Function at 0x10004c20
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x440
mov eax, dword [esp + 0x444]
push ebx
push ebp
push esi
push edi
lea ebx, [ecx + 4]
push eax
push 0x1f48
mov ecx, ebx
mov dword [esp + 0x18], ebx
call fcn.10003760
test eax, eax
je 0x10004f52
xor ebp, ebp
mov ecx, 0x109
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x28], ebp
push ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x2c]
push ecx
push edx
push ebp
push ebp
mov ecx, ebx
mov dword [esp + 0x30], 0x428
call fcn.100038a0
test eax, eax
je 0x10004f4b
mov eax, dword [esp + 0x2c]
push ebp
cmp eax, ebp
push 0x80
jne 0x10004e03
push 3
push ebp
push 1
lea eax, [esp + 0x260]
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x10004ce5
lea ecx, [esp + 0x38]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10004ce5
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
cmp eax, ecx
jl 0x10004cf1
jg 0x10004ce9
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
cmp edx, ecx
jbe 0x10004cf1
jmp 0x10004ce9
mov eax, dword [esp + 0x44]
mov dword [esp + 0x30], 0x1b6b
cmp eax, ebp
jl 0x10004d28
jg 0x10004cfd
cmp dword [esp + 0x40], ebp
jbe 0x10004d28
push ebp
push ebp
push eax
mov eax, dword [esp + 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
sub edx, ecx
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x44]
sbb eax, edx
mov dword [esp + 0x3c], eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x34]
push 0x428
push eax
mov ecx, ebx
call fcn.100038a0
test eax, eax
je 0x10004f44
cmp dword [esp + 0x30], ebp
jne 0x10004df7
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov ecx, ebx
or ecx, eax
je 0x10004df3
push 0x1fffe
mov ebp, eax
mov dword [esp + 0x28], 0
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
test ebp, ebp
jl 0x10004dda
jg 0x10004d83
test ebx, ebx
jbe 0x10004dda
test ebp, ebp
jl 0x10004d98
jg 0x10004d91
cmp ebx, 0x1fffe
jbe 0x10004d98
mov esi, 0x1fffe
jmp 0x10004d9a
mov esi, ebx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x24]
push 0
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
push esi
push edi
call fcn.100038a0
test eax, eax
je 0x10004f1a
sub ebx, esi
sbb ebp, 0
test ebp, ebp
jg 0x10004d91
jl 0x10004dd6
test ebx, ebx
ja 0x10004d83
mov esi, dword [esp + 0x18]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
jmp 0x10004c4d
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004c4d
push 4
push ebp
push ebp
lea ecx, [esp + 0x260]
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004e4b
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10004e4b
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
cmp eax, ecx
jl 0x10004e53
jg 0x10004e4b
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp ecx, eax
jbe 0x10004e53
mov dword [esp + 0x30], 0x1b6c
xor ecx, ecx
push 2
xor eax, eax
push ebp
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
sub eax, edx
push ebp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x48]
push ebp
push ebp
lea ecx, [esp + 0x34]
push 0x428
push ecx
sbb edi, eax
mov ecx, ebx
mov dword [esp + 0x50], edi
call fcn.100038a0
test eax, eax
je 0x10004f44
cmp dword [esp + 0x30], ebp
je 0x10004ead
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004c4d
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
push 0x1fffe
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
test ebx, ebx
jl 0x10004f14
jg 0x10004ed6
test edi, edi
jbe 0x10004f14
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
push ebp
push 0
push 0
call fcn.100038a0
test eax, eax
je 0x10004f5f
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push 0
push eax
push ecx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub edi, dword [esp + 0x14]
sbb ebx, 0
test ebx, ebx
jg 0x10004ed6
jl 0x10004f14
test edi, edi
ja 0x10004ed6
push ebp
jmp 0x10004ddb
mov ecx, dword [esp + 0x10]
call fcn.10003880
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x1c]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.10003880
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret 4
mov ecx, dword [esp + 0x10]
call fcn.10003880
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret 4