Function at 0x4d13c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59514d
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x61094c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x44], ebx
cmp dword [esi + 0x14], 8
jb 0x4d13fe
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], 0
cmp edi, 0xffffffff
jne 0x4d1492
push 1
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d1464
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x54], eax
jb 0x4d1444
mov esi, dword [esi]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x58], esi
push eax
lea eax, [ebp - 0x58]
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
push eax
push ecx
push 0x24
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
call fcn.004d1950
add esp, 0x14
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
push 0xffffffffffffffff
jmp 0x4d18b8
push 0x400
call fcn.00554193
mov esi, eax
mov dword [ebp - 0x4c], esi
push 0x400
push 0
push esi
mov byte [ebp - 4], 1
call fcn.00556180
add esp, 0x10
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push 0
push eax
push 0x3ff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d1541
push 5
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d150c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x58], eax
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
lea eax, [ebp - 0x58]
mov ecx, 5
push eax
push str.failed_to_read_the_file:__d
push 0x2e
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
call fcn.00428a80
add esp, 0x10
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
push esi
call fcn.00469710
add esp, 4
jmp 0x4d18b3
mov ecx, esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d1560
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00425b00
mov byte [ebp - 4], 2
push esi
mov dword [ebp - 0x4c], 0
call fcn.00469710
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x40]
add esp, 4
cmp dword [ebp - 0x2c], 0x10
cmovae ecx, dword [ebp - 0x40]
setae byte [ebp - 0x4d]
mov dword [ebp - 0x5c], ecx
cmp eax, 0xd
jb 0x4d1631
add eax, 0xfffffff4
add eax, ecx
mov dword [ebp - 0x58], eax
sub eax, ecx
push eax
push 0x24
push ecx
call fcn.00557280
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
je 0x4d1631
mov ecx, eax
mov edx, str._FileVersion
mov esi, 9
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4d15e1
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4d15d0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4d1608
cmp esi, 0xfffffffd
je 0x4d1604
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4d1608
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4d1608
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4d1608
xor eax, eax
jmp 0x4d160d
sbb eax, eax
or eax, 1
mov ecx, dword [ebp - 0x54]
test eax, eax
je 0x4d16bb
mov eax, dword [ebp - 0x58]
inc ecx
sub eax, ecx
push eax
push 0x24
push ecx
call fcn.00557280
add esp, 0xc
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x4d15c2
push 5
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d165d
push str.failed_to_find_file_version_key
push 0x39
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
mov ecx, 5
call fcn.00428ac0
add esp, 0xc
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x4d18a1
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1897
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1936
jmp 0x4d1897
sub ecx, dword [ebp - 0x5c]
cmp ecx, 0xffffffff
je 0x4d1631
mov eax, dword [ebp - 0x30]
lea edx, [ecx + 0xd]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, edx
jb 0x4d193b
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp byte [ebp - 0x4d], 0
lea eax, [ebp - 0x40]
cmovne eax, dword [ebp - 0x40]
push ecx
add eax, edx
lea ecx, [ebp - 0x28]
push eax
call fcn.00425b00
mov byte [ebp - 4], 3
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x18]
cmovae esi, dword [ebp - 0x28]
setae byte [ebp - 0x4d]
test eax, eax
je 0x4d18de
push eax
push 0x20
push esi
call fcn.00557280
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x4d18de
sub ecx, esi
cmp ecx, 0xffffffff
je 0x4d18de
cmp dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x74], 0
cmovb ecx, dword [ebp - 0x18]
cmp byte [ebp - 0x4d], 0
push ecx
cmovne eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x74]
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
call fcn.00425b00
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x28]
call fcn.00462e20
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x4d17c0
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d17b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1936
push edx
push ecx
call fcn.00554162
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
jb 0x4d17d3
mov ecx, dword [ebp - 0x28]
add esi, ecx
jmp 0x4d17d8
add esi, ecx
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x54], ecx
push eax
mov ecx, ebx
call fcn.00437670
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x54], esi
je 0x4d1827
mov edi, dword [ebp - 0x54]
nop
movsx ax, byte [edi]
mov ecx, ebx
movzx eax, ax
push eax
call fcn.0043a5e0
inc edi
cmp edi, esi
jne 0x4d1810
mov edi, dword [ebp - 0x44]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4d185b
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1851
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1936
push edx
push ecx
call fcn.00554162
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x4d18a1
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4d1897
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d1936
push edx
push ecx
call fcn.00554162
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
test edi, edi
je 0x4d18be
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret 0xc
push 5
call fcn.004deaf0
add esp, 4
test eax, eax
je 0x4d190a
push str.failed_to_find_the_end_of_the_file_version
push 0x41
push str.Intel::Analytics::CTxtVerSubstitution::Substitute
mov edx, str.E:BT5a34f070_108c_442c_81a8_adb208410955ClientAnalyticsXMLUpdater_srcBSIUpdaterPluginTxtVerSubstitution.cpp
mov ecx, 5
call fcn.00428ac0
add esp, 0xc
push 8
xor eax, eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov dword [ebx + 0x14], 7
push str._UNKNOWN
mov word [ebx], ax
call fcn.00425790
jmp 0x4d1827
call fcn.0055eb27
call fcn.00426cb0
int3