Function at 0x4d14d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59560d
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x44], ebx
cmp dword [esi + 0x14], 8
jb 0x4d150e
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], 0
cmp edi, 0xffffffff
jne 0x4d15a2
push 1
call fcn.004dec10
add esp, 4
test eax, eax
je 0x4d1574
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x54], eax
jb 0x4d1554
mov esi, dword [esi]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x58], esi
push eax
lea eax, [ebp - 0x58]
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
push eax
push ecx
push 0x24
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
call fcn.004d1a60
add esp, 0x14
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425810
push 0xffffffffffffffff
jmp 0x4d19c8
push 0x400
call fcn.00554273
mov esi, eax
mov dword [ebp - 0x4c], esi
push 0x400
push 0
push esi
mov byte [ebp - 4], 1
call fcn.00556260
add esp, 0x10
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push 0
push eax
push 0x3ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d1651
push 5
call fcn.004dec10
add esp, 4
test eax, eax
je 0x4d161c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x58], eax
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
lea eax, [ebp - 0x58]
mov ecx, 5
push eax
push str.failed_to_read_the_file:__d
push 0x2e
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
call fcn.00428b00
add esp, 0x10
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425810
push esi
call fcn.004697f0
add esp, 4
jmp 0x4d19c3
mov ecx, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d1670
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00425b80
mov byte [ebp - 4], 2
push esi
mov dword [ebp - 0x4c], 0
call fcn.004697f0
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x40]
add esp, 4
cmp dword [ebp - 0x2c], 0x10
cmovae ecx, dword [ebp - 0x40]
setae byte [ebp - 0x4d]
mov dword [ebp - 0x5c], ecx
cmp eax, 0xd
jb 0x4d1741
add eax, 0xfffffff4
add eax, ecx
mov dword [ebp - 0x58], eax
sub eax, ecx
push eax
push 0x24
push ecx
call fcn.00557360
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
je 0x4d1741
mov ecx, eax
mov edx, str._FileVersion
mov esi, 9
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4d16f1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4d16e0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4d1718
cmp esi, 0xfffffffd
je 0x4d1714
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4d1718
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4d1718
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4d1718
xor eax, eax
jmp 0x4d171d
sbb eax, eax
or eax, 1
mov ecx, dword [ebp - 0x54]
test eax, eax
je 0x4d17cb
mov eax, dword [ebp - 0x58]
inc ecx
sub eax, ecx
push eax
push 0x24
push ecx
call fcn.00557360
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x4d16d2
push 5
call fcn.004dec10
add esp, 4
test eax, eax
je 0x4d176d
push str.failed_to_find_file_version_key
push 0x39
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
mov ecx, 5
call fcn.00428b40
add esp, 0xc
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425810
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4d19b1
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d19a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1a46
jmp 0x4d19a7
sub ecx, dword [ebp - 0x5c]
cmp ecx, 0xffffffff
je 0x4d1741
mov eax, dword [ebp - 0x30]
lea edx, [ecx + 0xd]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, edx
jb 0x4d1a4b
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp byte [ebp - 0x4d], 0
lea eax, [ebp - 0x40]
cmovne eax, dword [ebp - 0x40]
push ecx
add eax, edx
lea ecx, [ebp - 0x28]
push eax
call fcn.00425b80
mov byte [ebp - 4], 3
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x18]
cmovae esi, dword [ebp - 0x28]
setae byte [ebp - 0x4d]
test eax, eax
je 0x4d19ee
push eax
push 0x20
push esi
call fcn.00557360
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4d19ee
sub ecx, esi
cmp ecx, 0xffffffff
je 0x4d19ee
cmp dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x74], 0
cmovb ecx, dword [ebp - 0x18]
cmp byte [ebp - 0x4d], 0
push ecx
cmovne eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x74]
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
call fcn.00425b80
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x28]
call fcn.00462ef0
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x4d18d0
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d18c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1a46
push edx
push ecx
call fcn.00554242
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
jb 0x4d18e3
mov ecx, dword [ebp - 0x28]
add esi, ecx
jmp 0x4d18e8
add esi, ecx
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x54], ecx
push eax
mov ecx, ebx
call fcn.00437700
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x54], esi
je 0x4d1937
mov edi, dword [ebp - 0x54]
nop
movsx ax, byte [edi]
mov ecx, ebx
movzx eax, ax
push eax
call fcn.0043a670
inc edi
cmp edi, esi
jne 0x4d1920
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4d196b
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1961
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1a46
push edx
push ecx
call fcn.00554242
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x4d19b1
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d19a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1a46
push edx
push ecx
call fcn.00554242
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
test edi, edi
je 0x4d19ce
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret 0xc
push 5
call fcn.004dec10
add esp, 4
test eax, eax
je 0x4d1a1a
push str.failed_to_find_the_end_of_the_file_version
push 0x41
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
mov ecx, 5
call fcn.00428b40
add esp, 0xc
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425810
jmp 0x4d1937
call fcn.0055ec17
call fcn.00426d30
int3