Function at 0x4d1460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59559d
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x44], ebx
cmp dword [esi + 0x14], 8
jb 0x4d149e
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], 0
cmp edi, 0xffffffff
jne 0x4d1532
push 1
call fcn.004deb80
add esp, 4
test eax, eax
je 0x4d1504
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x54], eax
jb 0x4d14e4
mov esi, dword [esi]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x58], esi
push eax
lea eax, [ebp - 0x58]
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
push eax
push ecx
push 0x24
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
call fcn.004d19f0
add esp, 0x14
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
push 0xffffffffffffffff
jmp 0x4d1958
push 0x400
call fcn.005541f3
mov esi, eax
mov dword [ebp - 0x4c], esi
push 0x400
push 0
push esi
mov byte [ebp - 4], 1
call fcn.005561e0
add esp, 0x10
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push 0
push eax
push 0x3ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d15e1
push 5
call fcn.004deb80
add esp, 4
test eax, eax
je 0x4d15ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x58], eax
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
lea eax, [ebp - 0x58]
mov ecx, 5
push eax
push str.failed_to_read_the_file:__d
push 0x2e
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
call fcn.00428a80
add esp, 0x10
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
push esi
call fcn.00469760
add esp, 4
jmp 0x4d1953
mov ecx, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d1600
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00425b00
mov byte [ebp - 4], 2
push esi
mov dword [ebp - 0x4c], 0
call fcn.00469760
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x40]
add esp, 4
cmp dword [ebp - 0x2c], 0x10
cmovae ecx, dword [ebp - 0x40]
setae byte [ebp - 0x4d]
mov dword [ebp - 0x5c], ecx
cmp eax, 0xd
jb 0x4d16d1
add eax, 0xfffffff4
add eax, ecx
mov dword [ebp - 0x58], eax
sub eax, ecx
push eax
push 0x24
push ecx
call fcn.005572e0
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
je 0x4d16d1
mov ecx, eax
mov edx, str._FileVersion
mov esi, 9
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4d1681
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4d1670
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4d16a8
cmp esi, 0xfffffffd
je 0x4d16a4
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4d16a8
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4d16a8
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4d16a8
xor eax, eax
jmp 0x4d16ad
sbb eax, eax
or eax, 1
mov ecx, dword [ebp - 0x54]
test eax, eax
je 0x4d175b
mov eax, dword [ebp - 0x58]
inc ecx
sub eax, ecx
push eax
push 0x24
push ecx
call fcn.005572e0
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x4d1662
push 5
call fcn.004deb80
add esp, 4
test eax, eax
je 0x4d16fd
push str.failed_to_find_file_version_key
push 0x39
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
mov ecx, 5
call fcn.00428ac0
add esp, 0xc
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4d1941
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1937
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d19d6
jmp 0x4d1937
sub ecx, dword [ebp - 0x5c]
cmp ecx, 0xffffffff
je 0x4d16d1
mov eax, dword [ebp - 0x30]
lea edx, [ecx + 0xd]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, edx
jb 0x4d19db
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp byte [ebp - 0x4d], 0
lea eax, [ebp - 0x40]
cmovne eax, dword [ebp - 0x40]
push ecx
add eax, edx
lea ecx, [ebp - 0x28]
push eax
call fcn.00425b00
mov byte [ebp - 4], 3
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x18]
cmovae esi, dword [ebp - 0x28]
setae byte [ebp - 0x4d]
test eax, eax
je 0x4d197e
push eax
push 0x20
push esi
call fcn.005572e0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4d197e
sub ecx, esi
cmp ecx, 0xffffffff
je 0x4d197e
cmp dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x74], 0
cmovb ecx, dword [ebp - 0x18]
cmp byte [ebp - 0x4d], 0
push ecx
cmovne eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x74]
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
call fcn.00425b00
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x28]
call fcn.00462e80
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x4d1860
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1856
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d19d6
push edx
push ecx
call fcn.005541c2
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
jb 0x4d1873
mov ecx, dword [ebp - 0x28]
add esi, ecx
jmp 0x4d1878
add esi, ecx
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x54], ecx
push eax
mov ecx, ebx
call fcn.004376a0
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x54], esi
je 0x4d18c7
mov edi, dword [ebp - 0x54]
nop
movsx ax, byte [edi]
mov ecx, ebx
movzx eax, ax
push eax
call fcn.0043a620
inc edi
cmp edi, esi
jne 0x4d18b0
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4d18fb
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d18f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d19d6
push edx
push ecx
call fcn.005541c2
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x4d1941
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1937
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d19d6
push edx
push ecx
call fcn.005541c2
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
test edi, edi
je 0x4d195e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553d2a
mov esp, ebp
pop ebp
ret 0xc
push 5
call fcn.004deb80
add esp, 4
test eax, eax
je 0x4d19aa
push str.failed_to_find_the_end_of_the_file_version
push 0x41
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
mov ecx, 5
call fcn.00428ac0
add esp, 0xc
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
jmp 0x4d18c7
call fcn.0055eb97
call fcn.00426cb0
int3