Function at 0x438b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce8b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4f5568]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4f5568]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov bl, 1
call dword [eax + 0x28]
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x65
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x40], 0
cmp byte [esi + 0x4fa], 0
je 0x438cce
cmp byte [esi + 0x4e8], 0
jne 0x438cc7
cmp byte [esi + 0x4f9], 0
jne 0x438cc7
push 0
lea edi, [esi + 0x4ec]
push edi
push 0x2000
push dword [esi + 0x37c]
push dword [esi + 0x4e4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x438c64
cmp dword [edi], eax
je 0x438bb4
mov byte [esi + 0x4f9], bl
mov ecx, dword [esi + 0x4fc]
test ecx, ecx
je 0x438c79
mov eax, dword [esi + 0x500]
cmp eax, dword [esi + 0x504]
jge 0x438c79
mov ecx, dword [eax + ecx]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x438c79
push 0
add eax, 4
push 0
push 0
mov dword [esi + 0x500], eax
call fcn.004a6f80
add esp, 0xc
push dword [edi]
push dword [esi + 0x37c]
push eax
call fcn.004a6f80
add esp, 0xc
cmp eax, dword [esp + 0x10]
jne 0x438c79
mov ecx, dword [edi]
mov edx, ecx
mov eax, ecx
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
mov word [esp + 0x24], 0x507
movzx eax, byte [esi + 0x4ef]
and ecx, 0xff00
shl edx, 8
or edx, ecx
mov dword [esp + 0x28], 0x2000000
mov ecx, dword [esi + 0x10c]
or edx, eax
push 7
push 0xc
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], edx
push eax
call fcn.00472e20
jmp 0x438dc1
cmp dword [edi], 0
jne 0x438bb4
mov byte [esi + 0x4e8], 1
jmp 0x438dd1
xor al, al
mov edx, 0x2400
mov dword [esp + 0x10], edx
cmp byte [esi + 0x4f8], al
je 0x438d00
push dword [edi]
lea eax, [esp + 0x14]
push dword [esi + 0x37c]
push eax
push dword [esi + 0x380]
call fcn.004a72a0
add esp, 0x10
test eax, eax
je 0x438cfa
push eax
push str.vncclient.cpp_:_Compress_returned_error_in_File_Send_:_d_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
mov byte [esi + 0x4f9], 1
mov ecx, esi
call fcn.00438e00
mov bl, 1
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004aca59
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
mov al, 1
mov ebx, dword [edi]
movzx ecx, al
xor eax, eax
cmp edx, ebx
mov dword [esp + 0x18], 0x1000000
mov word [esp + 0x24], 0x507
cmova ecx, eax
test cl, cl
mov dword [esp + 0x14], ecx
cmovne eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
je 0x438d50
mov ecx, edx
mov eax, edx
shr eax, 0x10
and ecx, 0xff0000
or ecx, eax
mov eax, edx
shl eax, 0x10
and edx, 0xff00
or eax, edx
shr ecx, 8
shl eax, 8
jmp 0x438d73
mov ecx, ebx
mov eax, ebx
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
shr ebx, 8
movzx eax, byte [esi + 0x4ef]
and ebx, 0xff00
shl ecx, 8
or ecx, ebx
or ecx, eax
lea eax, [esp + 0x24]
push 7
push 0xc
mov dword [esp + 0x34], ecx
mov ecx, dword [esi + 0x10c]
push eax
call fcn.00472e70
test eax, eax
setne bl
test bl, bl
je 0x438dc1
cmp byte [esp + 0x14], 0
mov ecx, dword [esi + 0x10c]
je 0x438daf
push dword [esp + 0x10]
push dword [esi + 0x380]
jmp 0x438db7
push dword [edi]
push dword [esi + 0x37c]
call fcn.00472ec0
test eax, eax
setne bl
mov eax, dword [edi]
add dword [esi + 0x4f0], eax
test bl, bl
je 0x438cd0
mov ecx, dword [0x503c60]
mov edx, esi
push 0
call fcn.00470190
add esp, 4
jmp 0x438cd0