Function at 0x46bb10
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681c2a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x190
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x181], dl
mov eax, ecx
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x190], 0xffffffff
lea eax, [ebp - 0x198]
mov dword [ebp - 4], 0
push 0
push eax
mov edx, 0x6f8b80
mov dword [ebp - 0x198], 0x1a
lea ecx, [ebp - 0xf8]
call fcn.00471970
add esp, 8
cmp byte [ebp - 0x181], 0
mov edx, str.Yandexui
mov eax, str.Yandexui_yd2
mov byte [ebp - 4], 1
cmove edx, eax
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46bbd0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xf8]
call fcn.00459fe0
mov dword [ebp - 0xd0], 0
xor ecx, ecx
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x19c], 0x18
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 3
call fcn.00453390
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push 0x80
cmovae eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0x190]
push 3
push 1
push SysReAllocString
push eax
call fcn.004647e0
test eax, eax
je 0x46bd27
mov esi, dword [ebp - 0x190]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x26
jne 0x46bd27
push ecx
lea eax, [ebp - 0x189]
mov byte [ebp - 0x189], 0
push eax
push 0x26
lea ecx, [ebp - 0xbc]
call fcn.004685f0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xb8]
mov edi, dword [ebp - 0xbc]
sub eax, edi
mov dword [ebp - 0x188], eax
je 0x46bdb5
push 0
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x198], 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46bdaf
mov byte [ebp - 4], 3
test edi, edi
je 0x46bd27
mov ecx, dword [ebp - 0xb4]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x46bd1d
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c161
push ecx
push edi
call fcn.00611704
add esp, 8
cmp dword [ebp - 0xcc], 8
lea eax, [ebp - 0xe0]
push 2
cmovae eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0x190]
push 2
push 0
push 0x40000000
push eax
call fcn.004647e0
mov esi, dword [ebp - 0x190]
test eax, eax
je 0x46bf84
lea eax, [ebp - 0xc0]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0xc0], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x40
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x198], edi
test edi, edi
je 0x46c166
jmp 0x46be8a
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
cmp edi, dword [ebp - 0xb8]
je 0x46bde5
push eax
push edi
lea ecx, [ebp - 0xb0]
call fcn.0044fad0
mov ecx, dword [ebp - 0x194]
lea edx, [ebp - 0xb0]
mov byte [ebp - 4], 5
call fcn.0046b9c0
mov edx, dword [ebp - 0x9c]
cmp edx, 0x10
jb 0x46be34
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46be2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c170
push edx
push ecx
call fcn.00611704
add esp, 8
test edi, edi
je 0x46be68
mov ecx, dword [ebp - 0xb4]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x46be5e
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c175
push ecx
push edi
call fcn.00611704
add esp, 8
lea ecx, [ebp - 0xe0]
call fcn.00453390
cmp esi, 0xffffffff
je 0x46be7f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x194]
jmp 0x46c143
push edi
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 6
call fcn.0046c290
mov byte [ebp - 4], 7
mov edx, dword [eax]
mov ecx, edx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
lea eax, [ecx + 1]
mov dword [ebp - 0x188], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46bec6
sub ecx, dword [ebp - 0x188]
push ecx
push edx
lea ecx, [ebp - 0xb0]
call fcn.0044fad0
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x17c]
cmp eax, ecx
je 0x46bef9
push eax
call fcn.00659210
add esp, 4
push edi
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x9c], 0x10
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0xa0]
cmovae eax, dword [ebp - 0xb0]
test ecx, ecx
je 0x46bfad
push 0
lea edx, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46bfad
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x9c]
cmp edx, 0x10
jb 0x46bf84
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46bf7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c17a
push edx
push ecx
call fcn.00611704
add esp, 8
cmp byte [ebp - 0x181], 0
je 0x46c01a
mov edx, 0x79d9ac
lea ecx, [ebp - 0xc8]
call fcn.0046b9c0
mov ecx, eax
mov eax, 0x1a
jmp 0x46c031
mov edi, dword [ebp - 0x194]
lea edx, [ebp - 0xb0]
mov ecx, edi
call fcn.0046b9c0
mov edx, dword [ebp - 0x9c]
cmp edx, 0x10
jb 0x46bffa
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46bff0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c17f
push edx
push ecx
call fcn.00611704
add esp, 8
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
jmp 0x46c12a
mov edx, 0x79d9c4
lea ecx, [ebp - 0xb0]
call fcn.0046b9c0
mov ecx, eax
mov eax, 0x1c
mov edi, dword [ebp - 0x194]
or eax, 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [edi], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
test al, 4
je 0x46c0d1
mov edx, dword [ebp - 0x9c]
and eax, 0xfffffffb
mov dword [ebp - 0x188], eax
cmp edx, 0x10
jb 0x46c0b6
mov ecx, dword [ebp - 0xb0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46c0a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c184
push edx
push ecx
call fcn.00611704
mov eax, dword [ebp - 0x188]
add esp, 8
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
test al, 2
je 0x46c12a
mov edx, dword [ebp - 0xb4]
cmp edx, 0x10
jb 0x46c10f
mov ecx, dword [ebp - 0xc8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46c105
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c189
push edx
push ecx
call fcn.00611704
add esp, 8
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
lea ecx, [ebp - 0xe0]
call fcn.00453390
cmp esi, 0xffffffff
je 0x46c141
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006116c3
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00655e38
push 0x8007000e
call fcn.0046abb0
call fcn.00655e38
call fcn.00655e38
call fcn.00655e38
call fcn.00655e38
call fcn.00655e38
call fcn.00655e38
int3