Function at 0x418a50
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x470a08
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x489348]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp]
mov edx, dword [eax + 0x24]
mov ecx, ebp
call edx
mov ebx, eax
push ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x34], 0
cmp byte [ebp + 0x452], 0
je 0x418c0b
cmp byte [ebp + 0x440], 0
jne 0x418c04
cmp byte [ebp + 0x451], 0
jne 0x418c04
mov eax, dword [ebp + 0x2d4]
mov ecx, dword [ebp + 0x43c]
push 0
lea esi, [ebp + 0x444]
push esi
push 0x2000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esi]
test eax, eax
jne 0x418b97
test esi, esi
je 0x418af8
mov byte [ebp + 0x451], 1
mov ecx, dword [ebp + 0x454]
test ecx, ecx
je 0x418baf
mov eax, dword [ebp + 0x458]
cmp eax, dword [ebp + 0x45c]
jge 0x418baf
mov ebx, dword [eax + ecx]
test ebx, ebx
je 0x418bab
mov edx, dword [ebp + 0x2d4]
add eax, 4
mov dword [ebp + 0x458], eax
mov eax, esi
mov ecx, 1
call fcn.00456210
cmp eax, ebx
jne 0x418bab
mov edx, esi
mov eax, esi
shl edx, 0x10
and eax, 0xff00
or edx, eax
movzx eax, byte [ebp + 0x447]
shr esi, 8
shl edx, 8
and esi, 0xff00
or edx, esi
or edx, eax
mov eax, dword [ebp + 0xec]
mov cl, 7
mov esi, 0xc
lea ebx, [esp + 0x20]
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 5
mov dword [esp + 0x24], 0x2000000
mov dword [esp + 0x28], edx
call fcn.0044a2c0
jmp 0x418cef
test esi, esi
jne 0x418af8
mov byte [ebp + 0x440], 1
jmp 0x418cff
mov ebx, dword [esp + 0x1c]
cmp byte [ebp + 0x450], 0
mov edi, 0x2400
mov dword [esp + 0x18], edi
mov byte [esp + 0x3c], 0
je 0x418c31
mov eax, dword [ebp + 0x2d4]
mov edx, dword [ebp + 0x2d8]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004564f0
add esp, 4
test eax, eax
je 0x418c28
push eax
push str.._vncclient.cpp_:_Compress_returned_error_in_File_Send_:_d_n
mov ecx, 9
mov eax, 0x48b3f0
call fcn.00401000
add esp, 8
mov byte [ebp + 0x451], 1
mov ecx, ebp
call fcn.00418d30
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
mov edi, dword [esp + 0x18]
mov byte [esp + 0x3c], 1
mov eax, dword [ebp + 0x444]
cmp edi, eax
jbe 0x418c40
mov byte [esp + 0x3c], 0
mov dl, byte [esp + 0x3c]
movzx esi, dl
neg esi
sbb esi, esi
and esi, 0x1000000
mov cl, 7
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], 5
mov dword [esp + 0x24], esi
test dl, dl
je 0x418c8a
mov edx, edi
and edx, 0xff0000
mov eax, edi
shr eax, 0x10
or edx, eax
mov eax, edi
mov esi, edi
shl eax, 0x10
and esi, 0xff00
or eax, esi
shr edx, 8
shl eax, 8
jmp 0x418cad
mov edx, eax
mov esi, eax
shl edx, 0x10
and esi, 0xff00
shr eax, 8
or edx, esi
and eax, 0xff00
shl edx, 8
or edx, eax
movzx eax, byte [ebp + 0x447]
or edx, eax
mov eax, dword [ebp + 0xec]
mov esi, 0xc
lea ebx, [esp + 0x20]
mov dword [esp + 0x28], edx
call fcn.0044a2c0
cmp byte [esp + 0x3c], 0
je 0x418cd8
mov eax, dword [ebp + 0x2d8]
mov ecx, edi
jmp 0x418ce4
mov ecx, dword [ebp + 0x444]
mov eax, dword [ebp + 0x2d4]
mov edi, dword [ebp + 0xec]
call fcn.0044a300
mov ecx, dword [ebp + 0x444]
add dword [ebp + 0x448], ecx
mov ebx, dword [esp + 0x1c]
mov esi, dword [0x4a67c0]
push 0
push str.WinVNC_Tray_Icon
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x418c0b
push 0
push ebp
push esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x418c0b