Function at 0x42ede0
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x459adb
mov eax, dword fs:[0]
push eax
sub esp, 0x4e0
mov eax, dword [0x471660]
xor eax, esp
mov dword [esp + 0x4dc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x471660]
xor eax, esp
push eax
lea eax, [esp + 0x4f4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x504]
push 0
mov ebp, ecx
push 0x1a
lea ebx, [ebp + 0x208]
push ebx
push 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edi, 0x45c70a
mov esi, ebx
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42f52c
lea esi, [ebp + 0x31c]
push esi
lea edi, [ebp + 0x30c]
push edi
push ebx
push str._s_s_s
push ebp
call fcn.00435956
push edi
push ebx
lea eax, [ebp + 0x104]
push str._s_s
push eax
call fcn.00435956
add esp, 0x24
push ebp
push esi
lea ecx, [ebp + 0x343]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebp
call fcn.0042e1d0
xor eax, eax
push 0x20
lea edx, [esp + 0x4d4]
mov dword [esp + 0x4d5], eax
mov dword [esp + 0x4d9], eax
mov dword [esp + 0x4dd], eax
mov dword [esp + 0x4e1], eax
mov dword [esp + 0x4e5], eax
mov dword [esp + 0x4e9], eax
mov dword [esp + 0x4ed], eax
mov word [esp + 0x4f1], ax
mov byte [esp + 0x4f3], al
push edx
lea eax, [ebp + 0x372]
push eax
lea ecx, [ebp + 0x36a]
push ecx
mov ecx, ebp
mov byte [esp + 0x4e0], 0
xor esi, esi
call fcn.0042e960
test eax, eax
je 0x42f52c
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x4dc]
push str._d._d._d
push edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call fcn.0043a3fc
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
xor eax, eax
mov dword [esp + 0x4cd], eax
mov dword [esp + 0x4d1], eax
mov byte [esp + 0x4d5], al
mov eax, dword [esp + 0x48]
push eax
push ecx
push edx
lea eax, [esp + 0x4d8]
push str._d_d_d
push eax
mov byte [esp + 0x4e0], 0
call fcn.00435956
add esp, 0x28
lea ecx, [esp + 0x4b8]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov edx, dword [esp + 0x18]
push esi
push esi
push 3
push esi
push esi
push closesocket
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x42f52c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea esi, [eax + 1]
push esi
mov dword [esp + 0x20], eax
call fcn.00430b21
mov ebx, eax
push esi
mov dword [esp + 0x20], ebx
call fcn.00430b21
push esi
mov edi, eax
push 0
push edi
call fcn.00435750
push esi
push 0
push ebx
call fcn.00435750
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
add esp, 0x20
push 0
lea eax, [esp + 0x28]
push eax
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 8
xor eax, eax
lea edx, [esp + 0x4c8]
push ebx
push edx
mov dword [esp + 0x4d0], eax
mov dword [esp + 0x4d4], eax
mov byte [esp + 0x4d8], al
call fcn.00438d80
add esp, 0xc
add esi, 0xfffffff8
push esi
push edi
lea eax, [ebx + 8]
push eax
mov ecx, ebp
call fcn.0042e4a0
test eax, eax
je 0x42f507
lea ecx, [esp + 0x3c]
call fcn.0042d5e0
push esi
push edi
lea ecx, [esp + 0x44]
mov dword [esp + 0x504], 0
call fcn.0042d6e0
mov esi, eax
push 8
lea ecx, [esp + 0x4c8]
push esi
push ecx
call fcn.0043830b
add esp, 0xc
test eax, eax
jne 0x42f4f3
test esi, esi
je 0x42f091
push esi
call fcn.00435125
add esp, 4
xor ebx, ebx
sub dword [esp + 0x24], 8
push 0x60
lea edx, [ebx + edi]
push edx
lea eax, [esp + 0x448]
push eax
call fcn.004398b0
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x450]
xor eax, eax
push ecx
push edx
mov dword [esp + 0x4b5], eax
mov dword [esp + 0x4b9], eax
mov byte [esp + 0x4bd], al
mov eax, dword [esp + 0x454]
push eax
lea ecx, [esp + 0x4b8]
push str._d_d_d
push ecx
mov byte [esp + 0x4c0], 0
call fcn.00435956
add esp, 0x20
lea edx, [esp + 0x4a0]
push edx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, dword [esp + 0x450]
mov edx, dword [esp + 0x44c]
mov esi, eax
xor eax, eax
mov dword [esp + 0x4ad], eax
mov dword [esp + 0x4b1], eax
mov byte [esp + 0x4b5], al
mov eax, dword [esp + 0x454]
push eax
push ecx
push edx
lea eax, [esp + 0x4b8]
push str._d_d_d
push eax
mov byte [esp + 0x4c0], 0
call fcn.00435956
add esp, 0x14
lea ecx, [esp + 0x4ac]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, dword [esp + 0x14]
cmp ecx, esi
jle 0x42f16d
cmp ecx, eax
jl 0x42f187
mov edx, dword [esp + 0x49c]
lea ebx, [ebx + edx + 0x60]
cmp ebx, dword [esp + 0x24]
jb 0x42f098
jmp 0x42f4ef
mov eax, ebp
lea esi, [ebp + 0x38d]
nop
mov cl, byte [eax]
mov byte [eax + 0x38d], cl
add eax, 1
test cl, cl
jne 0x42f190
lea eax, [ebp + 0x8b0]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp + 0x79d]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x42f1b7
lea ecx, [ebp + 0x8bb]
push ecx
lea eax, [ebp + 0x79d]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov edx, dword [esp + 0x14]
push edx
mov ecx, ebp
call fcn.0042e010
test eax, eax
je 0x42f210
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4fc], 0xffffffff
call fcn.00434620
mov eax, 1
jmp 0x42f530
push ebp
mov ecx, ebp
call fcn.0042e670
mov ecx, ebp
call fcn.0042e5e0
test eax, eax
je 0x42f4ef
mov ecx, dword [esp + 0x45c]
add ecx, 1
push ecx
call fcn.00430b21
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x38], esi
je 0x42f4ef
mov edx, dword [esp + 0x45c]
add edx, 1
push edx
push 0
push esi
call fcn.00435750
mov eax, dword [esp + 0x468]
push eax
lea ecx, [ebx + edi + 0x60]
push ecx
push esi
call fcn.004398b0
mov edx, dword [esp + 0x474]
add esp, 0x18
push edx
lea eax, [esp + 0x464]
push eax
push esi
lea eax, [ebp + 0x79d]
push eax
mov ecx, ebp
call fcn.0042e260
test eax, eax
je 0x42f4e6
mov ecx, dword [esp + 0x46c]
add ecx, 1
push ecx
call fcn.00430b21
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x42f4e6
mov edx, dword [esp + 0x46c]
add edx, 1
push edx
push 0
push eax
call fcn.00435750
mov ecx, dword [esp + 0x468]
mov eax, dword [esp + 0x478]
push eax
mov eax, dword [esp + 0x24]
add ecx, ebx
lea edx, [ecx + edi + 0x60]
push edx
push eax
call fcn.004398b0
add esp, 0x18
lea ecx, [ebp + 0x8cd]
push ecx
lea esi, [ebp + 0x491]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov edx, dword [esp + 0x46c]
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x474]
push eax
push ecx
push esi
mov ecx, ebp
call fcn.0042e260
test eax, eax
je 0x42f4d5
mov edx, dword [esp + 0x47c]
add edx, 1
push edx
call fcn.00430b21
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x1c], esi
je 0x42f4d5
mov eax, dword [esp + 0x47c]
add eax, 1
push eax
push 0
push esi
call fcn.00435750
mov edx, dword [esp + 0x468]
mov eax, dword [esp + 0x478]
mov ecx, dword [esp + 0x488]
add eax, edx
push ecx
add eax, ebx
lea ecx, [eax + edi + 0x60]
push ecx
push esi
call fcn.004398b0
add esp, 0x18
mov eax, ebp
mov cl, byte [eax]
mov byte [eax + 0x595], cl
add eax, 1
test cl, cl
jne 0x42f384
lea edx, [ebp + 0x8d8]
push edx
lea eax, [ebp + 0x595]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [esp + 0x47c]
push eax
lea ecx, [esp + 0x484]
push ecx
push esi
lea eax, [ebp + 0x595]
push eax
mov ecx, ebp
call fcn.0042e260
test eax, eax
je 0x42f4cc
mov edx, dword [esp + 0x48c]
add edx, 1
push edx
call fcn.00430b21
mov esi, eax
add esp, 4
test esi, esi
je 0x42f4c8
mov eax, dword [esp + 0x48c]
add eax, 1
push eax
push 0
push esi
call fcn.00435750
mov edx, dword [esp + 0x478]
mov eax, dword [esp + 0x488]
mov ecx, dword [esp + 0x498]
add eax, edx
add eax, dword [esp + 0x468]
push ecx
add eax, ebx
lea ecx, [eax + edi + 0x60]
push ecx
push esi
call fcn.004398b0
add esp, 0x18
mov eax, ebp
lea ebx, [ebp + 0x699]
mov cl, byte [eax]
mov byte [eax + 0x699], cl
add eax, 1
test cl, cl
jne 0x42f435
lea edx, [ebp + 0x8e4]
push edx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [esp + 0x48c]
push eax
lea ecx, [esp + 0x494]
push ecx
push esi
push ebx
mov ecx, ebp
call fcn.0042e260
test eax, eax
je 0x42f4bf
lea edx, [esp + 0x4a0]
push edx
push 0x460b6c
lea ebx, [ebp + 0x900]
push ebx
push closesocket
mov ecx, ebp
call fcn.0042e1d0
lea eax, [esp + 0x4ac]
push eax
push 0x460b68
push ebx
push closesocket
mov ecx, ebp
call fcn.0042e1d0
cmp dword [esp + 0x28], 4
jge 0x42f4b7
mov ecx, ebp
call fcn.0042eb90
mov dword [esp + 0x2c], 1
push esi
call fcn.00435125
add esp, 4
mov esi, dword [esp + 0x1c]
push esi
call fcn.00435125
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00435125
mov esi, dword [esp + 0x3c]
add esp, 4
push esi
call fcn.00435125
add esp, 4
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4fc], 0xffffffff
call fcn.00434620
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x42f51f
push edi
call fcn.00435125
add esp, 4
test ebx, ebx
je 0x42f52c
push ebx
call fcn.00435125
add esp, 4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x4f4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4dc]
xor ecx, esp
call fcn.00434fe0
add esp, 0x4ec
ret 4