Function at 0x4bc860
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x988
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
lea esi, [ebp - 0x984]
lea edi, [ebp - 0x978]
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x978], ebx
mov dword [ebp - 0x984], ebx
call fcn.004bce50
xor ecx, ecx
test eax, eax
je 0x4bc8cb
push str.OS_and_IE_Version_all_not_Support_GCB___Process_exit.
push 0x54a0bc
xor edx, edx
call fcn.004a3a40
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push 0xfe
lea edx, [ebp - 0x462]
push ebx
push edx
mov word [ebp - 0x464], cx
call fcn.004e8ba0
add esp, 0xc
push 0xfe
lea ecx, [ebp - 0x562]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x564], ax
call fcn.004e8ba0
add esp, 0xc
push 0xfe
lea eax, [ebp - 0x362]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x364], dx
call fcn.004e8ba0
add esp, 0xc
lea ecx, [ebp - 0x364]
push ecx
lea edx, [ebp - 0x564]
push edx
lea ebx, [ebp - 0x464]
call fcn.004bcf30
add esp, 8
test eax, eax
jne 0x4bc959
push str.Get_UserName_and_UserDomain_and_HostName_Fail.
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
xor eax, eax
lea ecx, [ebp - 0x974]
push ecx
mov word [ebp - 0x974], ax
mov dword [ebp - 0x972], eax
mov dword [ebp - 0x96e], eax
mov dword [ebp - 0x96a], eax
mov word [ebp - 0x966], ax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0x962]
push eax
mov word [ebp - 0x964], dx
call fcn.004e8ba0
movzx eax, word [ebp - 0x968]
add esp, 0xc
lea ecx, [ebp - 0x464]
push ecx
movzx ecx, word [ebp - 0x96a]
lea edx, [ebp - 0x364]
push edx
movzx edx, word [ebp - 0x96c]
push eax
movzx eax, word [ebp - 0x96e]
push ecx
movzx ecx, word [ebp - 0x972]
push edx
movzx edx, word [ebp - 0x974]
push eax
push ecx
push edx
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x964]
push str._Alert__r_nType555_r_nPCName_s_r_nTime_04u__02u__02u__02u:_02u:_02u_r_nUser_s_s_r_nLanguage1028_r_n_CCE__r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp - 0x97c]
lea eax, [ebp - 0x964]
mov edx, esi
mov ecx, eax
add esp, 0x2c
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4bca12
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x262]
push eax
mov dword [0x56d800], esi
mov word [ebp - 0x264], dx
call fcn.004e8ba0
mov eax, dword [ebp - 0x978]
mov ecx, 0xa
mov esi, str.C:Temp_auditpol.tmp
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
cmp eax, 2
je 0x4bca6a
cmp eax, 3
jne 0x4bcc6c
lea ebx, [ebp - 0x34]
call fcn.004bd100
test eax, eax
jne 0x4bca80
push str.Auditpol_Output_Failed_
jmp 0x4bcc5b
lea ecx, [ebp - 0x34]
push 0
push ecx
call fcn.004e6be2
add esp, 8
test eax, eax
jne 0x4bcc6c
push eax
push 0x80
push 3
push eax
push 1
push bind
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x988], edi
cmp edi, 0xffffffff
je 0x4bcc56
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4bcc4d
lea eax, [esi + 0x40]
push eax
mov dword [ebp - 0x97c], eax
call fcn.004e5420
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4bcc37
mov eax, dword [ebp - 0x97c]
push eax
push 0
push ebx
call fcn.004e8ba0
add esp, 0xc
push 0
lea ecx, [ebp - 0x980]
push ecx
push esi
push ebx
push edi
mov dword [ebp - 0x980], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x980]
push eax
cmp eax, esi
je 0x4bcb48
lea edx, [ebp - 0x264]
push str.Dispatch__Read_Audit_Temp_File___Read_Size__i_Byte__Error___
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
jmp 0x4bcb64
lea ecx, [ebp - 0x264]
push str.Dispatch__Read_Audit_Temp_File___Read_Size__i_Byte_.
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x264]
push edx
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
mov edi, 0x557148
lea ebx, [ebx]
mov eax, dword [edi]
push 5
push str.Win81
push eax
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bcb9f
cmp dword [ebp - 0x978], 2
je 0x4bcbbe
mov ecx, dword [edi]
push 0xc
push str.Server2008R2
push ecx
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bcbfe
cmp dword [ebp - 0x978], 3
jne 0x4bcbfe
push esi
mov ecx, ebx
call fcn.004bd4d0
add esp, 4
test eax, eax
jne 0x4bcbfe
mov edx, dword [edi + 4]
push edx
lea eax, [ebp - 0x264]
push str.__s__Dispatch__Audit__AuditAnalysis_Exception_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x264]
push ecx
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
add edi, 0xc
cmp edi, 0x5574a8
jl 0x4bcb80
mov edx, dword [ebp - 0x97c]
push edx
push 0
push ebx
call fcn.004e8ba0
add esp, 0xc
push ebx
call fcn.004e577a
mov edi, dword [ebp - 0x988]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bcc6c
push str.Dispatch__Open_Audit_Temp_File___malloc_memory_Fail__
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bcc6c
push str.Dispatch__Open_Audit_Temp_File_Fail__
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
mov ecx, 9
mov esi, str.C:Temp_secpol.tmp
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsw word es:[edi], word [esi]
xor ebx, ebx
call fcn.004bd240
test eax, eax
jne 0x4bcca3
push str.Secedit_Output_Failed_
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
jmp 0x4bcca8
mov ebx, 1
mov esi, 0x556670
lea ecx, [ecx]
mov eax, dword [esi]
push 4
push str.Win7
push eax
call fcn.004e6cdf
mov edi, dword [ebp - 0x978]
add esp, 0xc
test eax, eax
jne 0x4bccd1
cmp edi, 1
je 0x4bcd07
mov ecx, dword [esi]
push 5
push str.Win81
push ecx
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bccec
cmp edi, 2
je 0x4bcd07
mov edx, dword [esi]
push 0xc
push str.Server2008R2
push edx
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bcd48
cmp edi, 3
jne 0x4bcd48
push ebx
lea edi, [ebp - 0x5c]
call fcn.004bd790
add esp, 4
test eax, eax
jne 0x4bcd48
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x264]
push str.__s__Dispatch__Secedit__MemberAnalysis_Exception_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x264]
push edx
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
add esi, 0x10
cmp esi, 0x557140
jl 0x4bccb0
mov ebx, dword [ebp - 0x984]
mov esi, 0x5574a8
mov eax, dword [esi]
push 4
push str.Win7
push eax
call fcn.004e6cdf
mov edi, dword [ebp - 0x978]
add esp, 0xc
test eax, eax
jne 0x4bcd83
cmp edi, 1
je 0x4bcdef
mov ecx, dword [esi]
push 5
push str.Win81
push ecx
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bcd9e
cmp edi, 2
je 0x4bcdef
mov edx, dword [esi]
push 0xc
push str.Server2008R2
push edx
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bcdb9
cmp edi, 3
je 0x4bcdef
mov eax, dword [esi]
push 3
push 0x531970
push eax
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bcdd4
cmp ebx, 8
je 0x4bcdef
mov ecx, dword [esi]
push 4
push str.IE11
push ecx
call fcn.004e6cdf
add esp, 0xc
test eax, eax
jne 0x4bce29
cmp ebx, 0xb
jne 0x4bce29
call fcn.004bd890
test eax, eax
jne 0x4bce29
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x264]
push str.__s__Dispatch__Reg__GetRegValue_Exception_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x264]
push ecx
push 0x54a0bc
xor edx, edx
xor ecx, ecx
call fcn.004a3a40
add esp, 8
add esi, 0x30
cmp esi, 0x562758
jl 0x4bcd62
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret