Function at 0x4c70fb
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4c7102
call fcn.005873a0
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.004fc000
mov dword [section..data], 0x500a26
mov dword [section..data], 0x500a48
mov dword [esp + 8], 0xfffffc17
mov dword [section..data], 0x500a4e
mov dword [section..data], 0x500a50
push edx
call fcn.00587290
pop edx
push eax
push 2
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Check_if_file__
push edx
call fcn.00587330
mov edx, dword [esp + 0xc]
push edx
call fcn.00587330
mov edx, str.__is_encrypted__UDF__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x40]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6e4b38
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.004fc302
add dword [esp + 8], edx
call fcn.0049e102
call fcn.004fc320
mov dword [section..data], 0x500a52
mov ebx, dword [esp + 0x2c]
and ebx, ebx
jne 0x4c7607
mov dword [section..data], 0x500a54
push dword [esp]
call fcn.00578e8f
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4c720d
jl 0x4c7209
cmp ebx, 0
ja 0x4c720d
xor eax, eax
jmp 0x4c7212
mov eax, 1
or eax, eax
jne 0x4c725d
mov dword [section..data], 0x500a55
push 3
mov eax, str.Error___Filesize
push eax
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.0049e102
mov dword [section..data], 0x500a56
mov dword [esp + 8], 0xfffffc15
mov dword [section..data], 0x500a57
jmp 0x4c7861
mov dword [section..data], 0x500a58
mov dword [section..data], 0x500a5a
push 0
push 0
push 3
push 0
push 3
push closesocket
push dword [esp + 0x18]
call sub.KERNEL32.dll_CreateFileW
mov dword [esp + 4], eax
mov dword [section..data], 0x500a5e
cmp dword [esp + 4], 0
je 0x4c72b1
xor eax, eax
jmp 0x4c72b6
mov eax, 1
and eax, eax
je 0x4c737e
mov dword [section..data], 0x500a60
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.CreateFile__failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x18]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, str.__GetLastError__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
call sub.KERNEL32.dll_GetLastError
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.004fc302
add dword [esp + 8], edx
call fcn.0049e102
call fcn.004fc320
mov dword [section..data], 0x500a62
mov dword [esp + 8], 0xfffffc14
mov dword [section..data], 0x500a63
jmp 0x4c7861
mov dword [section..data], 0x500a64
mov dword [section..data], 0x500a66
push 0x10
call fcn.00586c00
mov dword [esp + 0x18], eax
mov dword [section..data], 0x500a67
cmp dword [esp + 0x18], 0
je 0x4c73b5
xor eax, eax
jmp 0x4c73ba
mov eax, 1
and eax, eax
je 0x4c7405
mov dword [section..data], 0x500a68
push 3
mov eax, str.ERROR__AllocateMemory_failed___16_
push eax
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.0049e102
mov dword [section..data], 0x500a69
mov dword [esp + 8], 0xfffffc16
mov dword [section..data], 0x500a6a
jmp 0x4c7861
mov dword [section..data], 0x500a6b
mov dword [section..data], 0x500a70
push 0
lea eax, [esp + 0x10]
push eax
push 0x10
push dword [esp + 0x24]
push dword [esp + 0x14]
call sub.KERNEL32.dll_ReadFile
mov dword [esp + 0x14], eax
mov dword [section..data], 0x500a72
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x4c7553
mov dword [section..data], 0x500a73
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x10], eax
mov dword [section..data], 0x500a74
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.ReadFile___
push edx
call fcn.00587330
mov edx, dword [esp + 0xc]
push edx
call fcn.00587330
mov edx, str.__failed__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x28]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, str.____GetLastError__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x24]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6db8ba
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x20]
call fcn.004c626a
pop eax
mov edx, 0x6bdecc
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.004fc302
add dword [esp + 8], edx
call fcn.0049e102
call fcn.004fc320
mov dword [section..data], 0x500a75
mov dword [esp + 8], 0xfffffc14
mov dword [section..data], 0x500a76
jmp 0x4c7861
mov dword [section..data], 0x500a77
mov dword [section..data], 0x500a79
push edx
call fcn.00587290
pop edx
push eax
push 3
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.Bytes_read__
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
call fcn.00574cc0
pop eax
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.004fc302
add dword [esp + 8], edx
call fcn.0049e102
call fcn.004fc320
mov dword [section..data], 0x500a7b
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x500a7c
mov dword [esp + 4], 0
mov dword [section..data], 0x500a7f
jmp 0x4c777e
mov dword [section..data], 0x500a7f
mov dword [section..data], 0x500a82
push dword [esp]
push dword [esp + 0x30]
call fcn.004173cf
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4c763b
jl 0x4c7637
cmp ebx, 0
ja 0x4c763b
xor eax, eax
jmp 0x4c7640
mov eax, 1
or eax, eax
jne 0x4c768b
mov dword [section..data], 0x500a83
push 3
mov eax, str.Error___Filesize
push eax
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.0049e102
mov dword [section..data], 0x500a84
mov dword [esp + 8], 0xfffffc15
mov dword [section..data], 0x500a85
jmp 0x4c7861
mov dword [section..data], 0x500a86
mov dword [section..data], 0x500a88
push 0x10
push 0
push 0
push dword [esp + 0xc]
push dword [esp + 0x3c]
call fcn.0041963e
mov dword [esp + 0x18], eax
mov dword [section..data], 0x500a89
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jg 0x4c7774
mov dword [section..data], 0x500a8a
push edx
call fcn.00587290
pop edx
push eax
push 0
push edx
call fcn.00587290
pop edx
push eax
mov edx, str.ERROR__ReadFile_failed___
push edx
call fcn.00587330
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 0x28]
call fcn.004134f0
pop eax
mov edx, 0x6bef86
push edx
call fcn.00587330
call fcn.00587380
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.004fc302
add dword [esp + 8], edx
call fcn.0049e102
call fcn.004fc320
mov dword [section..data], 0x500a8b
mov dword [esp + 0x18], 0
mov dword [section..data], 0x500a8c
mov dword [esp + 8], 0xfffffc14
mov dword [section..data], 0x500a8d
jmp 0x4c7861
mov dword [section..data], 0x500a8e
mov dword [section..data], 0x500a91
mov dword [section..data], 0x500a93
mov ebx, dword [esp + 0x18]
add ebx, 4
push ebx
call fcn.00586fc0
mov ebx, eax
cmp ebx, 0x47
je 0x4c77ea
mov dword [section..data], 0x500a94
push 1
mov eax, str.ERROR__File_is_invalid__No_SYNC_byte_found_
push eax
mov eax, str.BRAACS_IsFileEncryptedv2
push eax
mov eax, 0x6eea4e
push eax
call fcn.0049e102
mov dword [section..data], 0x500a95
mov dword [esp + 8], 0xfffffc08
mov dword [section..data], 0x500a96
jmp 0x4c7861
mov dword [section..data], 0x500a97
mov dword [section..data], 0x500a9b
push dword [esp + 0x18]
call fcn.00586fc0
mov ebx, eax
and ebx, 0xc0
and ebx, ebx
je 0x4c7831
mov dword [section..data], 0x500a9d
mov dword [esp + 8], 2
mov dword [section..data], 0x500a9e
jmp 0x4c784d
mov dword [section..data], 0x500a9e
mov dword [section..data], 0x500aa0
mov dword [esp + 8], 1
mov dword [section..data], 0x500aa1
mov dword [section..data], 0x500aa3
mov dword [section..data], 0x500aa5
cmp dword [esp + 0x18], 0
je 0x4c7885
mov dword [section..data], 0x500aa6
push dword [esp + 0x18]
call fcn.00586d50
mov dword [section..data], 0x500aa7
mov dword [section..data], 0x500aa9
cmp dword [esp + 4], 0
je 0x4c78b3
mov dword [section..data], 0x500aaa
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [section..data], 0x500aab
mov dword [section..data], 0x500aad
mov eax, dword [esp + 8]
jmp 0x4c78d9
push dword [esp]
call fcn.00587410
add esp, 0x1c
pop edi
pop ebx
ret 8