Function at 0x4d9404
Capabilities:
Allocate or change rwx memory
Query environment variable
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4d940c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d9c02
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
lea ecx, [ebp - 0x13c]
mov edx, 0xa
mov eax, 0x4d9c1c
call fcn.004d90e8
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
mov ecx, 0
call fcn.00405d6c
mov eax, dword [ebp - 0x138]
call fcn.00405414
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 0x10], eax
push eax
push eax
pop eax
inc eax
inc eax
or eax, 0xce
inc eax
and eax, 0x20
or eax, 0x183
or eax, 0xd0
dec eax
add eax, 0x7a
pop eax
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
push 0x105
lea eax, [ebp - 0x133]
push eax
lea ecx, [ebp - 0x144]
mov edx, 6
mov eax, 0x4d9c64
call fcn.004d90e8
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
mov ecx, 0
call fcn.00405d6c
mov eax, dword [ebp - 0x140]
call fcn.00405414
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x133]
mov ecx, 0x105
call fcn.00405d10
mov eax, dword [ebp - 0x148]
call fcn.0040c600
test al, al
jne 0x4d95a8
push 0x105
lea eax, [ebp - 0x133]
push eax
lea ecx, [ebp - 0x150]
mov edx, 0xa
mov eax, 0x4d9d28
call fcn.004d90e8
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov ecx, 0
call fcn.00405d6c
mov eax, dword [ebp - 0x14c]
call fcn.00405414
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x4d9ddc
call sub.kernel32.dll_GlobalAddAtomW
push edx
push ecx
push ecx
pop ecx
xchg edx, edx
xchg ecx, ecx
mov ecx, 0x3a
mov edx, 0x150
xor edx, 0x66
and edx, 0x40
or ecx, 0x163
sub edx, 0xff
pop ecx
pop edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x133]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x1c], eax
push ebx
push eax
nop
nop
nop
mov eax, 0x11a
nop
nop
nop
nop
sub ebx, 0x155
nop
nop
nop
nop
nop
or ebx, 0x2d
dec eax
mov eax, 0x60
add ebx, 0x1a6
inc eax
pop eax
pop ebx
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
push 0
push 0
push 0
push 0x1000002
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x20], eax
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
push 1
call sub.user32.dll_GetLastActivePopup
push ebx
xchg ebx, ebx
mov ebx, 0xac
and ebx, 0x3c
xchg ebx, ebx
and ebx, 0x13e
sub ebx, 0x94
pop ebx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x3c]
add ebx, dword [ebp - 0x14]
push ebx
push esi
inc esi
sub esi, 0x2a
nop
nop
xchg ebx, ebx
and ebx, 0xd2
xor esi, 0x125
dec esi
mov ebx, 0x11c
mov esi, 0x188
and ebx, 0x33
add esi, 0x127
or esi, 0xe0
pop esi
pop ebx
push 1
call sub.user32.dll_GetLastActivePopup
push ebx
xchg ebx, ebx
mov ebx, 0xac
and ebx, 0x3c
xchg ebx, ebx
and ebx, 0x13e
sub ebx, 0x94
pop ebx
movzx eax, word [ebx + 6]
dec eax
test ax, ax
jb 0x4d9ace
inc eax
mov word [ebp - 0x2e], ax
mov word [ebp - 0x26], 0
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x3c]
add ebx, dword [ebp - 0x14]
add ebx, 0xf8
movzx eax, word [ebp - 0x26]
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add ebx, eax
push 1
call sub.user32.dll_GetLastActivePopup
push ebx
xchg ebx, ebx
mov ebx, 0xac
and ebx, 0x3c
xchg ebx, ebx
and ebx, 0x13e
sub ebx, 0x94
pop ebx
push 0
mov edx, ebx
lea eax, [ebp - 4]
mov ecx, 8
call fcn.00405094
push ebx
push edi
add edi, 0x134
add ebx, 0xcc
push ebx
pop ebx
dec edi
pop edi
pop ebx
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405d44
lea ecx, [ebp - 0x158]
mov edx, 2
mov eax, 0x4d9e28
call fcn.004d90e8
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov ecx, 0
call fcn.00405d6c
mov eax, dword [ebp - 0x154]
call fcn.00405414
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00405ca4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4d9856
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4d9856
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.0040512c
mov edi, eax
test edi, edi
je 0x4d9861
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4d987e
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4d987e
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.0040512c
mov esi, eax
test esi, esi
je 0x4d9889
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp - 0xc]
call fcn.00405bb4
push eax
push edi
mov eax, dword [ebp - 8]
call fcn.00405bb4
push eax
push 0
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
jne 0x4d9a56
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
xor eax, eax
mov dword [ebp - 0x2c], eax
push ecx
xor ecx, 0x11b
or ecx, 0x69
and ecx, 0x17
xchg ecx, ecx
xchg ecx, ecx
push ecx
pop ecx
mov ecx, 0x5c
push ecx
pop ecx
push ecx
pop ecx
and ecx, 0x146
and ecx, 0x1b
pop ecx
push 0x4d9e4c
call sub.kernel32.dll_GlobalAddAtomW
lea eax, [ebp - 0x2c]
push eax
push 0x40
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
push edx
sub edx, 0x82
or edx, 0x6c
xchg edx, edx
xor edx, 4
inc edx
and edx, 0x12a
and edx, 0x10
inc edx
inc edx
nop
nop
nop
mov edx, 0x1a9
sub edx, 0x59
pop edx
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xc]
add edx, eax
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov eax, ecx
mov ecx, dword [ebx + 8]
call fcn.00403278
call sub.kernel32.dll_GetUserDefaultLCID
push edi
xchg edi, edi
add edi, 0xfd
mov edi, 0x104
push edi
pop edi
and edi, 0x1a0
or edi, 0xd9
dec edi
xchg edi, edi
and edi, 0x3a
pop edi
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
push 0x4d9e88
call sub.kernel32.dll_GlobalAddAtomW
push edx
xchg edx, edx
mov edx, 0x1a7
mov edx, 0xa9
dec edx
push edx
pop edx
xor edx, 0x161
pop edx
push ecx
push esi
push ecx
pop ecx
mov esi, 0x152
inc ecx
xchg ecx, esi
xchg ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or esi, 4
and esi, 0x15e
xor esi, 0x99
pop esi
pop ecx
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
push 0x4d9e88
call sub.kernel32.dll_GlobalAddAtomW
push edx
xchg edx, edx
mov edx, 0x1a7
mov edx, 0xa9
dec edx
push edx
pop edx
xor edx, 0x161
pop edx
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
inc word [ebp - 0x26]
dec word [ebp - 0x2e]
jne 0x4d975f
call sub.kernel32.dll_GetCurrentThread
push edi
dec edi
push edi
pop edi
mov edi, 0x17f
nop
nop
nop
nop
nop
xchg edi, edi
push edi
pop edi
inc edi
xchg edi, edi
xchg edi, edi
pop edi
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
push esi
and esi, 0x133
push esi
pop esi
sub esi, 0xb3
push esi
pop esi
or esi, 0xc7
inc esi
mov esi, 0x13
sub esi, 0x43
xchg esi, esi
and esi, 0x18c
xor esi, 0x92
pop esi
push 1
call sub.user32.dll_GetLastActivePopup
push ebx
xchg ebx, ebx
mov ebx, 0xac
and ebx, 0x3c
xchg ebx, ebx
and ebx, 0x13e
sub ebx, 0x94
pop ebx
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
call sub.user32.dll_IsZoomed
push edi
add edi, 0x5d
mov edi, 0xe0
push edi
pop edi
or edi, 0xe4
dec edi
mov edi, 0x8a
and edi, 0x4c
nop
nop
nop
nop
dec edi
inc edi
or edi, 0x2b
dec edi
pop edi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9c09
lea eax, [ebp - 0x158]
call fcn.00405b18
lea eax, [ebp - 0x154]
call fcn.00404f5c
lea eax, [ebp - 0x150]
call fcn.00405b18
lea eax, [ebp - 0x14c]
call fcn.00404f5c
lea eax, [ebp - 0x148]
mov edx, 2
call fcn.00405b20
lea eax, [ebp - 0x140]
call fcn.00404f5c
lea eax, [ebp - 0x13c]
call fcn.00405b18
lea eax, [ebp - 0x138]
call fcn.00404f5c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405b20
lea eax, [ebp - 4]
call fcn.00404f5c
ret