Function at 0x43ff10
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x628
mov eax, dword [0x589758]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x638]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43ff6c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4401e4
push ebp
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x20]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
call ebp
push ebx
lea edx, [esp + 0x18]
push edx
push 0x600
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x4401da
mov ecx, 0xaa55
cmp word [esp + 0x232], cx
jne 0x4401da
mov edx, ecx
cmp word [esp + 0x432], dx
jne 0x4401da
mov eax, ecx
cmp word [esp + 0x632], ax
jne 0x4401da
cmp dword [esp + 0x234], 0x41615252
jne 0x4401da
cmp dword [esp + 0x418], 0x61417272
jne 0x4401da
lea ecx, [esp + 0xb4]
push edi
push ecx
call fcn.00509315
add esp, 8
test eax, eax
je 0x440067
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x440023
sub eax, edx
cmp eax, 0x104
ja 0x44004a
lea edx, [esp + 0xb4]
mov eax, edi
sub edx, edi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x440040
push ebx
push ebx
push ebx
push esi
call ebp
push ebx
lea edx, [esp + 0x18]
push edx
push 0x600
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
movzx edi, word [esp + 0x42]
mov cl, byte [esp + 0x44]
mov ebx, dword [esp + 0x58]
push 0
push 0
mov edx, edi
shl edx, 9
push edx
push esi
mov byte [esp + 0x23], cl
call ebp
push 0x200
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004f67e0
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4401da
cmp dword [esp + 0x34], 0xffffff8
jne 0x4401da
cmp byte [esp + 0x13], 2
jne 0x44011d
push 0
push 0
add edi, ebx
shl edi, 9
push edi
push esi
call ebp
push 0x200
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004f67e0
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x200
lea edx, [esp + 0x40]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4401da
cmp dword [esp + 0x34], 0xffffff8
jne 0x4401da
push 0
push 0
push 0x1c00
push esi
call ebp
push 0
lea eax, [esp + 0x18]
push eax
push 0x200
push 0x5bf538
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4401da
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push 0x1f0
push 0x5bf538
mov ecx, edi
call fcn.0043a860
cmp dword [0x5bf734], 0x54495753
jne 0x4401da
mov edx, dword [0x5bf72c]
cmp edx, dword [esp + 0x18]
jne 0x4401da
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200000
push 0
push 0x5bf848
call fcn.004f67e0
mov ecx, dword [esp + 0x30]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0x5bf848
push ecx
mov ecx, 0x7c4578
call fcn.0041b620
test eax, eax
je 0x4401e1
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edx
push 0x5bf848
push eax
push ecx
mov ecx, edi
call fcn.0043cd00
neg eax
sbb eax, eax
neg eax
jmp 0x4401e3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x630]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f6592
add esp, 0x628
ret 4