Function at 0x4111be
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, 0x201ff
mov byte [ebp - 5], bl
call fcn.004143f5
mov dword [ebp - 0x34], eax
test eax, eax
je 0x411451
mov ecx, dword [edi + 0x120]
test dword [ebp + 0xc], ecx
je 0x4111f4
mov byte [ebp - 5], 1
test eax, ecx
jne 0x4111fd
mov dword [ebp - 0x18], eax
jmp 0x411207
lea esi, [ecx + eax]
not ecx
and esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov ecx, dword [ebp + 0x14]
mov esi, eax
add dword [ebp + 8], ecx
mov edx, ebx
mov eax, dword [ebp + 0x18]
adc edx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edx
mov eax, 0x20000
xor edx, edx
mov dword [ebp - 0x20], esi
div esi
push dword [ebp - 0x1c]
mov esi, eax
mov dword [ebp - 0xc], ecx
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
push ecx
call fcn.004124da
test al, al
je 0x411447
mov eax, dword [ebp - 0x20]
cdq
mov ecx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push ecx
push eax
call sub.ntdll.dll__allmul
push dword [ebp - 0x1c]
add esi, dword [ebp - 0xc]
mov ecx, ebx
push dword [ebp + 8]
adc ecx, dword [ebp - 0x10]
push ecx
push esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
call fcn.00412554
test al, al
je 0x411291
mov esi, dword [ebp + 8]
sub esi, dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
jmp 0x411294
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
imul esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, ecx
cmp byte [ebp - 5], bl
je 0x4112c2
mov eax, dword [ebp - 0x18]
push esi
push ecx
push eax
mov dword [ebp - 0x28], eax
call sub.ntdll.dll_memcpy
mov eax, dword [ebp - 0x28]
add esp, 0xc
push ebx
lea ecx, [ebp - 0x3c]
push ecx
push esi
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
push dword [edi + 0x24]
call dword [sym.imp.ntdll.dll_NtWriteFile]
mov edx, eax
mov dword [edi + 0x38], edx
cmp edx, 0xc0000017
jne 0x411303
mov esi, dword [ebp - 0x14]
cmp esi, 1
je 0x411449
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shr esi, 1
sub eax, esi
mov dword [ebp - 0x14], esi
sbb ecx, ebx
jmp 0x41137e
mov ecx, 0xc0000000
mov eax, edx
and eax, ecx
cmp eax, ecx
je 0x41141f
cmp dword [ebp - 0x40], esi
jne 0x41141f
cmp byte [ebp + 0x10], bl
je 0x411372
cmp esi, 0x20000
ja 0x41141b
push ebx
lea eax, [ebp - 0x3c]
push eax
push esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
push dword [edi + 0x24]
call dword [sym.imp.ntdll.dll_NtReadFile]
mov edx, eax
mov eax, 0xc0000000
mov ecx, edx
mov dword [edi + 0x38], edx
and ecx, eax
cmp ecx, eax
je 0x4113d2
cmp dword [ebp - 0x40], esi
jne 0x4113d2
mov edx, dword [ebp + 0xc]
push esi
push edx
push dword [ebp - 0x18]
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4113a8
add dword [ebp + 0xc], esi
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x1c]
add eax, esi
push dword [ebp + 8]
adc ecx, ebx
mov dword [ebp - 0xc], eax
push ecx
push eax
mov dword [ebp - 0x10], ecx
call fcn.004124da
test al, al
je 0x411447
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
jmp 0x41125a
mov eax, dword [edi + 0x154]
test eax, eax
je 0x411449
push esi
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x401480
push 0x69a8
push eax
call fcn.00416e14
add esp, 0x18
jmp 0x411449
mov ecx, dword [edi + 0x154]
test ecx, ecx
je 0x411449
mov edi, 0xc0000000
mov eax, edx
and eax, edi
push esi
cmp eax, edi
jne 0x4113fd
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push edx
push 0x40145c
push 0x69a6
jmp 0x411410
push dword [ebp - 0x40]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x401474
push 0x69a7
push ecx
call fcn.00416e14
add esp, 0x1c
jmp 0x411449
xor al, al
jmp 0x411453
mov ecx, dword [edi + 0x154]
test ecx, ecx
je 0x411449
mov edi, 0xc0000000
mov eax, edx
and eax, edi
push esi
cmp eax, edi
je 0x4113ea
push dword [ebp - 0x40]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x401468
jmp 0x41140b
mov bl, 1
mov ecx, dword [ebp - 0x34]
call fcn.0041457e
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14