Function at 0x4bf22e
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed4e0
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffff9a4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x458], 0
mov byte [ebp - 0x344], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x343]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x664], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x663]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x124], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x560], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x55f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x454], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x453]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x350], 0
mov byte [ebp - 0x23c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x23b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x348], 0
call fcn.004bf918
mov dword [ebp - 0x34c], eax
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x344]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4bf38c
mov dword [ebp - 0x12c], 0x30000401
jmp 0x4bf872
cmp dword [ebp - 0x34c], 2
jb 0x4bf3e7
push 1
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x23c]
push edx
push str.d_LclI__cLb_LclLh_4cz2K__I.
call fcn.004cc2c9
cmp eax, 1
je 0x4bf3c3
mov dword [ebp - 0x12c], 0x30000407
jmp 0x4bf872
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push 0x104
lea edx, [ebp - 0x124]
push edx
call fcn.004c5960
add esp, 0x10
jmp 0x4bf45c
push 0x104
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4bf40c
mov dword [ebp - 0x12c], 0x30000401
jmp 0x4bf872
push 1
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x23c]
push edx
push str.d_Lcl:Ha4sE
call fcn.004cc2c9
cmp eax, 1
je 0x4bf43a
mov dword [ebp - 0x12c], 0x30000407
jmp 0x4bf872
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push 0x104
lea edx, [ebp - 0x124]
push edx
call fcn.004c5960
add esp, 0x10
cmp dword [ebp - 0x34c], 3
jne 0x4bf47e
call fcn.004bef7f
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x4bf47e
jmp 0x4bf872
push 1
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push str.D_E_LS9__h8__..
call fcn.004cc2c9
cmp eax, 1
je 0x4bf4ac
mov dword [ebp - 0x12c], 0x30000407
jmp 0x4bf872
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x344]
push eax
push 0x5092e4
push 0x104
lea ecx, [ebp - 0x560]
push ecx
call fcn.004c5960
add esp, 0x14
lea edx, [ebp - 0x560]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jne 0x4bf4fe
mov dword [ebp - 0x12c], 0x3000040a
jmp 0x4bf872
push 1
lea eax, [ebp - 0x348]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push str.cS____
call fcn.004cc2c9
cmp eax, 1
je 0x4bf52c
mov dword [ebp - 0x12c], 0x30000407
jmp 0x4bf872
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51068c], eax
cmp dword [0x51068c], 0
jne 0x4bf55d
mov dword [ebp - 0x12c], 0x30000408
jmp 0x4bf872
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0xffffffff
jne 0x4bf59a
mov dword [ebp - 0x12c], 0x30000402
jmp 0x4bf872
push 0
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4bf5c1
mov dword [ebp - 0x12c], 0x30000403
jmp 0x4bf872
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
call fcn.0048ab32
add esp, 4
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x4bf5ee
mov dword [ebp - 0x12c], 0x30000404
jmp 0x4bf872
mov ecx, dword [ebp - 0x20]
add ecx, 1
push ecx
call fcn.0048ab32
add esp, 4
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x4bf61b
mov dword [ebp - 0x12c], 0x30000404
jmp 0x4bf872
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x4bf64d
mov dword [ebp - 0x12c], 0x30000405
jmp 0x4bf872
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
jne 0x4bf65b
cmp dword [ebp - 0x1c], 7
jae 0x4bf66a
mov dword [ebp - 0x12c], 0x30000405
jmp 0x4bf872
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x350], ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call fcn.00485c00
add esp, 0xc
mov edx, dword [ebp - 0x350]
add edx, dword [ebp - 0x20]
mov byte [edx], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x45c]
cmp eax, dword [ebp - 0x240]
je 0x4bf872
mov ecx, dword [ebp - 0x45c]
add ecx, 0x130
push ecx
push 0x104
lea edx, [ebp - 0x454]
push edx
call fcn.0047fb40
push 0x2f
lea eax, [ebp - 0x454]
push eax
call fcn.0048a030
add esp, 8
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
je 0x4bf70a
mov ecx, dword [ebp - 0x668]
mov byte [ecx], 0
lea edx, [ebp - 0x454]
push edx
call dword [0x51068c]
cmp eax, 0xffffffff
je 0x4bf72d
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x45c], ecx
jmp 0x4bf6b1
cmp dword [ebp - 0x34c], 3
jb 0x4bf73f
cmp dword [0x510680], 0
jne 0x4bf777
push 0
lea edx, [ebp - 0x454]
push edx
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
mov ecx, dword [ebp - 0x350]
push ecx
call fcn.004bf9bc
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x300000d0
jne 0x4bf772
jmp 0x4bf872
jmp 0x4bf844
mov dword [ebp - 0x66c], 0
push 0
lea edx, [ebp - 0x66c]
push edx
push 0
push 0x148
push 1
lea eax, [ebp - 0x454]
push eax
call dword [0x510680]
test eax, eax
jne 0x4bf7ed
mov ecx, dword [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x454]
push edx
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
mov ecx, dword [ebp - 0x350]
push ecx
call fcn.004bf9bc
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x300000d0
jne 0x4bf7eb
push 1
mov edx, dword [ebp - 0x66c]
push edx
call dword [0x510688]
jmp 0x4bf872
jmp 0x4bf82c
push 0
lea eax, [ebp - 0x454]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x350]
push edx
call fcn.004bf9bc
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x300000d0
jne 0x4bf82c
push 1
mov eax, dword [ebp - 0x66c]
push eax
call dword [0x510688]
jmp 0x4bf872
cmp dword [ebp - 0x66c], 0
je 0x4bf844
push 1
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [0x510688]
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00485c00
add esp, 0xc
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx + 4]
mov dword [ebp - 0x45c], eax
jmp 0x4bf6b1
mov dword [ebp - 4], 0xffffffff
jmp 0x4bf895
cmp dword [ebp - 0x34c], 3
jne 0x4bf8a3
call fcn.004bf214
cmp dword [ebp - 0x130], 0
je 0x4bf8bb
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00488be3
add esp, 4
cmp dword [ebp - 0x134], 0
je 0x4bf8d3
mov edx, dword [ebp - 0x134]
push edx
call fcn.00488be3
add esp, 4
cmp dword [ebp - 0x458], 0xffffffff
je 0x4bf8e9
mov eax, dword [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x138], 0
je 0x4bf8ff
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4