ba0
test al, al
jne 0x4e18b0
push 0x25
push esi
call fcn.0051f225
add esp, 8
test eax, eax
je 0x4e199a
push 0x25
add eax, 2
push eax
call fcn.0051f225
add esp, 8
test eax, eax
je 0x4e199a
lea eax, [ebp - 0x1014]
push eax
call fcn.004837b0
test al, al
jne 0x4e199a
push 0x800
lea eax, [ebp - 0x2264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x4e199a
push 0x800
lea eax, [ebp - 0x2264]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.004b0360
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1074]
call fcn.004b0450
jmp 0x4e18b0
lea eax, [ebp - 0x1074]
push eax
mov ecx, 0x59801c
call fcn.004114c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1074]
call fcn.00405620
mov dword [ebp - 4], 0xffffffff
push 0x800
push 0x59701a
push 0x59701a
mov ecx, 0x5a84b0
call fcn.00452e10
mov al, byte [0x58ebe8]
mov byte [0x5a80ac], al
mov ecx, 0x5a8080
call fcn.004cb5e0
cmp byte [0x595fec], 0
je 0x4e1a25
call fcn.004e21e0
jmp 0x4e1a37
movzx eax, byte [0x594fcb]
push eax
mov ecx, 0x5a57a8
call fcn.00405a30
cmp dword [0x5d869c], 0
je 0x4e1a4a
push 0x58bad6
call fcn.004831b0
cmp dword [0x57a0e4], 1
je 0x4e1ae1
cmp byte [0x57a0e0], 0
je 0x4e1a6c
mov ecx, 0x5a84b0
call fcn.00456a40
jmp 0x4e1ae1
cmp byte [0x58fc6a], 0
je 0x4e1a7f
mov ecx, 0x57b144
call fcn.004d1cb0
push 0x800
lea eax, [ebp - 0x1014]
push eax
mov ecx, 0x5a84b0
call fcn.00452420
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e1aa0
sub ecx, edx
sar ecx, 1
push ecx
push 0x59701a
lea eax, [ebp - 0x1014]
push eax
call fcn.004b4460
test eax, eax
jne 0x4e1ad1
push 0x59701a
call fcn.00495850
jmp 0x4e1ad6
mov eax, 0x54266c
push eax
mov ecx, 0x5a84b0
call fcn.00455ed0
push dword [0x5d869c]
call fcn.0051de88
add esp, 4
mov byte [0x5a80ac], 0
mov ecx, 0x5a8080
call fcn.004cb5e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051dca8
mov esp, ebp
pop ebp
ret 8