Function at 0x424741
Capabilities:
Clear file content
Execute anti-debugging instructions
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20170
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov dword [ebp - 0x20124], eax
mov dword [ebp - 0x2014c], esi
mov dword [ebp - 0x20138], ebx
mov dword [ebp - 0x20134], ebx
mov dword [ebp - 0x20130], ebx
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
mov dword [ebp - 0x20170], eax
call fcn.0043dd77
push ebx
push esi
mov dword [0x4cd2c0], 0xf4240
call fcn.0041fd96
mov esi, eax
lea ecx, [ebp - 0x108]
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
inc esi
cmp al, bl
jne 0x4247ad
mov edi, dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
push ebx
mov esi, 0x8000000
push esi
push 3
push ebx
push 1
push Ordinal_2
lea eax, [ebp - 0x108]
push eax
call edi
mov dword [0x4cce9c], eax
cmp eax, 0xffffffff
jne 0x42480c
push dword [ebp - 0x2014c]
push 0x46cf34
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xd6b
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
push 1
call fcn.00451974
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call fcn.0043deb7
push ebx
push esi
push 2
push ebx
push 3
push 0xc0000000
push dword [ebp - 0x20124]
call edi
mov dword [0x4cce98], eax
cmp eax, 0xffffffff
jne 0x42484e
push dword [ebp - 0x20124]
push 0x46e72c
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xd78
jmp 0x4247f8
rdtsc
mov dword [ebp - 0x20128], edx
mov dword [ebp - 0x2012c], eax
cmp dword [0x4cddd0], ebx
jne 0x42489c
push ebx
lea eax, [ebp - 0x2011c]
push eax
push 0x10000
mov esi, 0x4bce3c
push esi
push dword [0x4cce9c]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
je 0x424fd8
cmp dword [ebp - 0x2011c], ebx
je 0x424fd8
jmp 0x424b58
cmp dword [0x4d659c], 1
je 0x424fd8
lea eax, [ebp - 0x2011c]
push eax
push 0xc
lea eax, [ebp - 0x20114]
push eax
or esi, 0xffffffff
push esi
push esi
push dword [0x4cce9c]
call fcn.0043deb7
test eax, eax
je 0x424fd8
mov eax, dword [ebp - 0x20114]
cmp eax, 0x5458454e
jne 0x424a6d
push dword [0x4cce9c]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
inc dword [ebp - 0x20130]
push dword [ebp - 0x20130]
push dword [ebp - 0x2014c]
call fcn.0041fd96
lea esi, [ebp - 0x108]
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x42490d
push dword [ebp - 0x20130]
push dword [ebp - 0x2014c]
call fcn.0041fd96
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x424930
mov esi, 0x469ec0
push ebx
push ebx
push 3
push ebx
push 1
push Ordinal_2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov dword [0x4cce9c], eax
cmp eax, 0xffffffff
jne 0x424976
lea eax, [ebp - 0x108]
push eax
push 0x46cf20
call fcn.0042f614
pop ecx
jmp 0x4249c5
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call fcn.0043deb7
lea eax, [ebp - 0x2011c]
push eax
push 0xc
lea eax, [ebp - 0x20114]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4cce9c]
call fcn.0043deb7
test eax, eax
jne 0x4249ab
push str.cant_read__no_continuation_header_found
jmp 0x4249c0
cmp dword [ebp - 0x20114], 0x4f434e53
je 0x424a56
push 0x46ced4
call fcn.0042f614
pop ecx
cmp eax, ebx
je 0x424a56
cmp dword [0x4cddcc], ebx
je 0x424f8b
push dword [ebp - 0x20130]
push dword [ebp - 0x2014c]
call fcn.0041fd96
push 0x2e
push eax
call fcn.00452730
mov edi, eax
push edi
push 0x46ced0
call fcn.0042f614
add esp, 0x10
push eax
push edi
push ebx
push esi
push 0x46ceb4
call fcn.0042f614
add esp, 0x10
push eax
push dword [ebp - 0x20130]
push dword [ebp - 0x2014c]
call fcn.0041fd96
push eax
push esi
push 0x46cea4
call fcn.0042f614
add esp, 0xc
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push dword [0x4d617c]
call fcn.00449908
test eax, eax
jne 0x42493f
jmp 0x424fd8
lea eax, [ebp - 0x20114]
push eax
push dword [0x4cce9c]
call fcn.0043e4ba
jmp 0x42484e
cmp eax, 0x4f434e53
je 0x424a56
cmp eax, 0x304f4e53
je 0x424a56
cmp eax, 0x5f444e45
je 0x424fd8
cmp eax, 0x45544e53
je 0x424a56
cmp eax, 0x49524453
je 0x424a56
cmp eax, 0x30564e53
jne 0x424afd
lea eax, [ebp - 0x20124]
push eax
lea eax, [ebp - 0x20114]
push eax
push dword [0x4cce9c]
mov dword [ebp - 0x20124], ebx
call fcn.0043e520
mov eax, dword [ebp - 0x20124]
push ebx
push dword [eax + 0x4b]
push dword [eax + 0x47]
push dword [0x4cce98]
call fcn.0044df99
push dword [0x4cce98]
call dword [sym.imp.___total_physical_size__lu_MB_SetEndOfFile]
push ebx
push ebx
push ebx
push dword [0x4cce98]
call fcn.0044df99
push dword [ebp - 0x20124]
call fcn.0045038b
pop ecx
jmp 0x42484e
cmp eax, 0x30444e53
jne 0x424fb3
cmp dword [ebp - 0x20110], 0x10028
ja 0x424fc0
lea eax, [ebp - 0x2011c]
push eax
push dword [ebp - 0x20110]
push 0x4bce28
push esi
push esi
push dword [0x4cce9c]
call fcn.0043deb7
test eax, eax
je 0x424fd8
mov eax, dword [0x4bce34]
add eax, 0x14
cmp dword [ebp - 0x2011c], eax
jne 0x424fc0
mov esi, 0x4bce3c
lea eax, [ebp - 0x2012c]
push eax
call fcn.0041dfd7
add dword [0x4cce74], eax
mov eax, dword [ebp - 0x2011c]
add dword [0x4cddb0], eax
mov dword [ebp - 0x20118], eax
adc dword [0x4cddb4], ebx
cmp dword [0x4cddd0], ebx
jne 0x424ce5
rdtsc
and dword [0x4ac388], 0xfffffff8
test dword [0x4cd29c], 0x4000
mov dword [ebp - 0x2016c], eax
mov eax, dword [ebp - 0x2011c]
mov dword [ebp - 0x20168], edx
mov dword [ebp - 0x20118], eax
mov dword [ebp - 0x20124], ebx
je 0x424bd0
push 1
push eax
push esi
call fcn.0040b3a7
mov dword [ebp - 0x20124], eax
test byte [0x4cd29c], 1
je 0x424c05
push dword [ebp - 0x2011c]
mov edi, 0x4ac38c
push esi
push dword [ebp - 0x2011c]
push edi
call fcn.004423b7
cmp eax, 0xffffffff
je 0x424c05
or dword [0x4ac388], 1
mov dword [ebp - 0x20118], eax
mov esi, edi
test byte [0x4cd29c], 2
je 0x424c3e
push dword [ebp - 0x20118]
lea eax, [ebp - 0x10108]
push esi
push 0x10000
push eax
call fcn.0041a580
cmp eax, 0xffffffff
je 0x424c3e
or dword [0x4ac388], 2
mov dword [ebp - 0x20118], eax
lea esi, [ebp - 0x10108]
test dword [0x4cd29c], 0x4000
je 0x424c6f
push dword [ebp - 0x20124]
lea eax, [ebp - 0x20118]
push eax
push esi
call fcn.0043e60d
shl eax, 2
xor eax, dword [0x4ac388]
and eax, 4
xor dword [0x4ac388], eax
lea eax, [ebp - 0x2016c]
push eax
call fcn.0041dfd7
mov edi, dword [ebp - 0x20118]
add dword [ebp - 0x20138], eax
mov eax, dword [ebp - 0x2011c]
push edi
adc dword [ebp - 0x20134], ebx
push esi
push 0x4ac38c
mov dword [0x4ac384], edi
mov dword [0x4ac380], eax
call fcn.00451390
add esp, 0xc
push ebx
push ebx
add edi, 0x14
push edi
push 0x4ac378
push 0x30444e53
cmp dword [0x4cd334], ebx
jne 0x424ccc
call fcn.00424096
jmp 0x424cd1
call fcn.00423e7a
cmp eax, ebx
je 0x424805
cmp dword [0x4cddd0], ebx
je 0x424ee6
rdtsc
mov dword [ebp - 0x20140], eax
mov eax, dword [0x4bce34]
xor edi, edi
test byte [0x4bce38], 0x10
mov dword [ebp - 0x2013c], edx
mov dword [ebp - 0x20118], eax
je 0x424d44
rdtsc
push dword [0x4bce28]
mov ecx, 0x4a301c
push dword [0x4bce34]
mov dword [ebp - 0x20160], edx
push 0x4bce3c
mov dword [ebp - 0x20164], eax
call fcn.0040d3e2
lea eax, [ebp - 0x20164]
push eax
call fcn.0041dfd7
add dword [0x4cce84], eax
test byte [0x4bce38], 4
je 0x424d5c
lea eax, [ebp - 0x20118]
push eax
push esi
call fcn.0043e636
mov edi, eax
test byte [0x4bce38], 2
je 0x424d9e
rdtsc
mov dword [ebp - 0x2015c], eax
push esi
lea eax, [ebp - 0x20108]
push eax
mov dword [ebp - 0x20158], edx
call fcn.0041a030
mov dword [ebp - 0x20118], eax
lea eax, [ebp - 0x2015c]
push eax
lea esi, [ebp - 0x20108]
call fcn.0041dfd7
add dword [0x4bcb84], eax
test byte [0x4bce38], 1
je 0x424ddf
rdtsc
push dword [ebp - 0x20118]
mov dword [ebp - 0x20150], edx
push esi
mov esi, 0x4ac38c
push esi
mov dword [ebp - 0x20154], eax
call fcn.0044283b
mov dword [ebp - 0x20118], eax
lea eax, [ebp - 0x20154]
push eax
call fcn.0041dfd7
add dword [0x4cce94], eax
mov eax, dword [ebp - 0x20118]
cmp eax, dword [0x4bce30]
je 0x424dfe
push str.BytesToWrite___Input.DH.ExpandedSize_n
call fcn.00450f5c
pop ecx
call dword [sym.imp.___total_physical_size__lu_MB_DebugBreak]
test byte [0x4bce38], 4
je 0x424e2a
push 1
push dword [ebp - 0x20118]
push esi
call fcn.0040b3a7
cmp eax, edi
je 0x424e2a
push str.PackChecksum_BufferToWrite_BytesToWrite____UncompressedChecksum_n
call fcn.00450f5c
pop ecx
call dword [sym.imp.___total_physical_size__lu_MB_DebugBreak]
lea eax, [ebp - 0x20140]
push eax
call fcn.0041dfd7
add dword [ebp - 0x20138], eax
mov eax, dword [0x4bce28]
adc dword [ebp - 0x20134], ebx
or eax, dword [0x4bce2c]
jne 0x424e6e
mov al, byte [esi]
cmp al, 0xeb
je 0x424e59
cmp al, 0xe9
jne 0x424e6e
cmp byte [esi + 0x1fe], 0x55
jne 0x424e6e
cmp byte [esi + 0x1ff], 0xaa
jne 0x424e6e
mov dword [esi + 0x1c], ebx
rdtsc
mov ecx, dword [0x4bce2c]
mov dword [ebp - 0x20148], eax
mov eax, dword [0x4bce28]
mov dword [ebp - 0x20144], edx
mov edx, eax
or edx, ecx
je 0x424e9b
push ebx
push ecx
push eax
push dword [0x4cce98]
call fcn.0044df99
push ebx
lea eax, [ebp - 0x20120]
push eax
push dword [ebp - 0x20118]
push esi
push dword [0x4cce98]
call dword [sym.imp.___total_physical_size__lu_MB_WriteFile]
lea eax, [ebp - 0x20148]
push eax
call fcn.0041dfd7
add dword [0x4bcbec], eax
mov eax, dword [ebp - 0x20120]
cmp eax, dword [ebp - 0x20118]
jne 0x4250bb
add dword [0x4bcb78], eax
adc dword [0x4bcb7c], ebx
push 0x3e8
push 0x4ce0cc
call fcn.004430f8
test eax, eax
je 0x42484e
push dword [0x4cddb4]
push dword [0x4cddb0]
push str.read__I64u
call fcn.00450f5c
mov eax, dword [0x4cce74]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
mov edi, str.__ums_
push eax
push edi
call fcn.00450f5c
push dword [0x4bcb7c]
push dword [0x4bcb78]
push str._written__I64u
call fcn.00450f5c
mov eax, dword [0x4bcbec]
xor edx, edx
mov ecx, esi
div ecx
push eax
push edi
call fcn.00450f5c
add esp, 0x28
push ebx
push esi
push dword [ebp - 0x20134]
push dword [ebp - 0x20138]
call fcn.004544c0
push edx
push eax
push str.___de_compressing__ums
call fcn.00450f5c
push 0x46b764
call fcn.00450f5c
add esp, 0x10
jmp 0x42484e
push eax
lea eax, [ebp - 0x108]
push eax
push 0x470d90
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xdba
push str.NTCOPY
call fcn.0044dc85
add esp, 0x18
jmp 0x424fd8
push str.illegal_header_or_unexpected_end_of_file_a_n
call fcn.00450f5c
pop ecx
jmp 0x424fd8
push dword [ebp - 0x20110]
push str.illegal_header_size__x_a_n
call fcn.00450f5c
pop ecx
pop ecx
call dword [sym.imp.___total_physical_size__lu_MB_DebugBreak]
cmp dword [0x4cddd0], ebx
jne 0x424fe6
push ebx
call fcn.00423da9
mov eax, dword [0x4cce9c]
or esi, 0xffffffff
cmp eax, esi
je 0x424fff
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov dword [0x4cce9c], esi
mov eax, dword [0x4cce98]
cmp eax, esi
je 0x425015
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov dword [0x4cce98], esi
push dword [0x4cddb4]
push dword [0x4cddb0]
push str.read__I64u
call fcn.00450f5c
mov eax, dword [0x4cce74]
mov esi, 0x3e8
xor edx, edx
mov ecx, esi
div ecx
mov edi, str.__ums_
push eax
push edi
call fcn.00450f5c
push dword [0x4bcb7c]
push dword [0x4bcb78]
push str._written__I64u
call fcn.00450f5c
mov eax, dword [0x4bcbec]
xor edx, edx
mov ecx, esi
div ecx
push eax
push edi
call fcn.00450f5c
add esp, 0x28
push ebx
push esi
push dword [ebp - 0x20134]
push dword [ebp - 0x20138]
call fcn.004544c0
push edx
push eax
push str.___de_compressing__ums
call fcn.00450f5c
push 0x46a57c
call fcn.00450f5c
add esp, 0x10
call dword [sym.imp.___total_physical_size__lu_MB_GetTickCount]
sub eax, dword [ebp - 0x20170]
push eax
push str._ntotal_time_used__ums_n
call fcn.00450f5c
pop ecx
pop ecx
xor eax, eax
jmp 0x4250ed
mov eax, dword [0x4cce9c]
or esi, 0xffffffff
cmp eax, esi
je 0x4250d4
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov dword [0x4cce9c], esi
mov eax, dword [0x4cce98]
cmp eax, esi
je 0x4250ea
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
mov dword [0x4cce98], esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 8