Function at 0x49b990
Capabilities:
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2de2
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x633d24], 0
jne 0x49bc39
mov esi, dword [0x633d20]
test esi, esi
jne 0x49bad4
push 0x18
call fcn.00406b5e
mov esi, eax
add esp, 4
mov dword [ebp - 0x224], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x49bac5
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x218]
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49ba30
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00409db0
mov ebx, dword [esi + 0x14]
mov edx, esi
mov edi, dword [esi + 0x10]
cmp ebx, 8
jb 0x49ba5d
mov edx, dword [esi]
mov dword [ebp - 0x21c], edi
test edi, edi
je 0x49bab5
lea eax, [edi - 1]
mov ecx, edi
cmp eax, edi
mov dword [ebp - 0x21c], eax
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea eax, [edx + ecx*2]
je 0x49ba8e
cmp eax, edx
je 0x49bab5
sub eax, 2
cmp word [eax], 0x5c
jne 0x49ba81
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x49bab5
inc eax
cmp edi, eax
jb 0x49bc57
mov dword [esi + 0x10], eax
mov ecx, esi
cmp ebx, 8
jb 0x49baaf
lfence
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
push 9
push 0x5c0570
mov ecx, esi
call fcn.0040f730
jmp 0x49bac7
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x633d20], esi
test byte [0x633d1c], 1
je 0x49bc39
cmp dword [esi + 0x14], 8
jb 0x49bae9
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 3
push 4
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x633d24], eax
test eax, eax
je 0x49bb78
cmp eax, 0xffffffff
je 0x49bb85
lea ecx, [ebp - 0x220]
xorps xmm0, xmm0
push ecx
push eax
movlpd qword [ebp - 0x220], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x49bb73
cmp dword [ebp - 0x21c], 0
jl 0x49bb73
jg 0x49bb41
cmp dword [ebp - 0x220], 0xc800000
jbe 0x49bb73
mov eax, dword [0x633d20]
cmp dword [eax + 0x14], 8
jb 0x49bb4e
mov eax, dword [eax]
push 0
push 0x80
push 5
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x49bb73
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x633d24]
cmp eax, 0xffffffff
je 0x49bb85
test eax, eax
jne 0x49bc39
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x49bc35
cmp eax, 0x104
ja 0x49bc35
mov ecx, dword [0x633d20]
lea eax, [ebp - 0x218]
push eax
call fcn.0040bef0
mov ecx, dword [0x633d20]
mov edx, ecx
cmp dword [ecx + 0x14], 8
jb 0x49bbd5
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
cmp word [edx + eax*2 - 2], 0x5c
je 0x49bbf0
push 0x5c0584
call fcn.00439a10
mov ecx, dword [0x633d20]
push 0x5c0570
call fcn.00439a10
mov eax, dword [0x633d20]
cmp dword [eax + 0x14], 8
jb 0x49bc07
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x633d24], eax
cmp eax, 0xffffffff
je 0x49bc2b
test eax, eax
jne 0x49bc39
mov dword [0x633d24], 0
xor al, al
jmp 0x49bc3b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret
call fcn.0047f6b0
int3