Function at 0x4f1d30
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x553fbd
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x22c4
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x4f1d89
cmp word [0x5a7eee], 0
je 0x4f1de8
cmp dword [0x5f53d4], 0
je 0x4f1de8
xor eax, eax
mov word [0x5a7eee], ax
jmp 0x4f1de8
push 1
call fcn.004f84c0
mov dword [0x5abf40], 3
mov dword [0x595448], 0
mov dword [0x59544c], 0
cmp byte [0x5943f4], 0
jne 0x4f1ecb
push 0
push 0x5b432c
mov ecx, 0x5c6810
call fcn.0045d3c0
cmp byte [0x5c784a], 0
je 0x4f1de8
cmp dword [0x5b4340], 1
jbe 0x4f1de8
mov dword [0x5abf3c], 4
cmp byte [0x5943f4], 0
jne 0x4f1ecb
cmp word [0x5b332a], 0
jne 0x4f1ecb
mov byte [ebp + 8], 0
push 0x800
push 0x5b332a
push dword [0x5ae2c8]
call fcn.004f7d70
push 0x800
push 0x558718
lea eax, [ebp - 0x1014]
push eax
push str.DefFolder
push 0x558bd4
call fcn.004d0210
cmp word [ebp - 0x1014], 0
jne 0x4f1e6a
cmp byte [0x5c784a], 0
je 0x4f1ea7
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.004575a0
cmp word [ebp - 0x1014], 0
je 0x4f1ea7
push 0x800
lea eax, [ebp - 0x1014]
push eax
call fcn.004a1860
push 0x800
push 0x5b332a
lea eax, [ebp - 0x1014]
push eax
call fcn.004bda80
push 0x800
lea eax, [ebp - 0x1014]
push eax
push 0x5b332a
call fcn.004bdae0
push dword [0x5ae2c8]
cmp word [0x5a5ee8], 0
setne al
movzx eax, al
push eax
push 0x800
push 0x5b332a
call fcn.004fbc90
cmp dword [0x5abf3c], 0
jne 0x4f1ede
mov dword [0x5abf3c], 2
mov dword [ebp - 0x1164], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 0
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 7
xor eax, eax
mov word [ebp - 0x1164], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], eax
mov dword [ebp - 4], 2
cmp byte [0x5943f4], al
je 0x4f20e7
mov esi, dword [0x5c3bd4]
test esi, esi
je 0x4f1fbf
cmp esi, 1
je 0x4f1fbf
cmp dword [0x5abf04], 3
je 0x4f1f75
push 0x65
call fcn.004b7300
mov esi, eax
push 0x1fd
call fcn.004b7300
push 0x30
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1150]
cmp ecx, 8
jb 0x4f24df
lea ecx, [ecx*2 + 2]
mov edx, dword [ebp - 0x1164]
mov eax, edx
cmp ecx, 0x1000
jb 0x4f24d5
add ecx, 0x23
mov edx, dword [eax - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f251a
jmp 0x4f24d5
push 0x800
push 0x5b332a
mov ecx, 0x5c3bd0
call fcn.004099c0
push 0x800
push 0x5a8f00
mov ecx, 0x5c3bd0
call fcn.0040a1e0
cmp word [0x5a8f00], 0
je 0x4f2000
push 0x800
push 0x5a8f00
call fcn.004a1860
mov byte [0x5abf89], 0
lea eax, [ebp - 0x1288]
push eax
mov ecx, 0x5c3bd0
call fcn.0040a200
mov eax, dword [ebp - 0x1120]
mov dword [0x5ae2c8], eax
mov dword [ebp - 0x12c0], 0
mov dword [ebp - 0x12bc], 0
mov dword [ebp - 0x12b8], 0
mov dword [ebp - 0x12b4], 0
mov dword [ebp - 0x12b0], 0
mov dword [ebp - 0x12ac], 0
push 0
lea eax, [ebp - 0x22d0]
push eax
push 0x5b332a
call fcn.004930c0
test al, al
je 0x4f2088
cmp dword [ebp - 0x12d0], 0x18
jne 0x4f2088
cmp dword [ebp - 0x12cc], 0
je 0x4f20a8
cmp dword [ebp - 0x1120], 0
jne 0x4f20a1
cmp byte [ebp - 0x1208], 0
mov byte [0x5abf74], 1
jne 0x4f20a8
mov byte [0x5abf74], 0
test esi, esi
jne 0x4f20b4
cmp dword [ebp - 0x1098], esi
je 0x4f20c0
movzx eax, byte [ebp - 0x1126]
mov dword [0x5abf2c], eax
cmp dword [ebp - 0x112c], 0
je 0x4f20df
push 0x800
push 0x5588cc
push 0x5a5ee8
call fcn.004bdae0
jmp 0x4f20e7
xor eax, eax
mov word [0x5a5ee8], ax
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb eax, eax
and eax, dword [0x5933dc]
push 0
push dword [ebp + 8]
push eax
call fcn.004f5060
test al, al
je 0x4f24b1
movzx eax, byte [0x5f53ef]
neg eax
sbb eax, eax
and eax, dword [0x5f53f0]
mov dword [0x5abf18], eax
mov eax, dword [0x5f53d4]
test eax, eax
je 0x4f2137
push eax
call fcn.004fc6c0
jmp 0x4f215b
cmp byte [0x5943f4], 0
je 0x4f215b
cmp dword [ebp - 0x112c], 0
je 0x4f215b
cmp word [0x5a5ee8], 0x2a
jne 0x4f215b
xor eax, eax
mov word [0x5a5ee8], ax
cmp dword [0x5b4340], 0
jne 0x4f218b
push 0x65
call fcn.004b7300
mov esi, eax
push 0x14b
call fcn.004b7300
push 0x30
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
jmp 0x4f24b1
cmp word [0x5a7eee], 0
je 0x4f2251
cmp dword [0x5a8ef0], 0
jne 0x4f2251
push 0x55ba0c
push 0x5a7eee
call fcn.004928f0
mov edi, eax
test edi, edi
je 0x4f2251
push edi
push 0x400
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0053c895
mov esi, eax
push edi
call fcn.005391cd
add esp, 0x14
mov dword [ebp - 0x22d4], 0x30c
cmp esi, 0x3ff
jae 0x4f2219
mov byte [ebp + esi - 0x414], 0
test esi, esi
jne 0x4f221d
lea eax, [ebp - 0x414]
push eax
call fcn.004bd320
cmp eax, 2
jne 0x4f2242
mov dword [0x5a8ef0], 4
jmp 0x4f2251
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x22d4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x4f21fc
mov dword [0x5a8ef0], 3
jmp 0x4f2251
cmp eax, 1
jne 0x4f2251
mov dword [0x5a8ef0], 2
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1070]
call fcn.004bdb30
mov byte [ebp - 4], 6
mov ecx, 0x5b432c
call fcn.004bde20
mov edi, edi
mov ecx, 0x5b432c
call fcn.004bdc30
mov esi, eax
test esi, esi
je 0x4f2371
push 0x800
lea eax, [ebp - 0x1014]
push eax
push esi
mov ecx, 0x5c6810
call fcn.0045dd10
cmp word [esi], 0x40
jne 0x4f22f6
lea eax, [ebp - 0x1014]
push eax
call fcn.00491350
test al, al
jne 0x4f22f6
push 0x800
lea eax, [ebp - 0x1014]
push eax
lea eax, [esi + 2]
push eax
mov ecx, 0x5c6810
call fcn.0045dd10
push 1
push 1
push 1
push dword [0x5a8ef4]
push 0
push 0
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.004929b0
test al, al
jne 0x4f2270
push 0x25
push esi
call fcn.005317e5
add esp, 8
test eax, eax
je 0x4f235a
push 0x25
add eax, 2
push eax
call fcn.005317e5
add esp, 8
test eax, eax
je 0x4f235a
lea eax, [ebp - 0x1014]
push eax
call fcn.00491350
test al, al
jne 0x4f235a
push 0x800
lea eax, [ebp - 0x2288]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x4f235a
push 0x800
lea eax, [ebp - 0x2288]
push eax
lea eax, [ebp - 0x1014]
push eax
call fcn.004bdae0
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1070]
call fcn.004bdbd0
jmp 0x4f2270
lea eax, [ebp - 0x1070]
push eax
mov ecx, 0x5b432c
call fcn.0040d5f0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1070]
call fcn.00407c90
mov dword [ebp - 4], 2
push 0x800
push 0x5b332a
push 0x5b332a
mov ecx, 0x5c6810
call fcn.0045dd10
mov al, byte [0x5b4504]
mov byte [0x5c640c], al
mov ecx, 0x5c63e0
call fcn.004d86a0
cmp byte [0x5b22f8], 0
je 0x4f23e5
call fcn.004f2c40
jmp 0x4f23f7
movzx eax, byte [0x5b12d3]
push eax
mov ecx, 0x5c3bd0
call fcn.00408370
cmp dword [0x5f53d4], 0
je 0x4f240a
push 0x5a7eee
call fcn.00490db0
cmp dword [0x5943f8], 1
je 0x4f24b1
cmp byte [0x5943f4], 0
je 0x4f2439
cmp byte [0x5b12f2], 0
jne 0x4f24b1
mov ecx, 0x5c6810
call fcn.00461830
jmp 0x4f24b1
cmp byte [0x5abf72], 0
je 0x4f244c
mov ecx, 0x595454
call fcn.004dec40
push 0x800
lea eax, [ebp - 0x1014]
push eax
mov ecx, 0x5c6810
call fcn.0045d220
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
jmp 0x4f2470
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f2470
sub ecx, edx
sar ecx, 1
push ecx
push 0x5b332a
lea eax, [ebp - 0x1014]
push eax
call fcn.004c1bf0
test eax, eax
jne 0x4f24a1
push 0x5b332a
call fcn.004a3770
jmp 0x4f24a6
mov eax, 0x558718
push eax
mov ecx, 0x5c6810
call fcn.00460c30
push dword [0x5f53d4]
call fcn.0053041c
add esp, 4
mov byte [0x5c640c], 0
mov ecx, 0x5c63e0
call fcn.004d86a0
jmp 0x4f1f75
push ecx
push edx
call fcn.0053000d
add esp, 8
mov dword [ebp - 0x1154], 0
mov dword [ebp - 0x1150], 7
xor eax, eax
mov word [ebp - 0x1164], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00530218
mov esp, ebp
pop ebp
ret 8
call fcn.005345df
int3