Function at 0x4b0090
Capabilities:
Check if file exists
Get common file path
Read file on windows
Timestomp file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
xor r13d, r13d
mov rax, qword [rbp]
mov qword [rsp + 0xe8], rax
xor eax, eax
mov r12, rcx
mov edi, edx
call sub.msvcrt.dll_strlen
cmp eax, 3
jg 0x4b0379
lea rdx, [0x00590c10]
mov rcx, r12
call sub.msvcrt.dll_strpbrk
test rax, rax
je 0x4b0110
mov rcx, r12
call fcn.004996c0
mov rdi, qword [rsp + 0xe8]
xor rdi, qword [rbp]
jne 0x4b0409
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.PATH
call fcn.004adf70
mov r10, rax
test rax, rax
je 0x4b03ba
movzx ecx, byte [r10]
test cl, cl
je 0x4b0173
mov rbx, r10
cmp cl, 0x3b
jne 0x4b0145
jmp 0x4b0173
cmp cl, 0x3b
je 0x4b0154
mov rsi, rbx
movzx ecx, byte [rbx + 1]
add rbx, 1
test cl, cl
jne 0x4b0140
mov rdx, rbx
sub rdx, r10
cmp ebx, r10d
jne 0x4b0350
test cl, cl
je 0x4b017a
movzx ecx, byte [rbx + 1]
lea r10, [rbx + 1]
test cl, cl
jne 0x4b0130
mov rbx, r10
test cl, cl
jne 0x4b0167
xor eax, eax
mov edx, 1
test r13d, r13d
jne 0x4b00e6
test dl, dl
je 0x4b00e6
mov r8d, 7
lea rdx, str.busybox
mov rcx, r12
call qword [sym.imp.msvcrt.dll__strnicmp_2]
test eax, eax
jne 0x4b01d2
cmp byte [r12 + 7], 0
je 0x4b03ba
lea rcx, [r12 + 7]
lea rdx, str..exe
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x4b03ba
mov edx, dword [0x005ee908]
mov rax, qword [0x005ee900]
test edx, edx
je 0x4b03e2
test rax, rax
je 0x4b03ba
lea rdx, [0x00590c27]
mov rcx, r12
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x4b03cc
mov eax, dword [0x00576508]
test eax, eax
jne 0x4b032d
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x11
xor r9d, r9d
rep stosq qword [rdi], rax
mov rax, qword [0x005aaca0]
mov rdx, qword [0x005ee900]
lea rcx, [rsp + 0x68]
lea r8, str.__help
lea r13, [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
mov rax, qword [0x005ab200]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rax
call fcn.0040b730
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov rcx, r13
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x800
call fcn.00460f20
test eax, eax
jne 0x4b03a7
mov rcx, qword [rsp + 0x50]
lea rdx, str.Currently_defined_functions:_n
call sub.msvcrt.dll_strstr
mov rbx, rax
test rax, rax
je 0x4b039b
movzx eax, byte [rax]
cmp al, 0xa
je 0x4b02e8
test al, al
jne 0x4b02dc
jmp 0x4b02e8
cmp al, 0xa
je 0x4b02e8
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
jne 0x4b02d8
lea rdi, str._n_t__
lea r13, [0x00576500]
jmp 0x4b030c
mov byte [rbx + rax], 0
mov rdx, rbx
mov rcx, r13
lea rbx, [rbx + rsi + 1]
call fcn.00476890
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_strspn
mov rdx, rdi
add rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_strcspn
mov rsi, rax
test rax, rax
jne 0x4b02f8
mov rdx, r12
lea rcx, [0x00576500]
call fcn.00476a70
test eax, eax
je 0x4b03ba
mov rcx, qword [0x005ee900]
jmp 0x4b03d8
mov dword [rsp + 0x20], edi
mov r9d, r13d
mov r8, r12
mov rcx, r10
call fcn.004aff00
cmp byte [rbx], 0
je 0x4b03c1
lea r10, [rsi + 2]
test rax, rax
je 0x4b0128
jmp 0x4b00e6
cdqe
lea rdx, str..exe
xor r13d, r13d
lea rcx, [r12 + rax - 4]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
sete r13b
jmp 0x4b00ca
lea rcx, str.Could_not_parse_output_of_busybox___help
call fcn.00494a30
lea rdx, [0x00590c31]
lea rcx, [0x00576500]
call fcn.00476f10
xor eax, eax
jmp 0x4b00e6
test rax, rax
sete dl
jmp 0x4b0181
mov rcx, qword [0x005ee900]
test rcx, rcx
je 0x4b03ba
call fcn.004996c0
jmp 0x4b00e6
mov edx, 1
lea rcx, str.busybox.exe
call fcn.004b0090
mov dword [0x005ee908], 1
mov qword [0x005ee900], rax
jmp 0x4b01e7
call sub.libssp_0.dll___stack_chk_fail
nop
nop