Function at 0x41e680
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x44d0ae
mov eax, dword fs:[0]
push eax
mov eax, 0x153c
call fcn.004468f0
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x1538], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1550]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x2b8]
xor edx, edx
mov dword [esp + 0x20], ebx
cmp ecx, edx
je 0x41ed9e
cmp dword [ebx + 0x1b0], edx
je 0x41ed9e
lea eax, [ebx + 0x2a4]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], edx
mov byte [edi], dl
mov eax, dword [esi + 0x18]
lea ebp, [esp + 0x44]
cmp eax, 0x10
jb 0x41e710
mov ecx, dword [edi]
jmp 0x41e712
mov ecx, edi
cmp ecx, 0x4553c0
ja 0x41e74d
cmp eax, 0x10
jb 0x41e723
mov ecx, dword [edi]
jmp 0x41e725
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4553c0
jbe 0x41e74d
cmp eax, 0x10
jb 0x41e739
mov edi, dword [edi]
push 2
mov eax, 0x4553c0
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41e791
cmp eax, 2
jae 0x41e75f
mov ecx, dword [esi + 0x14]
push ecx
push 2
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41e76b
mov eax, dword [edi]
jmp 0x41e76d
mov eax, edi
push 2
push 0x4553c0
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 2
jb 0x41e78d
mov edi, dword [edi]
mov byte [edi + 2], 0
lea esi, [esp + 0xbc]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov dword [esp + 0x155c], 2
call fcn.00401a50
mov byte [esp + 0x155c], 3
cmp dword [eax + 0x18], 0x10
jb 0x41e7c4
mov eax, dword [eax + 4]
jmp 0x41e7c7
add eax, 4
lea edx, [ebx + 0x19c]
push edx
mov edi, eax
lea esi, [esp + 0x50]
call fcn.00405920
add esp, 4
push eax
lea edi, [esp + 0x6c]
mov byte [esp + 0x1560], 4
call fcn.004059d0
add esp, 8
push 0xffffffffffffffff
push 0
lea ebp, [ebx + 0x288]
push eax
mov ecx, ebp
mov byte [esp + 0x1564], 5
call fcn.00402d10
cmp dword [esp + 0x7c], 0x10
jb 0x41e81f
mov eax, dword [esp + 0x68]
push eax
call fcn.00437f8b
add esp, 4
xor edi, edi
cmp dword [esp + 0x60], 0x10
mov esi, 0xf
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], edi
mov byte [esp + 0x68], 0
jb 0x41e847
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], edi
mov byte [esp + 0x4c], 0
jb 0x41e868
mov edx, dword [esp + 0x28]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x3c], esi
lea esi, [esp + 0x9c]
mov dword [esp + 0x38], edi
mov byte [esp + 0x28], 0
mov dword [esp + 0x1558], 0xffffffff
call fcn.00429620
cmp dword [ebp + 0x18], 0x10
jb 0x41e897
mov eax, dword [ebp + 4]
jmp 0x41e89a
lea eax, [ebp + 4]
push edi
push 0x80
push 3
push edi
push edi
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41e960
lea eax, [esp + 0x40]
push eax
push edi
push edi
push esi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, edi
je 0x41e960
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push edi
push 0x989680
push ecx
push eax
call fcn.00441be0
sub eax, 0xb6109100
push 0xfff
lea ecx, [esp + 0x551]
sbb edx, 2
push edi
push ecx
mov dword [ebx + 0x280], eax
mov dword [ebx + 0x284], edx
mov byte [esp + 0x558], 0
call fcn.0043e780
add esp, 0xc
call fcn.00417cd0
test eax, eax
je 0x41e933
call fcn.00418a10
call fcn.00418790
push edi
lea edx, [esp + 0x20]
push edx
push 0xa
lea eax, [esp + 0x558]
push eax
push esi
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
jne 0x41ed65
cmp dword [esp + 0x1c], edi
jne 0x41ed65
cmp esi, edi
je 0x41e979
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00417cd0
test eax, eax
je 0x41e979
call fcn.00406fe0
call fcn.00437f69
cdq
mov ecx, 0xff
idiv ecx
mov edi, edx
shl edi, 8
call fcn.00437f69
cdq
mov ecx, 0xff
idiv ecx
mov esi, edx
add esi, edi
shl esi, 8
call fcn.00437f69
cdq
mov ecx, 0xff
idiv ecx
mov edi, edx
add edi, esi
shl edi, 8
call fcn.00437f69
cdq
mov ecx, 0xff
idiv ecx
add edx, edi
mov dword [ebx + 0x1f4], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x41e9e1
sub eax, 2
je 0x41e9e1
sub eax, 4
je 0x41e9e1
xor ecx, ecx
jmp 0x41e9ee
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 1
mov eax, 0x6ef5de4d
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x24ea
jle 0x41ea1b
push 0x24ea
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004353a0
call fcn.00418800
push 0x3ff
lea ecx, [esp + 0x151]
push 0
push ecx
mov byte [esp + 0x158], 0
call fcn.0043e780
mov eax, dword [ebx + 0x1f4]
add esp, 0xc
push 0xa
push 0x400
lea edx, [esp + 0x154]
push edx
push eax
call fcn.00439c63
lea eax, [esp + 0x15c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ea62
sub eax, edx
push eax
lea ecx, [esp + 0x150]
lea esi, [ebx + 0x1f8]
push ecx
mov ecx, esi
call fcn.00403090
call fcn.00417cd0
test eax, eax
je 0x41ea8f
call fcn.004188b0
cmp dword [ebp + 0x18], 0x10
jb 0x41ea9a
mov eax, dword [ebp + 4]
jmp 0x41ea9d
lea eax, [ebp + 4]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41ebeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov edi, esp
lea edx, [esp + 0x44]
mov esi, ebp
push edx
sub esp, 0x1c
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, esp
mov ebp, 0xf
mov dword [esi + 0x18], ebp
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov ebx, pe_nt_image_headers32
mov dword [esp + 0x5c], esp
cmp eax, ebx
jb 0x41eb09
mov ecx, dword [edi]
jmp 0x41eb0b
mov ecx, edi
cmp ecx, 0x4553c4
ja 0x41eb44
cmp eax, ebx
jb 0x41eb1b
mov ecx, dword [edi]
jmp 0x41eb1d
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4553c4
jbe 0x41eb44
cmp eax, ebx
jb 0x41eb30
mov edi, dword [edi]
push 0x26
mov eax, 0x4553c4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41eb86
cmp eax, 0x26
jae 0x41eb56
mov ecx, dword [esi + 0x14]
push ecx
push 0x26
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x41eb61
mov eax, dword [edi]
jmp 0x41eb63
mov eax, edi
push 0x26
push 0x4553c4
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x26
cmp dword [esi + 0x18], ebx
jb 0x41eb82
mov edi, dword [edi]
mov byte [edi + 0x26], 0
lea esi, [esp + 0xdc]
call fcn.004014c0
mov dword [esp + 0x157c], 6
call fcn.00401580
mov byte [esp + 0x1578], 7
cmp dword [eax + 0x18], ebx
jb 0x41ebb4
mov eax, dword [eax + 4]
jmp 0x41ebb7
add eax, 4
mov edx, dword [esp + 0x40]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x2c
cmp dword [esp + 0x3c], ebx
jb 0x41ebda
mov eax, dword [esp + 0x28]
push eax
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], 0
jmp 0x41eeaa
cmp dword [esi + 0x18], 0x10
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x20c]
mov dword [esp + 0x18], 0
jb 0x41ec08
mov esi, dword [esi + 4]
jmp 0x41ec0b
add esi, 4
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41ec2a
cmp dword [esp + 0x18], 0
jne 0x41ed4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, ebp
mov edi, esp
sub esp, 0x1c
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebp, [esp + 0xbc]
mov dword [esp + 0x58], esp
cmp eax, 0x10
jb 0x41ec6f
mov ecx, dword [edi]
jmp 0x41ec71
mov ecx, edi
cmp ecx, 0x4553ec
ja 0x41ecac
cmp eax, 0x10
jb 0x41ec82
mov ecx, dword [edi]
jmp 0x41ec84
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4553ec
jbe 0x41ecac
cmp eax, 0x10
jb 0x41ec98
mov edi, dword [edi]
push 0x24
mov eax, 0x4553ec
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41ecf0
cmp eax, 0x24
jae 0x41ecbe
mov ecx, dword [esi + 0x14]
push ecx
push 0x24
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x41ecca
mov eax, dword [edi]
jmp 0x41eccc
mov eax, edi
push 0x24
push 0x4553ec
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x24
jb 0x41ecec
mov edi, dword [edi]
mov byte [edi + 0x24], 0
lea esi, [esp + 0x130]
call fcn.004014c0
mov edx, ebp
mov ecx, eax
mov dword [esp + 0x1578], 8
call fcn.00401a50
mov byte [esp + 0x1578], 9
cmp dword [eax + 0x18], 0x10
jb 0x41ed23
mov eax, dword [eax + 4]
jmp 0x41ed26
add eax, 4
mov edx, dword [esp + 0x40]
push eax
push 1
push edx
call fcn.0041c990
add esp, 0x2c
lea ecx, [esp + 0x80]
call fcn.00402ba0
lea esi, [esp + 0xf4]
call fcn.00429620
test ebx, ebx
je 0x41ed5e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00417cd0
xor eax, eax
jmp 0x41eec0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x54c]
push eax
lea ecx, [ebx + 0x1f8]
call fcn.00402df0
push edi
lea ecx, [esp + 0x550]
push edi
push ecx
call fcn.00439f87
add esp, 0xc
mov dword [ebx + 0x1f4], eax
xor eax, eax
jmp 0x41eec0
mov eax, dword [ebx + 0x1b0]
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], edx
mov byte [edi], dl
mov eax, dword [esi + 0x18]
mov ebp, pe_nt_image_headers32
cmp eax, ebp
jb 0x41edd3
mov ecx, dword [edi]
jmp 0x41edd5
mov ecx, edi
cmp ecx, 0x45539c
ja 0x41ee0e
cmp eax, ebp
jb 0x41ede5
mov ecx, dword [edi]
jmp 0x41ede7
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45539c
jbe 0x41ee0e
cmp eax, ebp
jb 0x41edfa
mov edi, dword [edi]
push 0x21
mov eax, 0x45539c
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x41ee50
cmp eax, 0x21
jae 0x41ee20
mov ecx, dword [esi + 0x14]
push ecx
push 0x21
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebp
jb 0x41ee2b
mov eax, dword [edi]
jmp 0x41ee2d
mov eax, edi
push 0x21
push 0x45539c
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0x21
cmp dword [esi + 0x18], ebp
jb 0x41ee4c
mov edi, dword [edi]
mov byte [edi + 0x21], 0
lea esi, [esp + 0xc4]
call fcn.004014c0
xor esi, esi
mov dword [esp + 0x1564], esi
call fcn.00401580
mov byte [esp + 0x1560], 1
cmp dword [eax + 0x18], ebp
jb 0x41ee7c
mov eax, dword [eax + 4]
jmp 0x41ee7f
add eax, 4
push eax
push 1
push ebx
call fcn.0041c990
add esp, 0x14
cmp dword [esp + 0x3c], ebp
jb 0x41ee9e
mov edx, dword [esp + 0x28]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
lea esi, [esp + 0x9c]
mov byte [esp + 0x28], 0
call fcn.00429620
mov eax, 0x80004005
mov ecx, dword [esp + 0x1550]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1538]
xor ecx, esp
call fcn.00437983
add esp, 0x1548
ret