Function at 0x426ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c6778
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4ea5e0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov eax, dword [0x4ea5e0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
mov dword [esp + 0x18], edi
mov byte [esp + 0x16], 1
call edx
mov ebx, eax
push ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x65
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x48], 0
cmp byte [edi + 0x4fe], 0
je 0x426cb0
cmp byte [edi + 0x4ec], 0
jne 0x426ca9
cmp byte [edi + 0x4fd], 0
jne 0x426ca9
mov eax, dword [edi + 0x380]
mov ecx, dword [edi + 0x4e8]
push 0
lea esi, [edi + 0x4f0]
push esi
push 0x2000
push eax
push ecx
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x426c38
cmp dword [esi], eax
je 0x426b86
mov byte [edi + 0x4fd], 1
mov ecx, dword [edi + 0x500]
test ecx, ecx
je 0x426c51
mov eax, dword [edi + 0x504]
cmp eax, dword [edi + 0x508]
jge 0x426c51
mov ebx, dword [eax + ecx]
test ebx, ebx
je 0x426c4d
push 0
add eax, 4
push 0
push 0
mov dword [edi + 0x504], eax
call fcn.004922b0
mov edx, dword [esi]
mov ecx, dword [edi + 0x380]
add esp, 0xc
push edx
push ecx
push eax
call fcn.004922b0
add esp, 0xc
cmp eax, ebx
jne 0x426c4d
mov eax, dword [esi]
mov edx, eax
mov esi, eax
shl edx, 0x10
and esi, 0xff00
or edx, esi
shr eax, 8
shl edx, 8
and eax, 0xff00
or edx, eax
movzx eax, byte [edi + 0x4f3]
or edx, eax
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x18]
mov esi, dword [edx + 0x10c]
mov cl, 7
mov edi, 0xc
lea ebx, [esp + 0x2c]
mov word [esp + 0x2c], 0x507
mov dword [esp + 0x30], 0x2000000
call fcn.00460910
jmp 0x426dba
cmp dword [esi], 0
jne 0x426b86
mov byte [edi + 0x4ec], 1
jmp 0x426dd3
mov ebx, dword [esp + 0x24]
cmp byte [edi + 0x4fc], 0
mov eax, 0x2400
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], 0
je 0x426ce0
mov eax, dword [esi]
mov ecx, dword [edi + 0x380]
push eax
mov eax, dword [edi + 0x384]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call fcn.00492670
add esp, 0x10
test eax, eax
je 0x426cd7
push eax
push str.vncclient.cpp_:_Compress_returned_error_in_File_Send_:_d_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
mov byte [edi + 0x4fd], 1
mov ecx, edi
call fcn.00426e00
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x17], 1
mov esi, dword [esi]
cmp eax, esi
jbe 0x426ceb
mov byte [esp + 0x17], 0
mov dl, byte [esp + 0x17]
movzx ebx, dl
neg ebx
sbb ebx, ebx
and ebx, 0x1000000
mov cl, 7
mov word [esp + 0x2c], 0x507
mov dword [esp + 0x30], ebx
test dl, dl
je 0x426d36
mov edx, eax
mov esi, eax
shr esi, 0x10
and edx, 0xff0000
or edx, esi
mov esi, eax
shl esi, 0x10
and eax, 0xff00
or esi, eax
shr edx, 8
shl esi, 8
or edx, esi
mov dword [esp + 0x34], edx
jmp 0x426d60
mov eax, esi
mov edx, esi
shl eax, 0x10
and edx, 0xff00
or eax, edx
movzx edx, byte [edi + 0x4f3]
shr esi, 8
shl eax, 8
and esi, 0xff00
or eax, esi
or eax, edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov esi, dword [eax + 0x10c]
mov edi, 0xc
lea ebx, [esp + 0x2c]
call fcn.00460960
test eax, eax
setne al
mov byte [esp + 0x16], al
test al, al
je 0x426dba
cmp byte [esp + 0x17], 0
mov edx, dword [esp + 0x18]
je 0x426d9c
mov ecx, dword [esp + 0x1c]
mov eax, dword [edx + 0x384]
jmp 0x426da8
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx]
mov eax, dword [edx + 0x380]
mov edx, dword [edx + 0x10c]
call fcn.004609b0
test eax, eax
setne byte [esp + 0x16]
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x18]
add dword [eax + 0x4f4], ecx
cmp byte [esp + 0x16], 0
je 0x426de0
mov edi, eax
mov ebx, dword [0x544914]
xor esi, esi
call fcn.0045de90
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [esp + 0x16]
jmp 0x426cb9