Function at 0x412fc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xb0
push ebx
push ebp
push edi
xor ebp, ebp
push 0x41
lea eax, [esp + 0x38]
push ebp
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
call fcn.004030b0
push 0x41
lea ecx, [esp + 0x88]
push ebp
push ecx
call fcn.004030b0
mov edx, dword [esp + 0xdc]
movzx ebx, word [edx + 0x406]
mov edi, dword [esp + 0xd8]
add esp, 0x18
mov eax, ebx
sar eax, 8
push edi
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], bl
call sub.HID.DLL_HidD_FlushQueue
test al, al
jne 0x41302e
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xb0
ret 0xc
push esi
push ebp
xor eax, eax
push 1
push 1
push ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
cmp bx, bp
mov dword [esp + 0x30], eax
jle 0x413149
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esp + 0x18]
mov edx, ecx
sar edx, 8
cmp bx, 0x3a
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3c], cl
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0x3a
jg 0x4130df
mov byte [esp + 0x3e], bl
movsx eax, bx
push eax
movsx eax, cx
add eax, dword [esp + 0xcc]
lea ecx, [esp + 0x43]
push eax
push ecx
call fcn.00403330
mov edx, dword [esp + 0xd4]
add esp, 0xc
cmp byte [edx + 1], 0x47
je 0x4130e6
mov eax, dword [esp + 0xcc]
push 0x40
push eax
lea ecx, [esp + 0x85]
push ecx
lea edx, [esp + 0x45]
push edx
mov dword [esp + 0x2c], 1
call fcn.00412ec0
add esp, 0x10
lea edx, [esp + 0x7c]
jmp 0x4130ee
mov eax, 0x3a
jmp 0x41308c
mov dword [esp + 0x1c], ebp
lea edx, [esp + 0x38]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x41
push edx
push edi
call esi
test eax, eax
jne 0x413113
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x4132b3
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
cmp bx, 0x3a
jle 0x413149
add dword [esp + 0x18], 0x3a
sub ebx, 0x3a
cmp bx, bp
jg 0x413064
movzx eax, byte [esp + 0x39]
shl eax, 8
or eax, 0x3a
mov byte [esp + 0x3a], 0x3a
jle 0x41326b
mov bp, word [esp + 0x10]
mov esi, dword [esp + 0x1c]
cmp esi, 1
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x41
lea eax, [esp + 0x88]
je 0x413184
lea eax, [esp + 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4131a1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x4132ae
mov ecx, dword [esp + 0x30]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x4132ae
push 1
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
test eax, eax
je 0x4132ae
cmp esi, 1
jne 0x4131f5
mov ecx, dword [esp + 0xcc]
push 0x40
push ecx
lea edx, [esp + 0x41]
push edx
lea eax, [esp + 0x89]
push eax
call fcn.00412f40
add esp, 0x10
movzx dx, byte [esp + 0x3c]
xor ecx, ecx
mov ch, byte [esp + 0x3b]
or cx, dx
movzx eax, cx
cmp ax, 0x400
jae 0x4132ae
mov bl, byte [esp + 0x3e]
movzx esi, bl
movsx edx, ax
mov eax, dword [esp + 0xc8]
push esi
lea ecx, [esp + 0x43]
push ecx
lea ecx, [edx + eax + 6]
push ecx
call fcn.00403330
mov dl, byte [esp + esi + 0x49]
mov al, byte [esp + esi + 0x4a]
mov byte [esp + 0x40], dl
movzx edx, byte [esp + 0x45]
movzx cx, bl
mov byte [esp + 0x24], al
movzx eax, byte [esp + 0x46]
add bp, cx
shl edx, 8
movsx ecx, bp
or edx, eax
add esp, 0xc
cmp ecx, edx
jl 0x413164
mov word [esp + 0x10], bp
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0x18]
add edx, 0xfffffffe
mov word [eax + 0x408], dx
mov edx, dword [esp + 0x34]
push ecx
push edx
call fcn.00412e50
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov word [esp + 0x10], bp
mov esi, 0xf0000003
jmp 0x413294