Function at 0x4783e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c6c
call fcn.004cf6c0
mov eax, dword [0x574a28]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c6c], ecx
mov dword [ebp - 0x2c], 0
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocString
mov ecx, dword [ebp - 0x2c6c]
call fcn.00414aa0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffff
jne 0x478438
xor eax, eax
jmp 0x478692
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov ecx, dword [ebp + 0xc]
call fcn.00414aa0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x478474
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
jmp 0x478692
mov byte [ebp - 0x2c68], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x2c67]
push ecx
call fcn.004cb660
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c6c]
mov ecx, dword [eax + 0x420]
mov dword [edx + 0x84], ecx
lea edx, [ebp - 0x2c68]
push edx
mov ecx, dword [ebp + 8]
call sym.ftl.bin_public:_bool___thiscall_FileHeader::EncryptMemory_void__
mov dword [ebp - 0x2864], 0
push 0
lea eax, [ebp - 0x2864]
push eax
push 0x400
lea ecx, [ebp - 0x2c68]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4784fe
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
jmp 0x478692
mov byte [ebp - 0x2860], 0
push 0x27ff
push 0
lea edx, [ebp - 0x285f]
push edx
call fcn.004cb660
add esp, 0xc
mov byte [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 0x54], 0
xor ecx, ecx
mov dword [ebp - 0x53], ecx
mov dword [ebp - 0x4f], ecx
mov dword [ebp - 0x4b], ecx
mov dword [ebp - 0x47], ecx
mov dword [ebp - 0x43], ecx
mov dword [ebp - 0x3f], ecx
mov dword [ebp - 0x3b], ecx
mov dword [ebp - 0x37], ecx
mov edx, dword [ebp - 0x2c6c]
cmp dword [edx + 0x1c], 0
je 0x47858e
push 0
push 0
push 0x400
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x20
mov ecx, dword [ebp - 0x2c6c]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.004cb2f0
add esp, 0xc
push 0x20
mov eax, dword [ebp + 8]
add eax, 0x24
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.004cb2f0
add esp, 0xc
mov dword [ebp - 0x58], 0x2800
mov dword [ebp - 0x2868], 0x2800
cmp dword [ebp - 0x58], 0x2800
jne 0x47867b
push 0
lea edx, [ebp - 0x58]
push edx
push 0x2800
lea eax, [ebp - 0x2860]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4785eb
jmp 0x47867b
mov edx, dword [ebp - 0x2c6c]
cmp dword [edx + 0x1c], 0
je 0x478622
lea eax, [ebp - 0x28]
push eax
call fcn.004cbac0
add esp, 4
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x2860]
push edx
mov eax, dword [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2860]
push ecx
call fcn.0045a1a0
add esp, 0x14
lea edx, [ebp - 0x54]
push edx
call fcn.004cbac0
add esp, 4
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2860]
push ecx
mov edx, dword [ebp - 0x58]
push edx
lea eax, [ebp - 0x2860]
push eax
call fcn.0045a1a0
add esp, 0x14
push 0
lea ecx, [ebp - 0x2868]
push ecx
mov edx, dword [ebp - 0x58]
push edx
lea eax, [ebp - 0x2860]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x478676
jmp 0x47867b
jmp 0x4785b4
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca80c
mov esp, ebp
pop ebp
ret 8