Function at 0x4a4541
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, edx
push 0x400
push eax
mov dword [ebp - 0x828], eax
mov ebx, eax
mov dword [ebp - 0x82c], eax
mov edi, ecx
lea eax, [ebp - 0x404]
mov dword [ebp - 0x830], esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
and dword [esi], eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edx, eax
lea ecx, [ebp - 0x828]
call fcn.004c6584
test eax, eax
jne 0x4a45be
mov eax, 0x8007000e
push eax
push 0x438013e
mov esi, eax
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a4aa8
push 0x42045c
push dword [ebp - 0x828]
call dword [sym.imp.msvcrt.dll_fopen]
mov dword [ebp - 0x824], eax
pop ecx
pop ecx
test eax, eax
jne 0x4a4603
push edi
mov esi, 0x80070002
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edi, edi
inc edi
cmp eax, 0xffffffff
je 0x4a45f1
mov esi, edi
push edi
push esi
push 0x447013e
call dword [sym.imp.certcli.dll_Ordinal_358]
jmp 0x4a4aa8
push eax
xor edi, edi
lea eax, [ebp - 0x404]
push 0x400
inc edi
push eax
mov esi, edi
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x4a462e
push edi
push edi
push 0x44c013e
jmp 0x4a4a76
lea eax, [ebp - 0x404]
push 0x5b
push eax
call dword [sym.imp.msvcrt.dll_strchr]
mov dword [ebp - 0x818], eax
pop ecx
pop ecx
test eax, eax
je 0x4a4a6f
push 0x420460
push eax
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4a4a6f
push 0x5d
push dword [ebp - 0x818]
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x4a4a6f
mov esi, 0x104
lea eax, [ebp - 0x60c]
push esi
push eax
push 0x420470
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x4a46ae
push esi
lea eax, [ebp - 0x60c]
push eax
push 0x42047c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4a46b2
cmp eax, esi
jb 0x4a46fc
call fcn.004c73cc
push eax
push 0x45e013e
call dword [sym.imp.certcli.dll_Ordinal_357]
lea ecx, [ebp - 0x60c]
mov edx, 0x41d77c
mov eax, ecx
sub edx, eax
lea eax, [esi + 0x7ffffefa]
test eax, eax
je 0x4a46f7
movzx eax, word [edx + ecx]
test ax, ax
je 0x4a46f0
mov word [ecx], ax
add ecx, 2
sub esi, 1
jne 0x4a46d2
test esi, esi
jne 0x4a46f7
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x814]
push eax
push 0
push 0x420484
lea eax, [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4a4733
call fcn.004c73cc
mov esi, eax
push esi
push 0x468013e
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a4a7c
push 0xffffffffffffffff
lea eax, [ebp - 0x814]
mov dword [ebp - 0x81c], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edx, eax
lea ecx, [ebp - 0x82c]
call fcn.004c6584
test eax, eax
jne 0x4a4771
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x46f013e
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a4a7e
push 0x42048c
push dword [ebp - 0x82c]
call dword [sym.imp.msvcrt.dll_fopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4a4797
mov esi, 0x80070002
push esi
push 0x475013e
jmp 0x4a4766
push ebx
push 0x420490
call dword [sym.imp.msvcrt.dll_fputs]
mov esi, dword [ebp - 0x824]
push 0
push 0
push esi
call dword [sym.imp.msvcrt.dll_fseek]
add esp, 0x14
test eax, eax
je 0x4a47c8
mov esi, 0x80070026
push esi
push 0x47c013e
jmp 0x4a4766
push esi
lea eax, [ebp - 0x404]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0xc
jmp 0x4a4a08
lea eax, [ebp - 0x404]
push 0xa
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x4a4a33
and dword [ebp - 0x820], 0
mov byte [eax], 0
lea eax, [ebp - 0x404]
cmp byte [ebp - 0x404], 0x20
mov edi, eax
mov dword [ebp - 0x818], eax
jne 0x4a4823
inc edi
cmp byte [edi], 0x20
je 0x4a481d
lea eax, [ebp - 0x404]
push 0x3d
push eax
call dword [sym.imp.msvcrt.dll_strchr]
cmp byte [edi], 0x3b
pop ecx
pop ecx
je 0x4a49b4
test eax, eax
je 0x4a49b4
lea esi, [eax + 1]
jmp 0x4a4850
dec eax
cmp byte [eax], 0x20
jne 0x4a485d
lea ecx, [ebp - 0x404]
mov byte [eax], 0
cmp ecx, eax
jb 0x4a484a
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x818], ecx
test eax, eax
je 0x4a4887
push ebx
push 0x4204b8
call dword [sym.imp.msvcrt.dll_fputs]
pop ecx
pop ecx
push ebx
push edi
call dword [sym.imp.msvcrt.dll_fputs]
cmp dword [ebp - 0x818], 0
pop ecx
pop ecx
je 0x4a48a8
push ebx
push 0x4204b8
call dword [sym.imp.msvcrt.dll_fputs]
pop ecx
pop ecx
push ebx
push 0x4204bc
call dword [sym.imp.msvcrt.dll_fputs]
pop ecx
pop ecx
jmp 0x4a48b9
inc esi
cmp byte [esi], 0x20
je 0x4a48b8
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4a48c3
sub ecx, edx
lea eax, [ecx + esi]
jmp 0x4a48da
dec eax
cmp byte [eax], 0x20
jne 0x4a48de
mov byte [eax], 0
cmp esi, eax
jb 0x4a48d1
push 0x41c730
push esi
call dword [sym.imp.msvcrt.dll_strcspn]
pop ecx
pop ecx
xor ecx, ecx
mov al, byte [eax + esi]
test al, al
setne cl
mov dword [ebp - 0x818], ecx
mov edi, ecx
mov ecx, esi
test al, al
je 0x4a49c4
push ebx
push 0x4204b8
call dword [sym.imp.msvcrt.dll_fputs]
push 0x2c
push esi
call dword [sym.imp.msvcrt.dll_strchr]
mov edi, eax
add esp, 0x10
mov eax, dword [ebp - 0x818]
mov ecx, esi
mov dword [ebp - 0x820], eax
test edi, edi
je 0x4a49c2
push 0x3d
push edi
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x818], esi
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
jne 0x4a49a6
lea eax, [edi + 1]
cmp byte [eax], 0x20
mov dword [ebp - 0x818], eax
jne 0x4a4975
inc eax
cmp byte [eax], 0x20
je 0x4a4961
mov dword [ebp - 0x818], eax
jmp 0x4a4975
dec edi
cmp byte [edi], 0x20
jne 0x4a497c
mov byte [edi], 0
cmp esi, edi
jb 0x4a496f
push ebx
push esi
call dword [sym.imp.msvcrt.dll_fputs]
push ebx
push 0x4204b8
call dword [sym.imp.msvcrt.dll_fputs]
push ebx
push 0x4204c0
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 0x18
and dword [ebp - 0x820], 0
mov ecx, dword [ebp - 0x818]
mov edi, dword [ebp - 0x820]
jmp 0x4a49c4
mov ecx, dword [ebp - 0x818]
mov edi, dword [ebp - 0x820]
jmp 0x4a49ca
mov edi, eax
mov esi, dword [ebp - 0x824]
push ebx
push ecx
call dword [sym.imp.msvcrt.dll_fputs]
pop ecx
pop ecx
test edi, edi
je 0x4a49e6
push ebx
push 0x4204b8
call dword [sym.imp.msvcrt.dll_fputs]
pop ecx
pop ecx
push ebx
push 0x4204c4
call dword [sym.imp.msvcrt.dll_fputs]
push esi
lea eax, [ebp - 0x404]
push 0x400
push eax
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0x14
test eax, eax
jne 0x4a47e3
push ebx
call dword [sym.imp.msvcrt.dll_fflush]
push ebx
call dword [sym.imp.msvcrt.dll_ferror]
pop ecx
pop ecx
test eax, eax
je 0x4a4a4c
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x4da013e
jmp 0x4a4a3e
mov esi, 0x8007000d
push esi
push 0x489013e
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [ebp - 0x81c]
jmp 0x4a4a7e
mov edx, dword [ebp - 0x830]
lea ecx, [ebp - 0x814]
call fcn.004c723f
mov esi, eax
test esi, esi
je 0x4a4a6b
push esi
push 0x4de013e
jmp 0x4a4a3e
xor edi, edi
jmp 0x4a4a7e
push edi
push edi
push 0x453013e
call dword [sym.imp.certcli.dll_Ordinal_358]
mov edi, ebx
push dword [ebp - 0x824]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
test ebx, ebx
je 0x4a4a97
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
test edi, edi
je 0x4a4aa8
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x828], 0
je 0x4a4abd
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x82c]
test eax, eax
je 0x4a4ace
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret