Function at 0x4355e0
Capabilities:
Check os version
Get common file path
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x46597f
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0x36c], eax
push ebx
push ebp
push esi
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0x384]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x394]
xor ebx, ebx
push 0x1fe
lea ecx, [esp + 0x182]
push ebx
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x188], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea edx, [esp + 0x180]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 3
push ebx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x398], ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x390], 1
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0x48]
mov byte [esp + 0x38c], bl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp byte [esi], bl
je 0x4356e2
push str.WindowsSystem32_
lea ecx, [esp + 0x30]
call dword [0x46831c]
mov esi, dword [esi + 4]
sub esi, ebx
je 0x4356db
sub esi, 1
je 0x4356d4
sub esi, 1
jne 0x435740
push str.AnBakConfig.dat
jmp 0x435736
push str.PaBakConfig.dat
jmp 0x435736
push str.AbBakConfig.dat
jmp 0x435736
lea edx, [esp + 0x64]
push edx
mov dword [esp + 0x68], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x68], 6
lea ecx, [esp + 0x2c]
jb 0x435707
push str.ProgramDataAomei_
jmp 0x43570c
push str.Documents_and_SettingsAll_UsersApplication_DataAomei_
call dword [0x46831c]
mov esi, dword [esi + 4]
sub esi, ebx
je 0x435731
sub esi, 1
je 0x43572a
sub esi, 1
jne 0x435740
push str.AnConfig.dat
jmp 0x435736
push str.PaConfig.dat
jmp 0x435736
push str.AbConfig.dat
lea ecx, [esp + 0x30]
call dword [0x46831c]
push ebx
push 0x80
push 3
push ebx
push 1
push bind
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x4357db
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea esi, [esp + 0x48]
mov byte [esp + 0x38c], 2
call fcn.00432630
mov eax, esi
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
push str.Config.dat
lea ecx, [esp + 0x30]
call dword [0x46831c]
push ebx
push 0x80
push 4
push ebx
push 1
push 0xc0000000
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call ebp
lea ecx, [esp + 0x48]
mov esi, eax
mov byte [esp + 0x38c], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp esi, 0xffffffff
je 0x435929
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x435922
mov ecx, dword [edi]
mov eax, 0x4ec4ec4f
mul dword [esp + 0x14]
shr edx, 5
imul edx, edx, 0x68
cmp ecx, edx
jb 0x435911
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x435911
mov eax, 0x4ec4ec4f
mul dword [esp + 0x14]
shr edx, 5
imul edx, edx, 0x68
mov dword [edi], edx
mov dword [esp + 0x1c], vtable.MemoryControl.0
mov dword [esp + 0x20], ebx
push edx
lea ecx, [esp + 0x20]
call fcn.00436500
xor ecx, ecx
push ecx
push ecx
mov ebx, eax
push ecx
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x435875
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [esp + 0x1c]
call fcn.004364e0
jmp 0x435929
mov ecx, dword [edi]
push 0
lea eax, [esp + 0x2c]
push eax
push ecx
push ebx
push esi
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
je 0x435861
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x4ec4ec4f
mul dword [edi]
xor esi, esi
shr edx, 5
je 0x4358ca
mov ebp, ebx
lea ebx, [ebx]
push ebp
call fcn.00433510
mov eax, 0x4ec4ec4f
mul dword [edi]
add esi, 1
shr edx, 5
add ebp, 0x68
cmp esi, edx
jb 0x4358b0
mov edx, dword [edi]
mov esi, dword [esp + 0x10]
push edx
push 0
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [edi]
push eax
push ebx
push esi
call sub.MSVCR80.dll_memcpy
mov eax, dword [esp + 0x38]
add esp, 0x18
test eax, eax
je 0x4358f8
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x38c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
jmp 0x435940
mov eax, 0x4ec4ec4f
mul dword [esp + 0x14]
shr edx, 5
imul edx, edx, 0x68
mov dword [edi], edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x38c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x384]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x36c]
xor ecx, esp
call fcn.0043ad38
add esp, 0x380
ret 4