Function at 0x1004d300
Capabilities:
Allocate or change rwx memory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x1006c968]
sub esp, 0x10
push esi
mov esi, ecx
mov cx, word [0x1006c978]
movzx edx, cx
sub edx, eax
push edi
cmp edx, 0x63
jne 0x1004d349
mov ecx, dword [0x1006c984]
mov edx, dword [0x1006c980]
add ecx, 5
movzx eax, word [0x1006c954]
add ecx, edx
mov dword [0x1006c984], ecx
sub ecx, eax
add ecx, 0xffffffb0
add ecx, edx
jmp 0x1004d366
mov eax, dword [0x1006c984]
sub eax, dword [0x1006c954]
sub eax, 9
add cx, ax
mov word [0x1006c978], cx
mov ecx, 0xfffffffe
mov edi, dword [0x1006c958]
mov dword [0x1006c980], ecx
cmp ecx, edi
jb 0x1004d3a2
mov al, byte [0x1006c956]
mov edi, ecx
movzx ecx, word [0x1006c962]
movzx edx, al
movzx eax, al
sub edi, edx
imul eax, ecx
sub edi, 0x1f
mov word [0x1006c962], ax
imul eax, edi, 0x4e
add eax, edx
mov dword [0x1006c980], eax
mov eax, dword [0x1006eedc]
sub edi, esi
mov dword [0x1006eed0], eax
sub edi, 0x1f
push 0x703
movzx eax, di
push 0x10106b88
sub eax, 0x72
mov word [0x1006c954], di
push str.indica
mov dword [0x1006c958], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dl, byte [0x1006c956]
mov edi, 0xffff85e1
movzx ecx, dl
sub edi, ecx
cmp word [0x1006c9aa], 9
mov dword [ebp - 0xc], edi
je 0x1004d401
mov eax, dword [0x1006c958]
sub eax, ecx
sub eax, 0x1f
jmp 0x1004d40a
imul eax, ecx, 0x4e
add eax, dword [0x1006c958]
mov dword [0x1006c980], eax
mov eax, dword [0x1006c954]
lea ecx, [eax + eax]
movzx eax, dl
sub cx, ax
mov eax, 0x7b18
add cx, di
sub cx, ax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x51ca
push dword [0x1006eed0]
mov word [0x1006c954], cx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dl, byte [0x1006c956]
mov ecx, dword [0x1006c958]
movzx eax, dl
mov dword [ebp - 4], eax
sub eax, edi
mov di, word [0x1006c954]
sub eax, 0x50
add di, ax
mov eax, dword [0x1006c980]
mov word [0x1006c954], di
cmp eax, ecx
jb 0x1004d4a8
mov ecx, dword [ebp - 4]
movzx edx, dl
sub eax, edx
movzx ecx, cx
sub eax, 0x1f
mov dword [ebp - 8], eax
movzx eax, word [0x1006c962]
imul ecx, eax
mov word [0x1006c962], cx
mov ecx, dword [ebp - 8]
imul eax, ecx, 0x4e
add eax, edx
mov dword [0x1006c980], eax
mov dx, word [0x1006c978]
movzx eax, di
add eax, eax
sub eax, dword [ebp - 0xc]
sub eax, esi
add eax, 0xffffffb0
add eax, ecx
movzx ecx, dx
mov dword [ebp - 0xc], eax
movzx eax, word [0x1006c968]
sub ecx, eax
cmp ecx, 0x63
jne 0x1004d4f3
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + 5]
add di, ax
movzx eax, di
sub eax, esi
mov word [0x1006c954], di
add eax, 0xffffffb0
add eax, ecx
mov dword [0x1006c958], eax
jmp 0x1004d511
mov eax, dword [0x1006c954]
sub eax, esi
mov dword [0x1006c958], 0xfffffffe
sub eax, 9
add dx, ax
mov word [0x1006c978], dx
movzx eax, byte [0x1006c956]
push 0x703
push 0x1006e080
sub eax, 0x50
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [0x1006c958], eax
push dword [0x1006eed0]
mov ecx, dword [0x1006c958]
mov edi, 0x20fc
cmp word [0x1006c96e], di
movzx edx, word [0x1006c954]
movzx eax, cx
cmove edx, eax
add ecx, ecx
movzx eax, dx
mov edx, dword [ebp - 4]
sub ecx, eax
lea eax, [esi - 0x7b18]
add eax, ecx
mov dword [0x1006c958], eax
movzx eax, byte [0x1006c956]
sub al, 0x49
add al, dl
movzx ecx, al
movzx eax, word [0x1006c962]
sub cx, dx
sub cx, 2
mov word [0x1006c954], cx
cmp eax, esi
ja 0x1004d5bd
movzx eax, cx
imul eax, eax, 0x4f
mov word [0x1006c97a], cx
sub eax, 9
mov dword [0x1006c958], eax
lea eax, [esi + 0x24b7]
add cx, ax
mov word [0x1006c954], cx
mov byte [0x1006c956], 0xe1
ret