Function at 0x44e43a
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push 0x220
mov eax, 0x5b5823
call fcn.00598f94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor ebx, ebx
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x44e68d
push str.system32driversetchosts
lea eax, [ebp - 0x218]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x224], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44e68d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
je 0x44e523
cmp esi, 0x8000
jae 0x44e523
lea eax, [esi + 1]
push eax
call fcn.0058e040
pop ecx
mov dword [ebp - 0x21c], eax
cmp eax, ebx
je 0x44e523
push ebx
lea ecx, [ebp - 0x224]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44e523
cmp esi, dword [ebp - 0x224]
jne 0x44e523
mov eax, dword [ebp - 0x21c]
mov byte [esi + eax], bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x21c]
cmp edi, ebx
je 0x44e68d
cmp esi, dword [ebp - 0x224]
jne 0x44e681
jmp 0x44e679
mov al, byte [edi]
cmp al, 0x20
je 0x44e55b
cmp al, 9
je 0x44e55b
cmp al, 0xd
je 0x44e55b
cmp al, 0xa
jne 0x44e55e
inc edi
jmp 0x44e549
cmp al, bl
je 0x44e681
cmp al, 0x23
je 0x44e65b
cmp al, 0x2f
je 0x44e65b
mov esi, edi
cmp al, 0x20
je 0x44e587
cmp al, 9
je 0x44e587
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x44e578
cmp byte [esi], bl
je 0x44e681
mov eax, esi
sub eax, edi
push eax
push edi
lea eax, [ebp - 0x228]
push eax
call fcn.00451324
mov dword [ebp - 4], ebx
mov edi, esi
mov al, byte [edi]
cmp al, 0x20
je 0x44e5b0
cmp al, 9
jne 0x44e5b3
inc edi
jmp 0x44e5a6
mov esi, edi
jmp 0x44e5d2
cmp al, 0x20
je 0x44e5d6
cmp al, 9
je 0x44e5d6
cmp al, 0xd
je 0x44e5d6
cmp al, 0xa
je 0x44e5d6
cmp al, 0x23
je 0x44e5d6
cmp al, 0x2f
je 0x44e5d6
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x44e5b7
mov eax, esi
sub eax, edi
push eax
push edi
lea eax, [ebp - 0x220]
push eax
call fcn.00451324
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
cmp dword [eax - 0xc], ebx
je 0x44e61a
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x22c]
add eax, 0x48
push eax
call fcn.004514ba
mov edi, eax
lea eax, [ebp - 0x228]
call fcn.0040a3cc
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
mov edi, esi
call fcn.00407b6b
mov al, byte [esi]
cmp al, bl
je 0x44e647
cmp al, 0xd
je 0x44e647
cmp al, 0xa
je 0x44e647
cmp al, 0x23
je 0x44e647
cmp al, 0x2f
jne 0x44e5a6
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44e679
push 0xd
push edi
call fcn.00590e90
pop ecx
pop ecx
cmp eax, ebx
jne 0x44e677
push 0xa
push edi
call fcn.00590e90
pop ecx
pop ecx
cmp eax, ebx
je 0x44e681
mov edi, eax
cmp byte [edi], bl
jne 0x44e549
push dword [ebp - 0x21c]
call fcn.0058f807
pop ecx
call fcn.00599017
ret 4