Function at 0x4b8ee0
Capabilities:
Read file on windows
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x448
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x444], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 1
push dword [0x4ebb90]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push dword [0x4ebb90]
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
test eax, eax
je 0x4b9230
test byte [esp + 0x1c], 1
je 0x4b9230
lea eax, [esp + 0xc]
push eax
push 0
push dword [0x4ebb90]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
je 0x4b8f11
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4b8f11
push 0x400
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], 0
xorps xmm0, xmm0
push 0
push eax
movaps xmmword [esp + 0x2c], xmm0
call fcn.004c0cc0
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0
push esi
lea eax, [esp + 0x54]
push eax
push dword [0x4ebb90]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 1
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
push dword [0x4ebb90]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4b8f11
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
cmp ecx, edi
jne 0x4b8f11
cmp byte [esp + 0x48], 0x6a
jne 0x4b8f11
cmp byte [esp + 0x49], 1
jne 0x4b8f11
movzx eax, byte [esp + 0x4a]
add ecx, 0xfffffffc
cmp ecx, eax
jne 0x4b8f11
mov al, byte [esp + 0x4b]
cmp al, 2
je 0x4b9009
cmp al, 3
je 0x4b9009
cmp al, 4
je 0x4b9009
cmp al, 5
jne 0x4b8f11
lea esi, [edi - 1]
mov dword [esp + 0x18], 0
xor ecx, ecx
xor edx, edx
test esi, esi
je 0x4b9034
nop dword [eax]
movzx eax, byte [esp + ecx + 0x48]
inc ecx
add edx, eax
cmp ecx, esi
jb 0x4b9020
mov al, byte [esp + 0x4b]
mov dword [esp + 0x18], edx
cmp byte [esp + edi + 0x47], dl
jne 0x4b8f11
movzx eax, al
sub eax, 2
je 0x4b9196
sub eax, 1
je 0x4b911c
sub eax, 1
jne 0x4b8f11
cmp byte [0x4ede54], al
je 0x4b90aa
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push str.eg5u
push str.32770
push eax
push eax
mov byte [0x4ede54], al
call edi
test eax, eax
jne 0x4b909d
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.eg5u
push str.32770
push 0
push 0
call edi
test eax, eax
je 0x4b9081
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [esp + 8]
push 0x4e6ff0
push 0xc8
mov eax, dword [esi + 0x38]
add eax, 0xc
push eax
call fcn.004b5c10
mov ecx, dword [esi + 0x38]
add esp, 0xc
mov edx, dword [ecx + 8]
call fcn.004bd780
mov eax, dword [esi + 0x40]
push 0x4e6efc
add eax, 8
push 0xc8
push eax
call fcn.004b5c10
mov ecx, dword [esi + 0x40]
add esp, 0xc
call fcn.004be760
mov eax, dword [esi + 0x44]
push 0x4e7004
add eax, 0xc
push 0xc8
push eax
call fcn.004b5c10
mov ecx, dword [esi + 0x44]
add esp, 0xc
mov edx, dword [ecx + 8]
call fcn.004bd780
jmp 0x4b8f11
lea eax, [edi - 5]
xor esi, esi
test eax, eax
je 0x4b915b
mov edi, 0x4ee248
nop word [eax + eax]
movzx eax, byte [esp + esi + 0x4c]
push eax
mov eax, 0x64
push 0x4e7170
sub eax, esi
push eax
push edi
call fcn.004b5c10
mov eax, dword [esp + 0x20]
inc esi
add eax, 0xfffffffb
add esp, 0x10
add edi, 2
cmp esi, eax
jb 0x4b9130
mov eax, 0x64
sub eax, esi
push 0x4e7194
push eax
lea eax, [esi*2 + 0x4ee248]
push eax
call fcn.004b5c10
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x4ee248
push 2
push 0x8000
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4b8f11
cmp byte [0x4ede54], 0
jne 0x4b8f11
lea eax, [edi - 5]
mov byte [0x4ede54], 1
xor esi, esi
test eax, eax
je 0x4b91e5
movzx eax, byte [esp + esi + 0x4c]
push eax
mov eax, dword [esp + 0xc]
push 0x4e7170
push 0xc8
mov eax, dword [eax + 0x40]
lea eax, [eax + esi*2]
add eax, 8
push eax
call fcn.004b5c10
mov edi, dword [esp + 0x20]
inc esi
add esp, 0x10
lea eax, [edi - 5]
cmp esi, eax
jb 0x4b91b3
mov esi, dword [esp + 8]
xor ecx, ecx
mov eax, dword [esi + 0x40]
mov word [eax + edi*2 - 2], cx
mov ecx, dword [esi + 0x40]
call fcn.004be760
mov eax, dword [esi + 0x40]
add eax, 8
push eax
push str._ls
push 0x64
push 0x4ee248
call fcn.004b5c10
add esp, 0x10
push 0x4ee248
push 1
push 0x8000
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4b8f11
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4b8f11