Function at 0x4cbea0
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d32b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x26a0
call fcn.00507730
mov eax, dword [0x5755c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x4cbef9
cmp word [0x58e9ae], 0
je 0x4cbf58
cmp dword [0x5d96d4], 0
je 0x4cbf58
xor eax, eax
mov word [0x58e9ae], ax
jmp 0x4cbf58
push 1
call fcn.004d2030
mov dword [0x591afc], 3
mov dword [0x57f008], 0
mov dword [0x57f00c], 0
mov al, byte [0x57dfb4]
test al, al
jne 0x4cc03f
push 0
push 0x599eec
mov ecx, 0x5a9378
call fcn.004477c0
cmp byte [0x5aa3ba], 0
je 0x4cbf58
cmp dword [0x599f04], 1
jbe 0x4cbf58
mov dword [0x591af8], 4
mov al, byte [0x57dfb4]
test al, al
jne 0x4cc03f
cmp word [0x598eea], 0
jne 0x4cc03f
mov byte [ebp + 8], al
push 0x800
push 0x598eea
push dword [0x593e90]
call fcn.004d1a30
push 0x800
push 0x541b9c
lea eax, [ebp - 0x1014]
push eax
push str.DefFolder
push 0x542068
call fcn.004af2c0
cmp word [ebp - 0x1014], 0
jne 0x4cbfd9
cmp byte [0x5aa3ba], 0
je 0x4cc016
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.00441650
cmp word [ebp - 0x1014], 0
je 0x4cc016
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.00484610
push 0x800
push 0x598eea
lea eax, [ebp - 0x1014]
push eax
call fcn.0049dbe0
push 0x800
lea eax, [ebp - 0x1014]
push eax
push 0x598eea
call fcn.0049dc20
push dword [0x593e90]
cmp word [0x58c9a8], 0
setne al
movzx eax, al
push eax
push 0x800
push 0x598eea
call fcn.004d57a0
mov al, byte [0x57dfb4]
cmp dword [0x591af8], 0
jne 0x4cc052
mov dword [0x591af8], 2
test al, al
je 0x4cc1c3
mov esi, dword [0x5a6674]
test esi, esi
je 0x4cc09b
cmp esi, 1
je 0x4cc09b
cmp dword [0x591ac4], 3
je 0x4cc5b0
push 0x30
push 0x65
call fcn.00497960
push eax
push 0x1fd
call fcn.00497960
push eax
push dword [0x57cf9c]
call fcn.004d8380
jmp 0x4cc5b0
push 0x800
push 0x598eea
mov ecx, 0x5a6670
call fcn.004065d0
push 0x800
push 0x58f9c0
mov ecx, 0x5a6670
call fcn.00406c30
cmp word [0x58f9c0], 0
je 0x4cc0dc
push 0x800
push 0x58f9c0
call fcn.00484610
mov byte [0x591b51], 0
lea eax, [ebp - 0x1664]
push eax
mov ecx, 0x5a6670
call fcn.00406c50
mov eax, dword [ebp - 0x1524]
mov dword [0x593e90], eax
mov dword [ebp - 0x169c], 0
mov dword [ebp - 0x1698], 0
mov dword [ebp - 0x1694], 0
mov dword [ebp - 0x1690], 0
mov dword [ebp - 0x168c], 0
mov dword [ebp - 0x1688], 0
push 0
lea eax, [ebp - 0x26ac]
push eax
push 0x598eea
call fcn.004769d0
test al, al
je 0x4cc164
cmp dword [ebp - 0x16ac], 0x18
jne 0x4cc164
cmp dword [ebp - 0x16a8], 0
je 0x4cc184
cmp dword [ebp - 0x1524], 0
jne 0x4cc17d
cmp byte [ebp - 0x15e4], 0
mov byte [0x591b3c], 1
jne 0x4cc184
mov byte [0x591b3c], 0
test esi, esi
jne 0x4cc190
cmp dword [ebp - 0x149c], esi
je 0x4cc19c
movzx eax, byte [ebp - 0x152a]
mov dword [0x591ae8], eax
cmp dword [ebp - 0x1530], 0
je 0x4cc1bb
push 0x800
push 0x541db4
push 0x58c9a8
call fcn.0049dc20
jmp 0x4cc1c3
xor eax, eax
mov word [0x58c9a8], ax
push dword [0x57cf9c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x57cf9c]
push 0
push dword [ebp + 8]
push eax
call fcn.004cf170
test al, al
je 0x4cc591
movzx eax, byte [0x5d96ef]
neg eax
sbb eax, eax
and eax, dword [0x5d96f0]
mov dword [0x591ad8], eax
mov eax, dword [0x5d96d4]
test eax, eax
je 0x4cc213
push eax
call fcn.004d60d0
jmp 0x4cc237
cmp byte [0x57dfb4], 0
je 0x4cc237
cmp dword [ebp - 0x1530], 0
je 0x4cc237
cmp word [0x58c9a8], 0x2a
jne 0x4cc237
xor eax, eax
mov word [0x58c9a8], ax
cmp dword [0x599f04], 0
jne 0x4cc265
push 0x30
push 0x65
call fcn.00497960
push eax
push 0x14b
call fcn.00497960
push eax
push dword [0x57cf9c]
call fcn.004d8380
jmp 0x4cc591
cmp word [0x58e9ae], 0
je 0x4cc33b
cmp dword [0x58f9b0], 0
jne 0x4cc33b
push 0x54403c
push 0x58e9ae
call fcn.00476380
mov edi, eax
test edi, edi
je 0x4cc33b
push edi
push 0x400
push 1
lea eax, [ebp - 0x1414]
push eax
call fcn.0052891c
mov esi, eax
push edi
call fcn.00525a4d
add esp, 0x14
cmp esi, 0x3ff
jae 0x4cc2cf
mov eax, esi
cmp esi, 0x400
jb 0x4cc2d4
call fcn.00507636
mov eax, 0x3ff
mov byte [ebp + eax - 0x1414], 0
mov dword [ebp - 0x26b0], 0x30c
test esi, esi
je 0x4cc30f
lea eax, [ebp - 0x26b0]
push eax
push esi
lea eax, [ebp - 0x1414]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4cc30f
mov dword [0x58f9b0], 3
jmp 0x4cc33b
lea eax, [ebp - 0x1414]
push eax
call fcn.0049d4a0
cmp eax, 2
jne 0x4cc32c
mov dword [0x58f9b0], 4
jmp 0x4cc33b
cmp eax, 1
jne 0x4cc33b
mov dword [0x58f9b0], 2
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.0049dc70
mov byte [ebp - 4], 1
mov ecx, 0x599eec
call fcn.0049df50
jmp 0x4cc360
mov ecx, 0x599eec
call fcn.0049dd70
mov esi, eax
test esi, esi
je 0x4cc461
push 0x800
lea eax, [ebp - 0x1014]
push eax
push esi
mov ecx, 0x5a9378
call fcn.00448100
cmp word [esi], 0x40
jne 0x4cc3e6
lea eax, [ebp - 0x1014]
push eax
call fcn.004750c0
test al, al
jne 0x4cc3e6
push 0x800
lea eax, [ebp - 0x1014]
push eax
lea eax, [esi + 2]
push eax
mov ecx, 0x5a9378
call fcn.00448100
push 1
push 1
push 1
push dword [0x58f9b4]
push 0
push 0
lea eax, [ebp - 0x1474]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.00476450
test al, al
jne 0x4cc360
push 0x25
push esi
call fcn.0051f04b
add esp, 8
test eax, eax
je 0x4cc44a
push 0x25
add eax, 2
push eax
call fcn.0051f04b
add esp, 8
test eax, eax
je 0x4cc44a
lea eax, [ebp - 0x1014]
push eax
call fcn.004750c0
test al, al
jne 0x4cc44a
push 0x800
lea eax, [ebp - 0x2664]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x4cc44a
push 0x800
lea eax, [ebp - 0x2664]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.0049dc20
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1474]
call fcn.0049dd10
jmp 0x4cc360
lea eax, [ebp - 0x1474]
push eax
mov ecx, 0x599eec
call fcn.00410d80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1474]
call fcn.00405100
mov dword [ebp - 4], 0xffffffff
push 0x800
push 0x598eea
push 0x598eea
mov ecx, 0x5a9378
call fcn.00448100
mov al, byte [0x590ac0]
mov byte [0x5a8f74], al
mov ecx, 0x5a8f48
call fcn.004b7350
cmp byte [0x597ebc], 0
je 0x4cc4d5
call fcn.004ccd80
jmp 0x4cc4e7
movzx eax, byte [0x596e9b]
push eax
mov ecx, 0x5a6670
call fcn.00405290
cmp dword [0x5d96d4], 0
je 0x4cc4fa
push 0x58e9ae
call fcn.00474cc0
cmp dword [0x57dfb8], 1
je 0x4cc591
cmp byte [0x57dfb4], 0
je 0x4cc51c
mov ecx, 0x5a9378
call fcn.0044bdc0
jmp 0x4cc591
cmp byte [0x591b3a], 0
je 0x4cc52f
mov ecx, 0x57f024
call fcn.004bcfe0
push 0x800
lea eax, [ebp - 0x1014]
push eax
mov ecx, 0x5a9378
call fcn.00447620
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cc550
sub ecx, edx
sar ecx, 1
push ecx
push 0x598eea
lea eax, [ebp - 0x1014]
push eax
call fcn.004a1380
test eax, eax
jne 0x4cc581
push 0x598eea
call fcn.00486220
jmp 0x4cc586
mov eax, 0x541b9c
push eax
mov ecx, 0x5a9378
call fcn.0044b220
push dword [0x5d96d4]
call fcn.0050786d
add esp, 4
mov byte [0x5a8f74], 0
mov ecx, 0x5a8f48
call fcn.004b7350
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00507712
mov esp, ebp
pop ebp
ret 8