Function at 0x424312
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
lea eax, [ebp - 0x154]
push edi
mov edi, ecx
push eax
call fcn.00423d92
lea eax, [ebp - 0x154]
push eax
call fcn.0040ea14
test al, al
pop ecx
je 0x42494c
xor ebx, ebx
lea eax, [ebp - 0x154]
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x20], esi
je 0x42494c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
push ebx
push 0xfffffffffffffffc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call esi
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x30]
sub eax, 4
push eax
mov dword [ebp - 4], eax
call fcn.004260f9
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x4243cd
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42494c
lea ecx, [ebp - 0x40]
push ebx
push ecx
push dword [ebp - 4]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call esi
lea ecx, [ebp - 0x18]
call fcn.0041cf28
push dword [ebp - 4]
lea ecx, [ebp - 0x18]
push dword [ebp - 8]
call fcn.0041d195
lea ecx, [ebp - 0x18]
call fcn.0041d42e
test al, al
je 0x42493b
lea ecx, [ebp - 0x18]
call fcn.0041d42e
test al, al
je 0x42493b
cmp dword [ebp - 0x18], 2
jb 0x42493b
lea ecx, [ebp - 0x3c]
call fcn.0041cf28
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041da2a
cmp al, 0x5c
jne 0x424472
push 1
lea ecx, [ebp - 0x18]
call fcn.0041da2a
push 2
lea ecx, [ebp - 0x18]
call fcn.0041da60
lea esi, [eax + 6]
lea ecx, [ebp - 0x18]
push esi
push ebx
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041d0e3
push esi
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041d4f7
xor esi, esi
cmp dword [ebp - 0x18], ebx
mov byte [ebp - 0x19], bl
jbe 0x4245bc
push esi
lea ecx, [ebp - 0x18]
call fcn.0041da2a
cmp al, 0xd
je 0x424498
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x424480
jmp 0x4245bc
cmp esi, 0xffffffff
je 0x4245bc
push esi
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041cffc
push ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041d7fb
mov esi, eax
cmp esi, 0xffffffff
je 0x4245b4
lea ecx, [ebp - 0x2c]
call fcn.0041de81
lea eax, [eax + esi + 1]
push eax
push 0x42ece4
mov dword [ebp - 4], eax
call fcn.00425d50
pop ecx
test eax, eax
pop ecx
jge 0x4244ed
mov byte [ebp - 0x19], 1
cmp byte [edi + 0x92], bl
jne 0x4245b4
push dword [ebp - 4]
push 0x42ece0
call fcn.00425d50
pop ecx
test eax, eax
pop ecx
jge 0x4245b4
inc esi
lea ecx, [ebp - 0x18]
push esi
push ebx
call fcn.0041d7fb
mov esi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xc], esi
lea eax, [esi + 1]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0041d7fb
cmp esi, 0xffffffff
mov dword [ebp - 8], eax
je 0x4245b4
cmp eax, 0xffffffff
je 0x4245b4
mov esi, 0x47f0b8
push 0x47f6f8
mov ecx, esi
call fcn.0041b99b
push 0x7fffffff
push 0x47f6f8
mov ecx, esi
call fcn.0041c515
push 0x47f6f8
mov ecx, esi
call fcn.004174c1
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
sub eax, dword [ebp - 0xc]
lea esi, [eax - 1]
push esi
push dword [ebp - 4]
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x50]
call fcn.0041cffc
push esi
lea ecx, [ebp - 0x18]
push dword [ebp - 4]
call fcn.0041d4f7
push ebx
mov ecx, 0x47f6f8
push dword [ebp - 4]
call fcn.0041de81
push eax
lea ecx, [ebp - 0x18]
call fcn.0041db83
lea ecx, [ebp - 0x50]
call fcn.0041d05e
lea ecx, [ebp - 0x2c]
call fcn.0041d05e
push 1
push ebx
push str.Backups:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d81e
push 1
push ebx
push str.Files:_r_n
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041d81e
cmp eax, esi
jge 0x4245ea
push dword [ebp - 0x20]
jmp 0x42492b
push 1
mov esi, str.Shared:_r_n
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.0041d81e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
add ecx, eax
cmp dword [edi + 0x7c], ebx
mov dword [ebp - 0xc], ecx
jle 0x42469e
mov dword [ebp - 8], ebx
push ebx
push dword [edi + 0x8c]
call fcn.0040e9e1
pop ecx
cmp eax, ebx
pop ecx
je 0x424696
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041cf98
cmp byte [ebp - 0x19], bl
jne 0x42465a
push ebx
push 0x7c
lea ecx, [ebp - 0x2c]
call fcn.0041d7fb
cmp eax, 0xffffffff
je 0x42465a
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041d4f7
push ebx
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc]
call fcn.0041de81
push eax
lea ecx, [ebp - 0x18]
call fcn.0041db83
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add eax, ecx
push ebx
push eax
push 0x42cc5c
lea ecx, [ebp - 0x18]
call fcn.0041db83
inc dword [ebp - 8]
lea ecx, [ebp - 0x2c]
call fcn.0041d05e
push dword [ebp - 8]
jmp 0x42461c
lea ecx, [edi + 0x78]
call fcn.0041e154
cmp dword [edi + 0x54], ebx
jbe 0x424736
push 1
push ebx
push str.Backups:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d81e
push str.Backups:_r_n
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
add ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x2c]
call fcn.0041cf28
push dword [ebp - 4]
lea ecx, [edi + 0x54]
call fcn.0041db35
test al, al
je 0x424721
lea eax, [ebp - 0x2c]
lea ecx, [edi + 0x54]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041da92
push ebx
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc]
call fcn.0041de81
push eax
lea ecx, [ebp - 0x18]
call fcn.0041db83
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add eax, ecx
push ebx
push eax
push 0x42cc5c
lea ecx, [ebp - 0x18]
call fcn.0041db83
jmp 0x4246d4
push 0x42f1c8
lea ecx, [edi + 0x54]
call fcn.0041d075
lea ecx, [ebp - 0x2c]
call fcn.0041d05e
cmp dword [edi + 0x10], ebx
jle 0x4247a6
push 1
push ebx
push str.Files:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d81e
push str.Files:_r_n
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
add ecx, eax
push ebx
mov dword [ebp - 0xc], ecx
push dword [edi + 0x20]
call fcn.0040e9e1
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x42479e
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp - 0xc]
push eax
call fcn.0041db83
push ebx
push dword [ebp - 4]
call esi
add eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push 0x42cc5c
call fcn.0041db83
inc dword [ebp - 8]
push dword [ebp - 8]
jmp 0x424761
lea ecx, [edi + 0xc]
call fcn.0041e154
cmp dword [edi + 0x28], ebx
jle 0x424816
push 1
push ebx
push str.Directories:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d81e
push str.Directories:_r_n
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
add ecx, eax
push ebx
mov dword [ebp - 0xc], ecx
push dword [edi + 0x38]
call fcn.0040e9e1
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x42480e
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp - 0xc]
push eax
call fcn.0041db83
push ebx
push dword [ebp - 4]
call esi
add eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push 0x42cc5c
call fcn.0041db83
inc dword [ebp - 8]
push dword [ebp - 8]
jmp 0x4247d1
lea ecx, [edi + 0x24]
call fcn.0041e154
push 1
push ebx
push str.Registry:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d81e
push str.Registry:_r_n
mov dword [ebp - 4], eax
call esi
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x18]
add esi, eax
mov eax, dword [ebp - 0x18]
sub eax, esi
push eax
push esi
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041cffc
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
sub eax, esi
push eax
push esi
call fcn.0041d4f7
lea ecx, [ebp - 0x2c]
mov dword [ebp - 8], ebx
call fcn.0041de81
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], eax
mov esi, 0x47f590
jbe 0x424899
mov dword [ebp - 4], 0x47f480
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00423dd7
add dword [ebp - 4], 0x44
cmp dword [ebp - 4], esi
jl 0x42487b
cmp dword [edi + 0x40], ebx
jg 0x4248a3
cmp dword [edi + 0x64], ebx
jle 0x4248aa
mov ecx, edi
call fcn.00422c22
mov dword [ebp - 4], 0x47f480
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00422e07
add dword [ebp - 4], 0x44
cmp dword [ebp - 4], esi
jl 0x4248b1
lea ecx, [ebp - 0x2c]
call fcn.0041d05e
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041d213
lea ecx, [ebp - 0x3c]
call fcn.0041d37d
lea ecx, [ebp - 0x3c]
call fcn.0041d37d
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0041d0e3
lea eax, [ebp - 0x44]
push ebx
push eax
lea ecx, [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.0041de81
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edi
call esi
lea eax, [ebp - 0x44]
push ebx
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.0041d05e
jmp 0x424944
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.0041d05e
pop edi
pop esi
mov al, 1
pop ebx
leave
ret