Function at 0x465868
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff508
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4a6]
mov edx, 0x200
call fcn.004074d0
lea eax, [ebp - 0xaf7]
mov edx, 0x200
call fcn.004074d0
mov byte [ebp - 0x171], 0
mov byte [ebp - 0x170], 2
mov byte [ebp - 0x173], 0x52
mov byte [ebp - 0x172], 0x36
lea eax, [ebp - 0x16d]
mov edx, 0x12c
call fcn.004074d0
lea eax, [ebp - 0x16d]
mov ecx, 4
mov edx, dword [ebp - 8]
call fcn.004074bc
mov dword [ebp - 0x10], 4
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x46591f
mov eax, dword [ebp - 8]
mov al, byte [eax + 4]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x16d], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 8]
lea edx, [eax + 8]
mov eax, dword [ebp - 0x10]
lea eax, [ebp + eax - 0x16d]
call fcn.004074bc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add dword [ebp - 0x10], eax
jmp 0x465941
mov eax, dword [ebp - 8]
cmp dword [eax + 0x108], 0
je 0x465941
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x108]
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x16d], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jne 0x465955
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x16d], 0
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
shr eax, 8
mov byte [ebp - 0x16f], al
mov al, byte [ebp - 0x10]
mov byte [ebp - 0x16e], al
mov eax, dword [ebp - 0x10]
add eax, 6
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
shr eax, 8
mov byte [ebp - 0x4a6], al
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x4a5], al
mov word [ebp - 0x32], 0
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], 0
jle 0x465ac6
mov byte [ebp - 0x4a2], 0
movzx eax, word [ebp - 0x32]
shr eax, 8
mov byte [ebp - 0x4a4], al
mov al, byte [ebp - 0x32]
mov byte [ebp - 0x4a3], al
cmp dword [ebp - 0x24], 0xfa
jle 0x4659cc
mov byte [ebp - 0x4a1], 0xfa
jmp 0x4659d5
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x4a1], al
lea eax, [ebp - 0x173]
mov dword [ebp - 0x38], eax
movzx eax, word [ebp - 0x32]
add dword [ebp - 0x38], eax
lea eax, [ebp - 0x4a0]
mov ecx, 0xfa
mov edx, dword [ebp - 0x38]
call fcn.004074bc
lea eax, [ebp - 0x8f7]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x38], eax
lea edx, [ebp - 0x4a6]
mov ecx, pe_nt_image_headers32
mov eax, dword [ebp - 0x38]
call fcn.004074bc
sub dword [ebp - 0x24], 0xfa
add word [ebp - 0x32], 0xfa
add dword [ebp - 0x28], 0x100
cmp dword [ebp - 0x24], 0
jg 0x465abc
cmp dword [ebp - 0x28], 0x100
jle 0x465a4a
mov dword [ebp - 0x2c], 0x200
jmp 0x465a58
imul eax, dword [ebp - 4], 0x27
mov eax, dword [eax*8 + 0x4720f4]
mov dword [ebp - 0x2c], eax
cmp dword [0x4746c0], 0
je 0x465a8d
lea edx, [ebp - 0x8f7]
imul eax, dword [ebp - 4], 0x27
mov al, byte [eax*8 + 0x471fc8]
mov cx, word [ebp - 0x2c]
call fcn.00466508
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x465abc
mov dword [ebp - 0x30], 0xf0100003
jmp 0x465ac6
push 0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x8f7]
push eax
imul eax, dword [ebp - 4], 0x27
mov eax, dword [eax*8 + 0x471fc4]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x465abc
mov dword [ebp - 0x30], 0xf0100003
jmp 0x465ac6
cmp dword [ebp - 0x24], 0
jg 0x46599d
mov dword [ebp - 0x24], 1
mov word [ebp - 0x32], 0
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x465c1e
lea eax, [ebp - 0x4a6]
mov edx, 0x200
call fcn.004074d0
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [0x4746c0], 0
je 0x465b54
imul eax, dword [ebp - 4], 0x27
mov cx, word [eax*8 + 0x4720f4]
lea edx, [ebp - 0x4a6]
imul eax, dword [ebp - 4], 0x27
mov al, byte [eax*8 + 0x471fc8]
call fcn.004663a0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x465b32
mov dword [ebp - 0x30], 0xf0100004
jmp 0x465bb3
imul eax, dword [ebp - 4], 0x27
mov ecx, dword [eax*8 + 0x4720f4]
lea edx, [ebp - 0x4a6]
lea eax, [ebp - 0xaf7]
call fcn.004662bc
test eax, eax
je 0x465aed
jmp 0x465bb3
push 0
lea eax, [ebp - 0x40]
push eax
imul eax, dword [ebp - 4], 0x27
mov eax, dword [eax*8 + 0x4720f4]
push eax
lea eax, [ebp - 0x4a6]
push eax
imul eax, dword [ebp - 4], 0x27
mov eax, dword [eax*8 + 0x471fc4]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x465b95
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
jmp 0x465cb0
lea edx, [ebp - 0x4a6]
lea eax, [ebp - 0xaf7]
mov ecx, 0x200
call fcn.004662bc
test eax, eax
je 0x465aed
xor eax, eax
mov al, byte [ebp - 0x4a6]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0x4a5]
add eax, edx
mov dword [ebp - 0x24], eax
xor eax, eax
mov al, byte [ebp - 0x4a4]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0x4a3]
add ax, dx
mov word [ebp - 0x32], ax
xor eax, eax
mov al, byte [ebp - 0x4a2]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0x4a1]
add eax, edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2a6]
mov dword [ebp - 0x38], eax
movzx eax, word [ebp - 0x32]
add dword [ebp - 0x38], eax
lea edx, [ebp - 0x4a0]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
call fcn.004074bc
movzx eax, word [ebp - 0x32]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x465add
mov eax, dword [ebp - 0x24]
sub eax, 6
mov dword [ebp - 0x14], eax
xor eax, eax
mov al, byte [ebp - 0x2a2]
shl eax, 8
xor edx, edx
mov dl, byte [ebp - 0x2a1]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x465c60
mov dword [ebp - 0xc], 0xa0100014
jmp 0x465cb0
mov eax, dword [ebp - 0x18]
mov al, byte [ebp + eax - 0x2a2]
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x18]
mov al, byte [ebp + eax - 0x2a1]
mov byte [ebp - 0x1e], al
mov dl, byte [ebp - 0x1e]
mov al, byte [ebp - 0x1d]
call fcn.00460348
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x108], edx
lea edx, [ebp - 0x2a0]
mov eax, dword [ebp - 8]
add eax, 0x10c
mov ecx, dword [ebp - 0x18]
call fcn.004074bc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret