Function at 0x4f2b63
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0x458
mov eax, 0x78e63c
call fcn.00700ca1
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x440], eax
call fcn.0050f908
pop ecx
test eax, eax
je 0x4f36c0
push edi
call fcn.0050d1a8
mov esi, eax
pop ecx
test esi, esi
je 0x4f36c0
xor ebx, ebx
mov eax, edi
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x438], ebx
jb 0x4f2bb6
mov eax, dword [edi]
push 0x808e78
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.00721bfb
add esp, 0xc
mov dword [ebp - 0x43c], eax
test eax, eax
jne 0x4f3385
cmp dword [ebp - 0x438], ebx
je 0x4f3385
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push ebx
push esi
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xa
call fcn.004dfcc3
push dword [ebp - 0x438]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push esi
cmovae eax, dword [ebp - 0x230]
push 2
push eax
call fcn.00721ff9
add esp, 0x10
lea ecx, [ebp - 0x230]
cmp eax, dword [ebp - 0x220]
ja 0x4f2c60
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x220], eax
cmovae ecx, dword [ebp - 0x230]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x4f2c6d
sub eax, dword [ebp - 0x220]
push ebx
push eax
call fcn.004dfcc3
cmp dword [ebp - 0x21c], 8
mov ebx, 0x1000
jb 0x4f2d44
mov esi, dword [ebp - 0x220]
cmp esi, 8
jae 0x4f2c9a
lea ecx, [ebp - 0x230]
call fcn.004f6d96
jmp 0x4f2d44
or esi, 7
mov eax, 0x7ffffffe
cmp esi, eax
cmova esi, eax
cmp esi, dword [ebp - 0x21c]
jae 0x4f2d44
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x230]
call fcn.004c095f
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x43c], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x230]
push eax
call fcn.00718720
mov ecx, dword [ebp - 0x21c]
add esp, 0xc
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x428], eax
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x42c], ecx
cmp ecx, ebx
jb 0x4f2d29
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x42c]
push ecx
push eax
call fcn.007009b8
mov eax, dword [ebp - 0x43c]
pop ecx
pop ecx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x21c], esi
push dword [ebp - 0x438]
call fcn.00721d8f
lea eax, [ebp - 0x230]
mov dword [esp], 0xfde9
push eax
lea eax, [ebp - 0x308]
push eax
call fcn.004fba72
add esp, 0xc
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xb
call fcn.00441130
push 0
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 0xc
call fcn.00435a60
push 1
lea eax, [ebp - 0x464]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x424]
call fcn.00441250
test al, al
je 0x4f32ec
lea ecx, [ebp - 0x464]
call fcn.00435ff0
cmp eax, 7
jne 0x4f32ec
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x464]
call fcn.004378c0
mov esi, dword [ebp - 0x44c]
mov byte [ebp - 4], 0xe
jmp 0x4f2df8
push str.path
mov ecx, esi
call fcn.004405b0
test al, al
jne 0x4f2e05
add esi, 0x18
cmp esi, dword [ebp - 0x448]
jne 0x4f2de5
jmp 0x4f2edc
mov eax, dword [ebp - 0x440]
xor ecx, ecx
cmp dword [eax + 0x10], ecx
je 0x4f2e56
push ecx
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.004fba72
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0xf
jb 0x4f2e2f
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x440], esp
push eax
call fcn.00435c90
push esi
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 0x10
call fcn.004376e0
mov byte [ebp - 4], 0xf
jmp 0x4f2ec6
push 0x208
push ecx
lea eax, [ebp - 0x218]
push eax
call fcn.00719250
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xfde9
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.004fbbb7
sub esp, 0xc
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x290]
mov dword [ebp - 0x440], esp
mov ecx, esp
push eax
call fcn.00435d70
push esi
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 0x12
call fcn.004376e0
mov byte [ebp - 4], 0x11
mov ecx, eax
call fcn.00435ef0
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xe
call fcn.00438e20
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x464]
call fcn.00437e10
push 0xfde9
push eax
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 0x13
push eax
call fcn.004fa5fb
add esp, 0xc
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 0x15
call fcn.00438e20
and dword [ebp - 0x434], 0
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4f2f27
mov eax, dword [edi]
push str.w__ccsUTF_8
push eax
lea eax, [ebp - 0x434]
push eax
call fcn.00721bfb
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4f2f90
cmp dword [ebp - 0x434], eax
je 0x4f2f90
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x294], 8
push dword [ebp - 0x434]
lea ecx, [eax + eax]
lea eax, [ebp - 0x2a8]
cmovae eax, dword [ebp - 0x2a8]
inc esi
push esi
push ecx
push eax
call fcn.00722353
push dword [ebp - 0x434]
call fcn.00721d8f
add esp, 0x14
and dword [ebp - 0x434], 0
jmp 0x4f32d4
and dword [ebp - 0x280], 0
lea ecx, [ebp - 0x290]
push 0xf
pop eax
push eax
push str.CiscoWebexStart
mov dword [ebp - 0x27c], eax
mov byte [ebp - 0x290], 0
call fcn.00439710
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 0x16
push eax
call fcn.006210e3
and dword [ebp - 0x268], 0
mov ebx, eax
pop ecx
push 3
push 0x808e94
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], 0
call fcn.00439710
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 0x17
push esi
push eax
call fcn.00621152
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 0x18
push ecx
push eax
lea ecx, [ebp - 0x398]
call fcn.0061c551
mov edi, eax
and dword [ebp - 0x250], 0
lea ecx, [ebp - 0x260]
push 0xc
push str.jsonFilePath
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
call fcn.00439710
push 0
push dword [ebp - 0x430]
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0x1a
push eax
call fcn.00620ff2
add esp, 0xc
push 0
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x1b
push ecx
push eax
lea ecx, [ebp - 0x368]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 0x1c
push eax
push 0x858903
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], al
call fcn.00439710
push str.ModifyExtensionConfig_open_failed_with_utf_8
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0x1d
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0x1e
push ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.0061c551
push edi
push esi
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x1f
call fcn.00621a3d
lea ecx, [ebp - 0x320]
call fcn.00438e20
lea ecx, [ebp - 0x338]
call fcn.00438e20
lea ecx, [ebp - 0x2d8]
call fcn.00438e20
mov eax, dword [ebp - 0x234]
mov ebx, 0x1000
cmp eax, 0x10
jb 0x4f3164
mov ecx, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], ecx
cmp eax, ebx
jb 0x4f315b
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x42c]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x238], 0
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.00438e20
lea ecx, [ebp - 0x368]
call fcn.00438e20
lea ecx, [ebp - 0x2f0]
call fcn.00438e20
mov eax, dword [ebp - 0x24c]
cmp eax, 0x10
jb 0x4f31e9
mov ecx, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], ecx
cmp eax, ebx
jb 0x4f31e0
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x42c]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x250], 0
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
call fcn.00438e20
lea ecx, [ebp - 0x398]
call fcn.00438e20
lea ecx, [ebp - 0x2c0]
call fcn.00438e20
mov eax, dword [ebp - 0x264]
cmp eax, 0x10
jb 0x4f326e
mov ecx, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], ecx
cmp eax, ebx
jb 0x4f3265
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x42c]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], 0
cmp eax, 0x10
jb 0x4f32d2
mov ecx, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], ecx
cmp eax, ebx
jb 0x4f32c9
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x42c]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor esi, esi
lea ecx, [ebp - 0x2a8]
call fcn.004c0931
lea ecx, [ebp - 0x44c]
call fcn.00438c90
jmp 0x4f330b
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x424]
call fcn.004445f0
lea ecx, [ebp - 0x2c0]
call fcn.00438e20
xor esi, esi
lea ecx, [ebp - 0x464]
call fcn.00435e20
lea ecx, [ebp - 0x424]
call fcn.004d6664
lea ecx, [ebp - 0x308]
call fcn.00438e20
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4f337e
mov ecx, dword [ebp - 0x230]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], ecx
cmp eax, ebx
jb 0x4f3375
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x428]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x42c]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, esi
jmp 0x4f36c2
push 0xf
pop eax
push eax
push str.CiscoWebexStart
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], eax
mov byte [ebp - 0x290], bl
call fcn.00439710
lea eax, [ebp - 0x290]
mov dword [ebp - 4], ebx
push eax
call fcn.006210e3
and dword [ebp - 0x238], 0
mov ebx, eax
pop ecx
push 3
push 0x808e94
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.00439710
push dword [ebp - 0x43c]
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 1
push eax
call fcn.00621152
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
push ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.0061c551
mov edi, eax
and dword [ebp - 0x250], 0
lea ecx, [ebp - 0x260]
push 0xc
push str.jsonFilePath
mov byte [ebp - 4], 3
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
call fcn.00439710
push 0
push dword [ebp - 0x430]
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 4
push eax
call fcn.00620ff2
add esp, 0xc
push 0
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 5
push ecx
push eax
lea ecx, [ebp - 0x368]
call fcn.0061c551
mov esi, eax
xor eax, eax
mov byte [ebp - 4], 6
push eax
push 0x858903
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], 0xf
mov byte [ebp - 0x278], al
call fcn.00439710
push str.ModifyExtensionConfig_open_failed
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 7
push eax
call fcn.006212a1
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 8
push ecx
push eax
lea ecx, [ebp - 0x398]
call fcn.0061c551
push edi
push esi
push eax
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.00621a3d
lea ecx, [ebp - 0x380]
call fcn.00438e20
lea ecx, [ebp - 0x398]
call fcn.00438e20
lea ecx, [ebp - 0x2c0]
call fcn.00438e20
mov eax, dword [ebp - 0x264]
mov esi, 0x1000
cmp eax, 0x10
jb 0x4f355b
mov ecx, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x428], ecx
cmp eax, esi
jb 0x4f3552
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x430]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x428]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x268], 0
lea ecx, [ebp - 0x350]
push 0xf
pop ebx
mov dword [ebp - 0x264], ebx
mov byte [ebp - 0x278], 0
call fcn.00438e20
lea ecx, [ebp - 0x368]
call fcn.00438e20
lea ecx, [ebp - 0x2f0]
call fcn.00438e20
mov eax, dword [ebp - 0x24c]
cmp eax, 0x10
jb 0x4f35df
mov ecx, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x428], ecx
cmp eax, esi
jb 0x4f35d6
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x430]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x428]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x250], 0
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x24c], ebx
mov byte [ebp - 0x260], 0
call fcn.00438e20
lea ecx, [ebp - 0x338]
call fcn.00438e20
lea ecx, [ebp - 0x2d8]
call fcn.00438e20
mov eax, dword [ebp - 0x234]
cmp eax, 0x10
jb 0x4f3660
mov ecx, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x428], ecx
cmp eax, esi
jb 0x4f3657
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x430]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x428]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x234], ebx
mov byte [ebp - 0x248], 0
cmp eax, 0x10
jb 0x4f36c0
mov ecx, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x428], ecx
cmp eax, esi
jb 0x4f36b7
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x430]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x428]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
xor eax, eax
call fcn.00700c4b
ret