Function at 0x404f91
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
mov ebx, eax
push edi
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x404fa8
mov edi, dword [ebx + 0x14]
mov esi, dword [ebx + 8]
test esi, esi
je 0x404fc5
call fcn.00406901
push edi
push eax
push 0x1011
call fcn.00405c7a
add esp, 0xc
jmp 0x404fd2
push edi
push 0x1012
call fcn.00405c7a
pop ecx
pop ecx
push 0x101d
call fcn.00405c7a
mov edi, dword [ebx + 0x14]
pop ecx
push edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
push 0x2a
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
push 7
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
push 0xc0100080
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x58], ecx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jns 0x405048
push 0x1013
call fcn.00405c7a
pop ecx
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.00405cc4
jmp 0x4052e0
push 0x4010f0
push edi
lea ebx, [ebp - 0x28]
call fcn.0040685c
mov esi, eax
test esi, esi
jns 0x405079
push 0x1014
call fcn.00405c7a
pop ecx
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.00405cc4
jmp 0x4052cc
push dword [ebp - 0x28]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x4021
xor ebx, ebx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x58], eax
push ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x100000
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ntdll.dll_NtOpenFile]
push dword [ebp - 0x28]
mov esi, eax
call fcn.00405b38
test esi, esi
jns 0x4050d7
push 0x1015
jmp 0x405061
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00404c26
push dword [ebp - 0x2c]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x405100
push 0x1016
jmp 0x405061
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x14]
mov ecx, dword [0x4151e0]
mov edx, 0x200
cmp edi, 1
jne 0x40512f
cmp esi, edx
je 0x405143
push 0x108b
call fcn.00405c7a
pop ecx
mov esi, 0xc0000001
jmp 0x4052cc
cmp edi, 3
jne 0x405143
cmp ecx, 0x40e330
jne 0x405143
push 0x108c
jmp 0x40511f
mov eax, edi
sub eax, ebx
je 0x405180
dec eax
je 0x405173
dec eax
je 0x405166
dec eax
je 0x405159
push 0x1017
jmp 0x40511f
mov ecx, dword [ecx + 0x10]
mov eax, 0x600
mov dword [ebp - 0x20], eax
jmp 0x405187
mov ecx, dword [ecx + 8]
mov eax, 0x2000
mov dword [ebp - 0x20], eax
jmp 0x405187
mov ecx, dword [ecx + 4]
mov eax, 0x600
mov dword [ebp - 0x20], eax
jmp 0x405187
mov ecx, dword [ecx]
mov eax, edx
mov dword [ebp - 0x20], edx
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [ebp - 0x1c], eax
div esi
test edx, edx
je 0x4051a1
mov ecx, dword [ebp - 0x20]
sub ecx, edx
add ecx, esi
mov dword [ebp - 0x1c], ecx
cmp edi, 3
jne 0x4051ae
mov ecx, esi
imul ecx, ecx, 0x18
mov dword [ebp - 0x1c], ecx
lea eax, [ecx + esi]
push eax
call fcn.00405b16
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4051d3
push 0x1018
call fcn.00405c7a
pop ecx
mov esi, 0xc000009a
jmp 0x4052cc
push ebx
push esi
push ebx
push eax
call fcn.0040db80
mov esi, dword [ebp - 0x28]
test eax, eax
je 0x4051e8
sub esi, eax
add esi, dword [ebp - 0x14]
push 0x90018
push dword [ebp - 0xc]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 5], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
call fcn.00404d24
test eax, eax
jns 0x40521d
cmp byte [ebp + 8], bl
jne 0x405219
mov byte [ebp - 6], 1
mov dword [ebp - 0x34], eax
jmp 0x405254
mov byte [ebp - 5], 1
push 0x90020
push dword [ebp - 0xc]
call fcn.00404d24
test eax, eax
jns 0x405237
mov byte [ebp - 7], 1
mov dword [ebp - 0x38], eax
jmp 0x405254
cmp byte [ebp - 5], 1
jne 0x405254
push 0x101e
call fcn.00405c7a
mov dword [esp], 0x101d
call fcn.00405c7a
pop ecx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40526c
push 0x1019
jmp 0x405294
push ebx
lea eax, [ebp - 0x10]
push eax
cmp edi, 3
jne 0x4052e9
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40528f
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], eax
je 0x4052ff
push 0x101a
call fcn.00405c7a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00405cc4
mov esi, 0xc0000001
cmp byte [ebp - 5], 0
jne 0x4052c4
cmp byte [ebp - 6], 0
jne 0x4052c4
push 0x9001c
push dword [ebp - 0xc]
call fcn.00404d24
push dword [ebp - 0x28]
call fcn.00405b38
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x101d
call fcn.00405c7a
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
push dword [ebp - 0x14]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40528f
mov eax, dword [ebp - 0x14]
jmp 0x40528a
mov ecx, ebx
test edi, edi
js 0x40531f
cmp edi, 1
jle 0x405318
cmp edi, 2
je 0x4053dc
cmp edi, 3
jne 0x40531f
movzx ecx, byte [esi + 1]
add ecx, 2
cmp edi, 3
jne 0x4053ef
mov edi, dword [ebp - 0x18]
mov eax, 0x200
sub eax, ecx
push eax
lea eax, [ecx + edi]
push eax
lea eax, [ecx + esi]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
lea esi, [edi + 0x200]
lea edi, [edx + eax]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
add esi, 0x400
lea edi, [edx + eax*2]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
imul ecx, ecx, 0xb
add esp, 0xc
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x4053ab
cmp esi, 0x6a
je 0x4053a0
cmp esi, 0x6b
je 0x4053a0
cmp esi, 0x70
je 0x4053a0
movzx ecx, byte [esi + edx]
mov eax, edi
shr eax, 1
add ecx, eax
shl edi, 0x1f
add edi, ecx
mov ecx, dword [ebp + 8]
inc esi
cmp esi, ecx
jb 0x40537f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov esi, dword [ebp - 0x24]
imul eax, eax, 0xc
mov dword [ebp - 0x18], eax
cmp ecx, eax
jae 0x4053cd
lea edi, [ecx + esi]
mov ecx, eax
sub ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
dec ecx
shr ecx, 2
inc ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
push eax
add eax, esi
push esi
push eax
call sub.msvcrt.dll_memcpy
mov edi, dword [ebp - 0x30]
jmp 0x405404
cmp dword [0x4151e0], 0x40e344
push 0x54
pop ecx
je 0x4053ef
mov byte [esi + 0x24], 0x80
mov eax, dword [ebp - 0x20]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x18]
add eax, ecx
push eax
lea eax, [ecx + esi]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x405265
push ebx
lea eax, [ebp - 0x10]
push eax
cmp edi, 1
jne 0x40548c
push 0x200
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405482
cmp dword [ebp - 0x10], 0x200
jne 0x405482
push ebx
push ebx
push 0x1800
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x405265
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x200
lea eax, [esi + 0x400]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405482
cmp dword [ebp - 0x10], 0x200
je 0x4054a5
push 0x101b
jmp 0x405294
push dword [ebp - 0x1c]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405482
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], eax
jne 0x405482
mov esi, ebx
sub edi, ebx
je 0x4054c9
dec edi
je 0x4054c2
dec edi
je 0x4054bb
dec edi
jne 0x4054ce
mov ebx, 0x4011ec
jmp 0x4054ce
mov ebx, 0x4011d4
jmp 0x4054ce
mov ebx, 0x4011c8
jmp 0x4054ce
mov ebx, 0x4011c0
cmp byte [ebp - 6], 1
push ebx
jne 0x4054e6
push 0x101f
call fcn.00405c7a
pop ecx
pop ecx
push dword [ebp - 0x34]
jmp 0x4054fb
cmp byte [ebp - 7], 1
jne 0x40550c
push 0x1020
call fcn.00405c7a
pop ecx
pop ecx
push dword [ebp - 0x38]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.00405cc4
jmp 0x4052ab
push 0x101c
call fcn.00405c7a
pop ecx
pop ecx
jmp 0x4052ab