Function at 0x46fcc1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x424
mov esi, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x420], eax
lea ebx, [esp + 0x14]
mov dword [ebx], 0
call fcn.0046fbc4
push ebx
mov dword [esp + 4], eax
push eax
call fcn.0046f668
add esp, 8
mov ebx, eax
mov ebp, 0
cmp eax, 0xffffffff
je 0x46fd57
mov esi, dword [esp + 0x438]
push esi
call fcn.0045b044
add esp, 4
xor ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
sub eax, ebp
jbe 0x46fd67
mov ecx, dword [esi]
add ecx, ebp
push 0
lea edx, [esp + 0x24]
push edx
push eax
push ecx
push ebx
call edi
add ebp, dword [esp + 0x20]
test eax, eax
jne 0x46fd28
xor ebp, ebp
mov esi, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
xor eax, eax
mov dword [edi], eax
mov dword [esp + 4], 0
mov dword [esi], eax
jmp 0x46fdc2
mov edi, dword [esp + 0x444]
test edi, edi
je 0x46fec4
xor ebp, ebp
push ebp
push 0x10
push 1
call fcn.004115d0
add esp, 0xc
mov esi, eax
push ebp
push eax
push 0x4700a7
push ebx
call fcn.0046b0d8
add esp, 0x10
mov dword [esi], eax
call fcn.0045af6b
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov dword [esp + 4], esi
mov eax, dword [esp + 0x448]
mov dword [esi + 0xc], eax
xor ebx, ebx
mov esi, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
push dword [esp + 0x14]
call fcn.00411645
add esp, 4
push dword [esp]
call fcn.00411645
add esp, 4
cmp ebx, 0xffffffff
je 0x46fde5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x46fdf2
push ebp
call fcn.0045af73
add esp, 4
mov ebx, dword [esp + 4]
test ebx, ebx
jne 0x47004f
cmp dword [edi], 0
jne 0x47004f
xor eax, eax
mov dword [edi], eax
mov dword [esi], eax
mov eax, dword [esp + 0x438]
cmp dword [eax + 8], 0x40000
ja 0x47004f
mov eax, 0x4a8286
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x47004f
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.PageantRequest_08x
call fcn.0045abe5
add esp, 8
mov edi, eax
xor esi, esi
call fcn.004706b8
mov ecx, 0
test al, al
je 0x46ff41
call fcn.00470817
test eax, eax
je 0x46ff3d
mov esi, eax
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
je 0x46ff3d
mov ebx, eax
push 1
push eax
call dword [0x4c443c]
test eax, eax
je 0x46ff36
push 0
push esi
push ebx
call dword [0x4c4440]
test eax, eax
je 0x46ff36
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x14]
mov esi, ebx
jmp 0x46ff41
call fcn.0045af6b
mov ebp, eax
lea esi, [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46fd49
mov ecx, ebp
mov edx, esi
push dword [esp + 0x10]
call fcn.0047006a
add esp, 4
test eax, eax
je 0x46fecf
mov edi, eax
cmp eax, 0xffffffff
je 0x46fd49
push ebp
call fcn.0045afa2
add esp, 4
mov ecx, dword [esp + 0x43c]
mov dword [ecx], eax
mov esi, dword [esp + 0x440]
mov dword [esi], edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 4], 0
jmp 0x46fdc2
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
xor ecx, ecx
push edi
push 0x40000
push 0
push 4
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
inc eax
cmp eax, 1
ja 0x46ff6e
push edi
call fcn.00411645
add esp, 4
mov ebx, dword [esp + 4]
jmp 0x47004f
mov dword [esp + 0xc], esi
sub esp, 0x14
movaps xmm0, xmmword [0x4a1990]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 8], edi
mov edi, eax
mov esi, dword [esp + 0x438]
push esi
call fcn.0045b044
add esp, 4
push dword [esi + 8]
push dword [esi]
mov dword [esp + 8], edi
push edi
mov edi, dword [esp + 0x14]
call fcn.00478020
add esp, 0xc
lea esi, [esp + 0x20]
mov dword [esi], 0x804e50ba
push edi
call fcn.004855c0
add esp, 4
inc eax
mov dword [esi + 4], eax
mov dword [esi + 8], edi
push esi
push 0
push 0x4a
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x470023
mov eax, dword [esp]
mov ebp, dword [eax]
bswap ebp
lea eax, [ebp - 1]
cmp eax, 0x3fffb
ja 0x470023
add ebp, 4
push 0
push 1
push ebp
call fcn.004115d0
add esp, 0xc
mov esi, eax
push ebp
push dword [esp + 4]
push eax
call fcn.00478020
add esp, 0xc
mov eax, dword [esp + 0x43c]
mov dword [eax], esi
mov eax, dword [esp + 0x440]
mov dword [eax], ebp
push dword [esp]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00411645
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
mov ebx, dword [esp + 4]
je 0x47004f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00475526
mov eax, ebx
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret