Function at 0x443050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5708
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x48], 0x65
mov eax, dword [esi]
mov byte [ebp - 0x29], 1
mov edx, dword [eax + 0x28]
cmp eax, vtable.vncClient.0
jne 0x443495
mov eax, dword [esi + 0x24c]
mov ebx, dword [eax + 0x68]
add ebx, 0xdc2c
push ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp byte [esi + 0x51a], 0
je 0x443470
cmp byte [esi + 0x508], 0
jne 0x443469
cmp byte [esi + 0x519], 0
jne 0x443469
push 0
lea edi, [esi + 0x50c]
push edi
push 0x2000
push dword [esi + 0x4e0]
push dword [esi + 0x504]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4431f5
cmp dword [edi], eax
je 0x443115
mov byte [esi + 0x519], 1
mov ecx, dword [esi + 0x51c]
test ecx, ecx
je 0x443283
mov eax, dword [esi + 0x520]
cmp eax, dword [esi + 0x524]
jge 0x443283
mov edi, dword [eax + ecx]
test edi, edi
je 0x44327d
push 0
add eax, 4
push 0
push 0
mov dword [esi + 0x520], eax
call fcn.004c54c0
add esp, 0xc
push dword [esi + 0x50c]
push dword [esi + 0x4e0]
push eax
call fcn.004c54c0
add esp, 0xc
cmp eax, edi
jne 0x44327d
mov ecx, dword [esi + 0x50c]
mov edx, ecx
mov edi, dword [esi + 0x198]
mov eax, ecx
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov word [ebp - 0x28], 0x507
mov eax, ecx
shl edx, 8
and eax, 0xff0000
shr ecx, 0x10
or eax, ecx
mov dword [ebp - 0x24], 0x2000000
shr eax, 8
or edx, eax
mov dword [ebp - 0x20], edx
cmp dword [edi + 8], 0xffffffff
je 0x443419
cmp byte [edi + 0x1a], 0
jne 0x44320a
cmp byte [edi + 0x18], 0
je 0x44320a
mov eax, dword [edi + 0x10]
mov al, byte [eax + 0x21]
test al, al
je 0x44320a
push 1
lea eax, [ebp - 0x2a]
mov byte [ebp - 0x2a], 7
push eax
mov ecx, edi
call fcn.004862f0
push 0xc
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004862f0
jmp 0x443419
cmp dword [edi], 0
jne 0x443115
mov byte [esi + 0x508], 1
jmp 0x443425
cmp byte [edi + 0x18], 0
mov ecx, 0xc
je 0x44326c
mov eax, dword [edi + 0x10]
mov al, byte [eax + 0x21]
test al, al
je 0x44326c
cmp byte [edi + 0x68], 0
je 0x443243
mov ecx, dword [edi + 0x64]
add ecx, dword [edi + 0x6c]
movq xmm0, qword [ebp - 0x28]
movq qword [ecx], xmm0
mov eax, dword [ebp - 0x20]
mov dword [ecx + 8], eax
add dword [edi + 0x6c], 0xc
jmp 0x443419
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
push 0xc
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00486620
mov ecx, dword [ebp - 0x38]
push ecx
push eax
mov ecx, edi
call fcn.004860d0
jmp 0x443419
push ecx
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.004860d0
jmp 0x443419
lea edi, [esi + 0x50c]
xor al, al
mov ebx, 0x2400
mov dword [ebp - 0x34], ebx
cmp byte [esi + 0x518], al
je 0x4432bc
push dword [edi]
lea eax, [ebp - 0x34]
push dword [esi + 0x4e0]
push eax
push dword [esi + 0x4e4]
call fcn.004c5750
add esp, 0x10
test eax, eax
jne 0x443441
mov ebx, dword [ebp - 0x34]
mov al, 1
mov edi, dword [edi]
movzx ecx, al
xor eax, eax
cmp ebx, edi
mov dword [ebp - 0x40], edi
mov word [ebp - 0x1c], 0x507
cmova ecx, eax
movzx eax, cl
shl eax, 0x18
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], eax
test cl, cl
je 0x443306
mov edx, ebx
mov eax, ebx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov ecx, ebx
mov eax, ebx
shl ecx, 0x10
and eax, 0xff00
shr edx, 8
or ecx, eax
shl ecx, 8
jmp 0x443329
mov edx, edi
mov eax, edi
and eax, 0xff00
shl edx, 0x10
or edx, eax
mov ecx, edi
mov eax, edi
shl edx, 8
and ecx, 0xff0000
shr eax, 0x10
or ecx, eax
shr ecx, 8
mov edi, dword [esi + 0x198]
or edx, ecx
mov dword [ebp - 0x14], edx
cmp dword [edi + 8], 0xffffffff
jne 0x443344
mov eax, dword [ebp - 0x40]
xor ecx, ecx
jmp 0x4433e5
cmp byte [edi + 0x1a], 0
jne 0x44337a
cmp byte [edi + 0x18], 0
je 0x44337a
mov eax, dword [edi + 0x10]
mov al, byte [eax + 0x21]
test al, al
je 0x44337a
push 1
lea eax, [ebp - 0x2b]
mov byte [ebp - 0x2b], 7
push eax
mov ecx, edi
call fcn.004862f0
push 0xc
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004862f0
jmp 0x4433d9
cmp byte [edi + 0x18], 0
mov ecx, 0xc
je 0x4433cd
mov eax, dword [edi + 0x10]
mov al, byte [eax + 0x21]
test al, al
je 0x4433cd
cmp byte [edi + 0x68], 0
je 0x4433b0
mov ecx, dword [edi + 0x64]
add ecx, dword [edi + 0x6c]
movq xmm0, qword [ebp - 0x1c]
movq qword [ecx], xmm0
mov eax, dword [ebp - 0x14]
mov dword [ecx + 8], eax
add dword [edi + 0x6c], 0xc
jmp 0x4433d9
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push 0xc
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00486620
mov ecx, dword [ebp - 0x3c]
jmp 0x4433d0
lea eax, [ebp - 0x1c]
push ecx
push eax
mov ecx, edi
call fcn.004860d0
mov eax, dword [esi + 0x50c]
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x34]
test ecx, ecx
setne byte [ebp - 0x29]
test ecx, ecx
je 0x443416
cmp byte [ebp - 0x44], 0
mov ecx, dword [esi + 0x198]
je 0x443404
push ebx
push dword [esi + 0x4e4]
jmp 0x44340b
push eax
push dword [esi + 0x4e0]
call fcn.00486260
test eax, eax
setne byte [ebp - 0x29]
mov ebx, dword [ebp - 0x30]
mov eax, dword [esi + 0x50c]
add dword [esi + 0x510], eax
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0x29], 0
jne 0x443084
xor al, al
jmp 0x443479
push eax
push str.d:_saasultravncwinvncwinvnc_vncclient.cpp_:_Compress_returned_error_in_File_Send_:_d_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
mov byte [esi + 0x519], 1
mov ecx, esi
call fcn.004434a0
mov ebx, dword [ebp - 0x30]
jmp 0x443470
mov ecx, esi
call fcn.004434a0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
mov ecx, esi
call edx
mov ebx, eax
jmp 0x4430a7