Function at 0x40fe9f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fdc6
mov eax, dword fs:[0]
push eax
mov eax, 0x1550
call fcn.00438600
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2b8]
xor ebx, ebx
mov dword [ebp - 0x1420], eax
cmp ecx, ebx
je 0x4103d4
cmp dword [eax + 0x1b0], ebx
je 0x4103d4
add eax, 0x2a4
push eax
lea eax, [ebp - 0x1454]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x1428], esp
push 2
push 0x448254
call fcn.0040801d
lea edi, [ebp - 0x1500]
call fcn.00426ea5
mov dword [ebp - 4], 2
call fcn.0042700a
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 0x10
jb 0x40ff40
mov eax, dword [eax + 4]
jmp 0x40ff43
add eax, 4
mov edi, dword [ebp - 0x1420]
push eax
lea eax, [edi + 0x19c]
push eax
lea eax, [ebp - 0x148c]
push eax
call fcn.00419421
add esp, 0xc
push eax
lea eax, [ebp - 0x1470]
push eax
mov byte [ebp - 4], 4
call fcn.004194db
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x288]
push eax
mov byte [ebp - 4], 5
call fcn.004031c2
push ebx
push 1
lea ecx, [ebp - 0x1470]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0x148c]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0x1454]
call fcn.0040329c
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x1500]
call fcn.00417161
call fcn.004094e1
test eax, eax
je 0x40ffce
call fcn.0040a50d
lea eax, [ebp - 0x1415]
mov byte [ebp - 0x1415], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ffdd
sub eax, edx
je 0x40ffed
call fcn.0040a57e
lea eax, [edi + 0x288]
cmp dword [eax + 0x18], 0x10
jb 0x40fffe
mov eax, dword [eax + 4]
jmp 0x410001
add eax, 4
push ebx
push 0x80
push 3
push ebx
push ebx
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4100fb
xor eax, eax
mov dword [ebp - 0x1434], ebx
lea edi, [ebp - 0x1430]
stosd dword es:[edi], eax
lea eax, [ebp - 0x1434]
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, ebx
je 0x4100fb
mov eax, dword [ebp - 0x1430]
mov edi, dword [ebp - 0x1434]
mov dword [ebp - 0x1428], eax
call fcn.004094e1
test eax, eax
je 0x410069
call fcn.0040a645
push ebx
push 0x989680
push dword [ebp - 0x1428]
push edi
call fcn.004336d0
mov edi, dword [ebp - 0x1420]
sub eax, 0xb6109100
push 0xfff
mov dword [edi + 0x280], eax
lea eax, [ebp - 0x1413]
sbb edx, 2
push ebx
push eax
mov dword [edi + 0x284], edx
mov byte [ebp - 0x1414], bl
call fcn.00431170
add esp, 0xc
push ebx
call fcn.0042a13f
pop ecx
push ebx
call fcn.0042a13f
pop ecx
push ebx
mov dword [ebp - 0x141c], ebx
call fcn.0042a13f
or dword [ebp - 4], 0xffffffff
pop ecx
push ebx
lea eax, [ebp - 0x141c]
push eax
push 0xa
lea eax, [ebp - 0x1414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x410377
cmp dword [ebp - 0x141c], ebx
jne 0x410377
cmp esi, ebx
je 0x410106
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00428e21
cdq
mov esi, 0xff
mov ecx, esi
idiv ecx
mov edi, edx
shl edi, 8
call fcn.00428e21
cdq
mov ecx, esi
idiv ecx
add edx, edi
shl edx, 8
mov dword [ebp - 0x141c], edx
call fcn.00428e21
cdq
mov ecx, esi
idiv ecx
mov edi, edx
add edi, dword [ebp - 0x141c]
shl edi, 8
call fcn.00428e21
cdq
idiv esi
mov esi, dword [ebp - 0x1420]
push 0x3ff
lea eax, [ebp - 0x413]
push ebx
push eax
mov byte [ebp - 0x414], bl
add edi, edx
mov dword [esi + 0x1f4], edi
call fcn.00431170
add esp, 0xc
push 0xa
push 0x400
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.0042a922
add esp, 0x10
lea eax, [ebp - 0x414]
lea ecx, [esi + 0x1f8]
push eax
call fcn.00403254
lea edi, [esi + 0x288]
cmp dword [edi + 0x18], 0x10
jb 0x4101af
mov eax, dword [edi + 4]
jmp 0x4101b2
lea eax, [edi + 4]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x141c], eax
cmp eax, 0xffffffff
jne 0x410243
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
push 7
pop ecx
mov esi, edi
mov edi, esp
lea eax, [ebp - 0x1454]
push eax
sub esp, 0x1c
rep movsd dword es:[edi], dword [esi]
mov esi, esp
mov dword [ebp - 0x1428], esp
push 0x26
push 0x448258
call fcn.0040801d
lea edi, [ebp - 0x1500]
call fcn.00426ea5
mov dword [ebp - 4], 0xc
call fcn.00426f18
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x18], 0x10
jb 0x41022a
mov eax, dword [eax + 4]
jmp 0x41022d
add eax, 4
mov ebx, dword [ebp - 0x1420]
push eax
push 1
call fcn.0040e8e1
add esp, 0x28
jmp 0x41042f
lea eax, [ebp - 0x1415]
mov dword [ebp - 0x1438], ebx
mov byte [ebp - 0x1415], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x410258
sub eax, edx
je 0x41026d
call fcn.0040a6b6
call fcn.004017c3
mov ecx, dword [esi + 0x20c]
lea eax, [esi + 0x1f8]
cmp dword [eax + 0x18], 0x10
jb 0x410284
mov eax, dword [eax + 4]
jmp 0x410287
add eax, 4
push ebx
lea edx, [ebp - 0x1438]
push edx
push ecx
push eax
push dword [ebp - 0x141c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1428], eax
lea eax, [ebp - 0x1415]
mov byte [ebp - 0x1415], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4102b2
sub eax, edi
je 0x4102c2
call fcn.0040a732
cmp dword [ebp - 0x1428], ebx
je 0x4102d6
cmp dword [ebp - 0x1438], ebx
jne 0x410361
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
push 7
pop ecx
mov edi, esp
lea eax, [ebp - 0x14a8]
push eax
sub esp, 0x1c
add esi, 0x288
rep movsd dword es:[edi], dword [esi]
mov esi, esp
mov dword [ebp - 0x1430], esp
push 0x24
push 0x448280
call fcn.0040801d
lea edi, [ebp - 0x1558]
call fcn.00426ea5
mov dword [ebp - 4], 0xe
call fcn.0042700a
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 0x10
jb 0x410331
mov eax, dword [eax + 4]
jmp 0x410334
add eax, 4
mov ebx, dword [ebp - 0x1420]
push eax
push 1
call fcn.0040e8e1
add esp, 0x28
push 0
push 1
lea ecx, [ebp - 0x14a8]
call fcn.0040329c
lea esi, [ebp - 0x1558]
call fcn.00417161
xor ebx, ebx
cmp dword [ebp - 0x141c], ebx
je 0x4103d0
push dword [ebp - 0x141c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4103d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x410391
dec eax
dec eax
je 0x410391
sub eax, 4
jne 0x41039c
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.0042a13f
pop ecx
lea eax, [ebp - 0x1414]
push eax
lea ecx, [edi + 0x1f8]
call fcn.00403254
push ebx
lea eax, [ebp - 0x1414]
push ebx
push eax
call fcn.0042ac68
add esp, 0xc
mov dword [edi + 0x1f4], eax
xor eax, eax
jmp 0x41044e
push dword [eax + 0x1b0]
lea eax, [ebp - 0x1454]
push ecx
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x1430], esp
push 0x21
push 0x448230
call fcn.0040801d
lea edi, [ebp - 0x1500]
call fcn.00426ea5
mov dword [ebp - 4], ebx
call fcn.00426f82
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 0x10
jb 0x41041b
mov eax, dword [eax + 4]
jmp 0x41041e
add eax, 4
mov ebx, dword [ebp - 0x1420]
push eax
push 1
call fcn.0040e8e1
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x1454]
call fcn.0040329c
lea esi, [ebp - 0x1500]
call fcn.00417161
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428582
leave
ret 4