Function at 0x43b652
Capabilities:
Delete file
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x6079c0
call fcn.00465b38
sub esp, 0xf94
push ebx
push esi
xor ebx, ebx
push edi
push ebx
call fcn.004399ca
mov edi, dword [ebp + 8]
pop ecx
cmp edi, ebx
je 0x43c0d6
cmp word [edi], bx
je 0x43c0d6
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x43c0d6
cmp word [esi], bx
je 0x43c0d6
cmp dword [ebp + 0x10], ebx
je 0x43c0d6
cmp dword [0x69e3b4], ebx
jne 0x43b6b3
push 0x1d75
push 2
jmp 0x43c0dd
push edi
call fcn.004529c4
test al, 0x10
pop ecx
mov dword [ebp - 0x2c], eax
je 0x43b6cd
push 0x1d7d
push 0x1d
jmp 0x43c0dd
push esi
call fcn.004529c4
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 0x40], eax
je 0x43b6ec
test al, 0x10
je 0x43b6ec
push 0x1d87
push 0x1e
jmp 0x43c0dd
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
or dword [ebp - 0x10], 0xffffffff
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocStringLen
push edi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x34], ebx
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x43c03c
mov ecx, 0xe1
xor eax, eax
lea edi, [ebp - 0x7ef]
mov byte [ebp - 0x7f0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x467]
mov byte [ebp - 0x468], bl
push ebx
rep stosd dword es:[edi], eax
push ebx
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x64], ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xf7
xor eax, eax
lea edi, [ebp - 0xf9f]
mov byte [ebp - 0xfa0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xfa0]
push 0x3e0
push eax
push dword [ebp - 0x14]
call fcn.0043d94a
add esp, 0xc
test eax, eax
je 0x43b9ef
lea eax, [ebp - 0xfa0]
push eax
call fcn.0043da0b
cmp eax, 3
pop ecx
mov dword [ebp - 0x50], eax
jne 0x43b872
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0xfa0]
push eax
call fcn.0043d46e
pop ecx
test eax, eax
pop ecx
je 0x43b9fb
lea eax, [ebp - 0x7f0]
push eax
call fcn.0044208d
test eax, eax
pop ecx
je 0x43ba07
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x5c], ebx
push eax
lea eax, [ebp - 0x468]
push 0x40
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x7f0]
push eax
call fcn.004426d7
add esp, 0x14
test eax, eax
je 0x43ba13
push dword [ebp - 0x5c]
call fcn.00439674
cmp eax, ebx
pop ecx
mov dword [ebp - 0x64], eax
je 0x43ba1d
cmp dword [ebp - 0x470], ebx
je 0x43b872
cmp dword [ebp + 0x20], ebx
je 0x43b872
push dword [ebp - 0x470]
call fcn.005ed45a
mov edi, eax
pop ecx
cmp edi, ebx
mov dword [ebp - 0x34], edi
je 0x43b872
push dword [ebp - 0x470]
push ebx
push edi
call fcn.00466010
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push dword [ebp - 0x470]
push edi
push ebx
push dword [ebp - 0x14]
call fcn.0043a564
add esp, 0x20
test eax, eax
jne 0x43b872
push edi
call fcn.005ed483
pop ecx
mov dword [ebp - 0x34], ebx
push ebx
push 0x80
push 4
push ebx
mov edi, 0xc0000000
push ebx
push edi
push dword [ebp + 0xc]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x43b8bf
mov eax, dword [ebp - 0x40]
test al, 1
je 0x43b8a2
and al, 0xfe
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push 0x80
push 3
push ebx
push 1
push edi
push dword [ebp + 0xc]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x43c04f
mov ecx, 0xf3
xor eax, eax
lea edi, [ebp - 0xbbf]
mov byte [ebp - 0xbc0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
stosb byte es:[edi], al
pop esi
lea eax, [ebp - 0xbc0]
push eax
mov dword [ebp - 0x60], esi
call fcn.0043c88e
test eax, eax
pop ecx
je 0x43c058
mov ecx, 0xdb
xor eax, eax
lea edi, [ebp - 0x427]
mov byte [ebp - 0x428], bl
rep stosd dword es:[edi], eax
push dword [ebp + 0x28]
stosw word es:[edi], ax
push dword [ebp + 0x18]
stosb byte es:[edi], al
lea eax, [ebp - 0x428]
push eax
call fcn.0043c8c3
add esp, 0xc
test eax, eax
je 0x43c061
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0xb7]
mov byte [ebp - 0xb8], bl
mov dword [ebp - 0x38], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xb8]
push 0x40
push eax
push dword [ebp - 0x1cc]
push dword [ebp - 0x1d4]
push dword [ebp - 0x308]
call fcn.00441e9e
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x58], eax
je 0x43c06a
push eax
call fcn.00439674
cmp eax, ebx
pop ecx
mov dword [ebp - 0x44], eax
je 0x43c073
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp + 0x20], eax
call edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x50], 3
jne 0x43ba27
mov eax, dword [ebp - 0x7e0]
mov ecx, dword [ebp - 0x7d4]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], ecx
jmp 0x43ba5d
push 0x1db4
push 0xf
jmp 0x43c093
push 0x1dc0
push 0x14
jmp 0x43c093
push 0x1dc7
push 0x1f
jmp 0x43c093
push 0x1dd0
jmp 0x43c06f
push 0x1dd9
jmp 0x43c078
push dword [ebp - 0x14]
call fcn.00442075
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x2c]
pop ecx
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], eax
cmp dword [ebp + 0x14], ebx
je 0x43ba85
push dword [ebp + 0x14]
call fcn.00465c4f
test eax, eax
pop ecx
jbe 0x43ba85
push 0x77
lea eax, [ebp - 0x3f8]
push dword [ebp + 0x14]
push eax
call fcn.0046634f
add esp, 0xc
jmp 0x43baae
mov esi, dword [ebp + 8]
push 0x5c
push esi
call fcn.004663c1
pop ecx
cmp eax, ebx
pop ecx
je 0x43ba99
lea esi, [eax + 2]
push 0x77
lea eax, [ebp - 0x3f8]
push esi
push eax
call fcn.0046634f
add esp, 0xc
push 1
pop esi
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0xbc0]
push 0x3d0
push eax
push dword [ebp - 0x10]
call fcn.0043d9ba
add esp, 0xc
test eax, eax
je 0x43c07c
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x28], 0x3d0
mov dword [ebp - 0x304], eax
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0xb8]
push dword [ebp - 0x38]
mov dword [ebp - 0x24], ebx
push eax
call fcn.00453ab2
mov eax, dword [ebp - 0x408]
add esp, 0xc
or eax, dword [ebp - 0x404]
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2f0], 0x3d0
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2dc], ebx
jne 0x43bb42
mov dword [ebp - 0x30], esi
mov dword [ebp + 0x18], ebx
jmp 0x43be80
cmp dword [ebp - 0x50], 3
jne 0x43bb69
cmp dword [ebp - 0x7b4], esi
mov eax, dword [ebp - 0x7ac]
je 0x43bb5c
mov eax, dword [ebp - 0x7b0]
push ebx
push ebx
push dword [ebp - 0x7b8]
mov dword [ebp - 0x18], eax
jmp 0x43bb83
cmp dword [ebp - 0x48], ebx
mov eax, 0x10000
jne 0x43bb7d
mov ecx, dword [ebp + 0x20]
cmp ecx, eax
mov dword [ebp - 0x18], ecx
jb 0x43bb80
mov dword [ebp - 0x18], eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
call edi
push dword [ebp - 0x18]
call fcn.005ed45a
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x44]
push dword [ebp - 0x18]
mov eax, dword [ecx]
call dword [eax + 8]
add eax, 0x10
push eax
mov dword [ebp - 0x68], eax
call fcn.005ed45a
pop ecx
mov dword [ebp + 0x20], eax
mov ecx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x74]
push ebx
push ecx
push eax
mov dword [ebp - 0x3c], ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x70], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x78], eax
call edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp + 0x18], ebx
mov edi, dword [ebp - 0x18]
push edi
push ebx
push dword [ebp - 0x20]
call fcn.00466010
push dword [ebp - 0x68]
push ebx
push dword [ebp + 0x20]
call fcn.00466010
mov eax, dword [ebp + 0x20]
add esp, 0x18
cmp dword [ebp - 0x50], 3
mov dword [eax], ebx
mov eax, dword [ebp + 0x20]
mov dword [eax + 8], ebx
mov eax, dword [ebp + 0x20]
mov dword [eax + 4], ebx
mov dword [ebp + 0x14], ebx
jne 0x43bcdd
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x7b4]
mov edi, dword [ebp - 0x7b0]
jne 0x43bc38
mov edi, dword [ebp - 0x7ac]
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x4c], edi
jae 0x43bc60
cmp dword [ebp + 0x28], ebx
je 0x43bc4b
push dword [ebp + 0x28]
call fcn.005ed483
pop ecx
push edi
mov dword [ebp - 0x4c], edi
call fcn.005ed45a
cmp eax, ebx
pop ecx
mov dword [ebp + 0x28], eax
je 0x43bd93
push dword [ebp - 0x4c]
push ebx
push dword [ebp + 0x28]
call fcn.00466010
add esp, 0xc
lea eax, [ebp + 0x14]
push ebx
push eax
push edi
push dword [ebp + 0x28]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43bdc2
cmp dword [ebp + 0x14], edi
jb 0x43bdc2
mov eax, dword [ebp + 0x28]
add edi, 0xfffffffc
push dword [eax]
lea esi, [eax + 4]
push edi
push esi
call fcn.00453a6b
add esp, 0xc
test eax, eax
je 0x43bd9f
lea edx, [ebp + 0x14]
mov ecx, dword [ebp - 0x64]
push edx
lea edx, [ebp - 0x468]
push dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [ebp + 0x14], ebx
push dword [ebp - 0x20]
push edi
push esi
push dword [ebp - 0x6c]
push edx
call dword [eax + 0x14]
cmp eax, ebx
je 0x43bda8
push 1
pop esi
jmp 0x43bd08
lea eax, [ebp + 0x14]
push ebx
push eax
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43bdcb
cmp dword [ebp + 0x14], edi
jae 0x43bd08
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x30], esi
je 0x43be42
lea eax, [ebp - 0x70]
mov dword [ebp - 0x2c], ebx
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0xb8]
push dword [ebp + 0x14]
push dword [ebp - 0x20]
push dword [ebp - 0x38]
push eax
push dword [ebp - 0x44]
call fcn.0043d0ca
add esp, 0x28
cmp eax, ebx
jne 0x43bdd2
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 0x40], ebx
push dword [ebp - 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43be2d
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x40], eax
jb 0x43be34
inc dword [ebp - 0x2e0]
add dword [ebp - 0x2e8], eax
adc dword [ebp - 0x2e4], ebx
add dword [ebp - 0x28], eax
adc dword [ebp - 0x24], ebx
cmp dword [ebp - 0x30], ebx
je 0x43bbe1
jmp 0x43be42
push 0x1ee9
push 0x21
jmp 0x43be21
push 0x1efb
push 0x1c
jmp 0x43bdaf
push 0x1f05
push 0x12
call fcn.004399ac
pop ecx
mov dword [ebp + 0x18], 1
pop ecx
jmp 0x43be42
push 0x1ef3
push 0xd
jmp 0x43be21
push 0x1f0f
jmp 0x43bdc7
jge 0x43be1a
push 0x69dc58
lea ecx, [ebp - 0x1c]
call fcn.00480200
push 0x1f24
lea eax, [ebp - 0x1c]
push dword [ebp - 0x38]
mov dword [ebp - 4], ebx
push dword [ebp + 0x14]
push dword [ebp - 0x58]
push dword [ebp + 8]
push str.Error:_Encrypt_Data_Failed__File_s__Algrithm_d__DataLen_lu_KeyLen_lu__LINE_d
push eax
call fcn.00483a80
push dword [ebp - 0x1c]
call fcn.00442d4f
or dword [ebp - 4], 0xffffffff
add esp, 0x20
lea ecx, [ebp - 0x1c]
call fcn.00480a70
push 0x1f28
push 0x11
call fcn.004399ac
pop ecx
mov dword [ebp + 0x18], esi
pop ecx
jmp 0x43be42
push 0x1f30
jmp 0x43be39
push 0x1f36
push 0xe
call fcn.004399ac
pop ecx
pop ecx
cmp dword [ebp + 0x28], ebx
je 0x43be50
push dword [ebp + 0x28]
call fcn.005ed483
pop ecx
cmp dword [ebp - 0x20], ebx
je 0x43be5e
push dword [ebp - 0x20]
call fcn.005ed483
pop ecx
cmp dword [ebp + 0x20], ebx
je 0x43be6f
push dword [ebp + 0x20]
call fcn.005ed483
pop ecx
mov dword [ebp + 0x20], ebx
cmp dword [ebp - 0x3c], ebx
je 0x43be80
push dword [ebp - 0x3c]
call fcn.005ed483
pop ecx
mov dword [ebp - 0x3c], ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x30], ebx
je 0x43c09a
cmp dword [ebp + 0x18], ebx
jne 0x43c09a
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0xe8], ebx
cmp edi, ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xdc], ebx
jne 0x43becd
mov edi, dword [ebp + 0x1c]
cmp edi, ebx
je 0x43bf48
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
lea eax, [eax + eax + 0x7a]
push eax
lea eax, [ebp - 0xe8]
push edi
push eax
push dword [ebp - 0xba0]
push dword [ebp - 0x10]
call fcn.0043ca63
add esp, 0x14
test eax, eax
je 0x43bf3a
or dword [ebp - 0xb9c], 4
push edi
call fcn.00453b41
test eax, eax
pop ecx
jne 0x43bf17
or dword [ebp - 0xb9c], 1
add edi, 0x10
push edi
call fcn.00453b41
test eax, eax
pop ecx
jne 0x43bf2c
or dword [ebp - 0xb9c], 2
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0xe0]
adc dword [ebp - 0x24], ebx
jmp 0x43bf4b
push 0x1f6f
push 0x10
call fcn.004399ac
pop ecx
pop ecx
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc0], ebx
mov eax, dword [edi + 0x68]
mov ecx, dword [edi + 0x6c]
imul eax, eax, 0x88
add eax, dword [edi + 0x64]
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc4], ebx
lea eax, [ecx + eax*2 + 0x82]
push eax
lea eax, [ebp - 0xd0]
push edi
push eax
push dword [ebp - 0xba0]
push dword [ebp - 0x10]
call fcn.0043ca63
add esp, 0x14
test eax, eax
je 0x43bfd6
add dword [ebp - 0xb98], 4
push edi
call fcn.00453b41
test eax, eax
pop ecx
jne 0x43bfbf
or dword [ebp - 0xb98], 1
cmp dword [ebp + 0x24], ebx
je 0x43bfcb
or dword [ebp - 0xb98], 2
add esi, dword [ebp - 0xc8]
adc dword [ebp - 0x24], ebx
jmp 0x43bfe4
push 0x1f8d
push 0x10
call fcn.004399ac
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x400], esi
mov dword [ebp - 0x3fc], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xbc0]
push eax
call fcn.0043ce76
pop ecx
test eax, eax
pop ecx
je 0x43c083
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xbc0]
push 0x3d0
push eax
push dword [ebp - 0x10]
call fcn.0043d9ba
add esp, 0xc
test eax, eax
je 0x43c08c
mov dword [ebp - 0x54], 1
jmp 0x43c09a
push 0x1da1
push 3
call fcn.004399ac
pop ecx
pop ecx
jmp 0x43c0d1
push 0x1e11
push 4
jmp 0x43c093
push 0x1e1b
push 9
jmp 0x43c093
push 0x1e23
push 8
jmp 0x43c093
push 0x1e33
push 0xb
jmp 0x43c093
push 0x1e3a
push 0xc
jmp 0x43c093
push 0x1e7e
jmp 0x43c091
push 0x1f97
push 0x13
jmp 0x43c093
push 0x1f9f
push 0x10
call fcn.004399ac
pop ecx
pop ecx
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp - 0x10], 0xffffffff
je 0x43c0b0
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x34], ebx
je 0x43c0be
push dword [ebp - 0x34]
call fcn.005ed483
pop ecx
cmp dword [ebp - 0x54], ebx
jne 0x43c0d1
cmp dword [ebp - 0x60], ebx
je 0x43c0d1
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x54]
jmp 0x43c0e6
push 0x1d6f
push 1
call fcn.004399ac
pop ecx
xor eax, eax
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret