Function at 0x414e30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x41e8ca
push eax
mov eax, 0x1150
mov dword fs:[0], esp
call fcn.0041ae80
mov eax, dword [0x4256f0]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
push 0
push 0x80
mov esi, 1
push 3
push 0
cmp eax, esi
push esi
mov dword [esp + 0x34], ecx
push 0xc0000000
jne 0x414e8d
add ecx, 0x1018
push ecx
call ebx
jmp 0x414e93
add ecx, 0x18
push ecx
call ebp
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x414ea3
xor eax, eax
jmp 0x415735
mov ecx, dword [esp + 0x1174]
mov edx, dword [esp + 0x1170]
push 0
push ecx
push edx
push eax
call fcn.00407150
mov eax, dword [0x4256f0]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x10
cmp eax, esi
push 0
jne 0x414f06
mov ecx, dword [esp + 0x117c]
push 0
lea eax, [esp + 0x64]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call edi
push 0
push 0x80
push 4
push 0
push 1
lea edx, [esp + 0x70]
push SysReAllocString
push edx
call ebx
jmp 0x414f20
mov eax, dword [esp + 0x117c]
push 0x80
push 4
push 0
push 1
push SysReAllocString
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x3c], esi
jne 0x414f3d
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x415735
cmp dword [0x4256f0], 1
jne 0x414f7f
mov eax, dword [esp + 0x1180]
xor ebp, ebp
push ebp
push ebp
lea edx, [esp + 0x64]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push ebp
push ebp
call edi
push ebp
push 0x80
push 4
push ebp
push 1
lea ecx, [esp + 0x70]
push SysReAllocString
push ecx
call ebx
mov dword [esp + 0x38], eax
jmp 0x414fa1
mov edx, dword [esp + 0x1180]
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocString
push edx
call ebp
mov dword [esp + 0x38], eax
xor ebp, ebp
or edi, 0xffffffff
cmp eax, edi
jne 0x414fbf
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
xor eax, eax
jmp 0x415735
push ebp
push ebp
push ebp
push eax
call fcn.00407150
push ebp
push ebp
push ebp
push esi
call fcn.00407150
mov ecx, dword [esp + 0x40]
add esp, 0x20
mov dword [esp + 0x34], 0x800
mov eax, dword [ecx + 0x181c]
cmp eax, 1
je 0x414ff5
cmp eax, 3
je 0x414ff5
cmp eax, 4
jne 0x414ffd
mov dword [esp + 0x34], 0x914
xor ebx, ebx
cmp eax, 1
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x50], ebp
je 0x41504c
cmp eax, 3
je 0x41504c
cmp eax, 2
je 0x415023
cmp eax, 4
jne 0x41507c
push 0xe270
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebp
mov dword [esp + 0x1168], 1
je 0x415071
mov ecx, eax
call fcn.00404160
jmp 0x415073
push 0xe250
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebp
mov dword [esp + 0x1168], ebp
je 0x415071
mov ecx, eax
call fcn.004025b0
jmp 0x415073
xor eax, eax
mov dword [esp + 0x1168], edi
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x44], ebp
je 0x415159
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
mov ebp, dword [esp + 0x1174]
test ebp, ebp
jl 0x4150c5
jg 0x4150b1
cmp dword [esp + 0x1170], 0x2800
jb 0x4150c5
mov esi, dword [esp + 0x1170]
mov edi, ebp
sub esi, 0x2800
sbb edi, 0
jmp 0x4150c9
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x10]
push 0
push edi
push esi
push eax
call fcn.00407150
add esp, 0x10
cmp edi, ebp
mov dword [esp + 0x1c], 0
jg 0x41513e
jl 0x4150f1
cmp esi, dword [esp + 0x1170]
jae 0x41513e
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push 0
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x168]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x41513e
mov edx, dword [ebx]
push eax
lea eax, [esp + 0x164]
mov ecx, ebx
push eax
call dword [edx + 0xc]
add esi, dword [esp + 0x1c]
adc edi, 0
cmp edi, ebp
jl 0x4150f1
jg 0x41513e
cmp esi, dword [esp + 0x1170]
jb 0x4150f1
mov edx, dword [ebx]
lea eax, [esp + 0x44]
lea ecx, [esp + 0x54]
push eax
push ecx
mov ecx, ebx
call dword [edx + 0x40]
mov edx, dword [ebx]
push 1
mov ecx, ebx
call dword [edx]
jmp 0x415160
mov ebp, dword [esp + 0x1174]
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x1170]
mov ecx, dword [esp + 0x58]
xor ebx, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
push ebx
push ebp
push edx
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], ebx
call fcn.00407150
mov ebp, dword [esp + 0x118c]
add esp, 0x10
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x41531b
mov ecx, dword [esp + 0x24]
mov eax, dword [ebp]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x48], ecx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x4c], edx
dec ecx
test eax, eax
je 0x4151c7
test ecx, ecx
jle 0x4151c9
mov eax, dword [eax + 4]
dec ecx
test eax, eax
jne 0x4151bb
test ecx, ecx
jne 0x4151e9
test eax, eax
je 0x4151e9
mov eax, dword [eax]
test eax, eax
je 0x4151e9
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x28]
mov edi, dword [ecx + 0x1a74]
mov ecx, dword [esp + 0x48]
sub ecx, edx
sbb esi, eax
mov eax, edi
cdq
push edx
push eax
push esi
push ecx
call fcn.0041ada0
xor esi, esi
mov ebp, eax
test edi, edi
jle 0x415304
xor edi, edi
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x18]
push 0
push edx
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x168]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4152fc
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x181c]
cmp eax, 1
je 0x415294
cmp eax, 3
je 0x415294
cmp eax, 2
je 0x41526a
cmp eax, 4
jne 0x4152b5
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
cdq
push edx
push eax
mov eax, edi
cdq
add eax, ecx
mov ecx, dword [esp + 0x30]
adc edx, ecx
lea ecx, [esp + 0x168]
push edx
push eax
push ecx
call fcn.004016d0
add esp, 0x14
jmp 0x4152b5
mov ecx, dword [esp + 0x24]
mov eax, edi
cdq
add eax, ecx
mov ecx, dword [esp + 0x28]
adc edx, ecx
push edx
lea edx, [esp + 0x164]
push eax
push edx
call fcn.00401790
add esp, 0xc
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x168]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
add ebx, ecx
mov ecx, dword [esp + 0x20]
adc eax, 0
inc esi
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0x1a74]
add edi, ebp
cmp esi, eax
jl 0x415221
jmp 0x415304
mov dword [esp + 0x40], 1
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x117c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x4154be
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], 0
mov eax, dword [ecx + 0x1a70]
test eax, eax
jle 0x4154be
mov ecx, dword [ebp + 4]
mov eax, dword [ebp]
dec ecx
test eax, eax
je 0x415358
test ecx, ecx
jle 0x41535a
mov eax, dword [eax + 4]
dec ecx
test eax, eax
jne 0x41534c
test ecx, ecx
jne 0x41549b
test eax, eax
je 0x41549b
mov edi, dword [eax]
test edi, edi
je 0x41549b
mov eax, dword [edi + 0xc]
cmp eax, 0x1000
jle 0x4153d2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x40]
add esp, 4
mov esi, eax
mov eax, dword [edi + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
add ebx, edi
push esi
adc edx, 0
mov dword [esp + 0x34], edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x41541d
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push 0
push edx
push eax
lea eax, [esp + 0x16c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x168]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
add ebx, ecx
adc eax, 0
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 4]
cmp eax, 1
jne 0x415453
mov eax, dword [ebp]
mov eax, dword [eax]
test eax, eax
je 0x415437
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp], 0
mov dword [ebp + 4], 0
jmp 0x4154a3
mov esi, dword [ebp]
add eax, 0xfffffffe
test esi, esi
je 0x415469
test eax, eax
jle 0x415469
mov esi, dword [esi + 4]
dec eax
test esi, esi
jne 0x41545d
mov eax, dword [esi + 4]
test eax, eax
je 0x4154a3
mov eax, dword [eax]
test eax, eax
je 0x41547f
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov dword [esi + 4], 0
mov eax, dword [ebp + 4]
add esp, 4
dec eax
mov dword [ebp + 4], eax
jmp 0x4154a3
mov dword [esp + 0x50], 1
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
inc eax
mov edx, dword [ecx + 0x1a70]
mov dword [esp + 0x1c], eax
cmp eax, edx
jl 0x415341
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4151a0
mov eax, dword [esp + 0x50]
test eax, eax
je 0x415194
mov edx, dword [esp + 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x38]
push eax
call edi
mov edx, dword [esp + 0x1170]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1174]
add ebx, edx
adc eax, ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov eax, dword [0x4256f0]
cmp eax, 1
push 0
jne 0x415553
mov edx, dword [esp + 0x1188]
push 0
lea ecx, [esp + 0x64]
push 0x104
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0x80
push 4
push 0
push 1
lea eax, [esp + 0x70]
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x415571
mov ecx, dword [esp + 0x1188]
push 0x80
push 4
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415586
mov edx, dword [esp + 0x10]
push edx
call edi
xor eax, eax
jmp 0x415735
push 0
push 0
push 0
push esi
call fcn.00407150
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x20]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x10
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x168]
push 0x800
push ecx
push esi
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4155d9
lea edx, [esp + 0x14]
push 0
push edx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
jmp 0x4155a5
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push 0x58
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
mov dword [esp + 0x1168], 2
je 0x41560a
mov ecx, eax
call fcn.00419ea0
mov esi, eax
jmp 0x41560c
xor esi, esi
push 0
mov ecx, esi
mov dword [esp + 0x116c], 0xffffffff
call fcn.00419f10
mov ecx, dword [esp + 0x11a0]
mov edx, dword [esp + 0x119c]
mov eax, dword [esp + 0x1198]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0041aaa0
mov ecx, dword [esp + 0x20]
mov eax, 2
mov ecx, dword [ecx + 0x181c]
dec ecx
cmp ecx, 6
ja case.0x415654.5
jmp dword [ecx*4 + 0x415750]
mov eax, 3
jmp case.0x415654.5
mov eax, 6
jmp case.0x415654.5
mov eax, 1
jmp case.0x415654.5
mov eax, 4
jmp case.0x415654.5
mov eax, 2
push eax
mov ecx, esi
call fcn.0041a060
push 0xfa
mov ecx, esi
call fcn.0041a0d0
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1194]
push edx
mov edx, dword [esp + 0x1194]
push eax
mov eax, dword [esp + 0x1194]
push ecx
mov ecx, dword [esp + 0x1194]
push edx
mov edx, dword [esp + 0x1184]
push eax
mov eax, dword [esp + 0x1184]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0041a730
lea ecx, [esp + 0x160]
push ecx
mov ecx, esi
call fcn.0041a9e0
test eax, eax
jbe 0x415712
lea edx, [esp + 0x14]
push 0
push edx
push eax
lea eax, [esp + 0x16c]
push eax
push ebx
call ebp
mov eax, dword [esp + 0x14]
test eax, eax
je 0x415712
lea ecx, [esp + 0x160]
push ecx
mov ecx, esi
call fcn.0041a9e0
test eax, eax
ja 0x4156e4
mov ecx, esi
call fcn.0041a010
test esi, esi
je 0x41572d
mov ecx, esi
call fcn.00419f00
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebx
call edi
mov eax, 1
mov ecx, dword [esp + 0x1160]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x115c
ret 0x34