Function at 0x4c9f2d
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2c
cmp dword [eax + 0x14], 8
jb 0x4c9f3c
mov eax, dword [eax]
push ebx
push ebp
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
mov dword [esp + 8], ebp
cmp ebp, 0xffffffff
je 0x4ca1ba
push ebx
push ebp
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x4ca1b3
push esi
push edi
lea edi, [ebx + 1]
push edi
call fcn.006db7db
mov esi, eax
mov dword [esp + 0x44], esi
pop ecx
test esi, esi
je 0x4ca1b1
push edi
xor edi, edi
push edi
push esi
call fcn.006dca70
add esp, 0xc
lea eax, [esp + 0x14]
push edi
push eax
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ca1aa
cmp dword [esp + 0x14], ebx
jne 0x4ca1aa
mov ecx, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0xf
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c9fd9
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x2c]
call fcn.004519c9
mov ebp, dword [esp + 0x38]
lea ecx, [esp + 0x24]
mov esi, dword [esp + 0x24]
cmp ebp, 0x10
mov eax, dword [esp + 0x34]
cmovae ecx, esi
mov dword [esp + 0x18], ecx
cmp eax, 0x23
jb 0x4ca04a
add eax, 0xffffffde
add eax, ecx
mov dword [esp + 0x1c], eax
sub eax, ecx
push eax
push 0x22
push ecx
jmp 0x4ca03c
push 0x23
push str._mkndcbhcgphcfkkddanakjiepeknbgle_:
push edi
call fcn.006dd88d
add esp, 0xc
test eax, eax
je 0x4ca085
mov eax, dword [esp + 0x1c]
inc edi
sub eax, edi
push eax
push 0x22
push edi
call fcn.006dd7e0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4ca01d
cmp ebp, 0x10
jb 0x4ca190
lea eax, [ebp + 1]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], eax
cmp eax, 0x1000
jb 0x4ca187
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00450606
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
jmp 0x4ca185
sub edi, dword [esp + 0x18]
cmp edi, 0xffffffff
je 0x4ca04a
test edi, edi
je 0x4ca04a
mov ecx, dword [esp + 0x40]
dec edi
mov al, byte [edi + ecx]
cmp al, 0x20
je 0x4ca096
cmp al, 9
je 0x4ca096
cmp al, 0xd
je 0x4ca096
cmp al, 0xa
je 0x4ca096
mov edx, dword [esp + 0x34]
lea eax, [edi + 1]
cmp ebp, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x24]
cmovae ecx, esi
xor edi, edi
inc edi
mov dword [esp + 0x20], ecx
cmp edx, edi
jb 0x4ca04a
lea eax, [edx - 1]
cmp dword [esp + 0x18], eax
ja 0x4ca04a
add edx, ecx
add ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], edx
sub edx, ecx
push edx
push 0x7b
push ecx
jmp 0x4ca108
movzx ecx, byte [edx]
cmp cl, 0x7b
jne 0x4ca0f5
xor eax, eax
jmp 0x4ca0f9
sbb eax, eax
or eax, edi
test eax, eax
je 0x4ca11b
mov eax, dword [esp + 0x1c]
inc edx
sub eax, edx
push eax
push 0x7b
push edx
call fcn.006dd7e0
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x4ca0e9
jmp 0x4ca04a
sub edx, dword [esp + 0x20]
cmp edx, 0xffffffff
je 0x4ca04a
lea ecx, [edx + 1]
cmp ebp, 0x10
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x24]
cmovae eax, esi
mov al, byte [eax + ecx]
cmp al, 0x7b
jne 0x4ca143
inc edi
jmp 0x4ca148
cmp al, 0x7d
jne 0x4ca148
dec edi
test edi, edi
je 0x4ca153
test al, al
je 0x4ca157
inc ecx
jmp 0x4ca12b
cmp al, 0x7d
je 0x4ca1c0
cmp ebp, 0x10
jb 0x4ca190
lea eax, [ebp + 1]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
cmp eax, 0x1000
jb 0x4ca187
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00450606
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
pop ecx
pop ecx
push eax
push esi
call fcn.006db2db
pop ecx
pop ecx
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x40]
and dword [esp + 0x34], 0
mov dword [esp + 0x38], 0xf
mov byte [esp + 0x24], 0
push esi
call fcn.006db30c
pop ecx
pop edi
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
add esp, 0x2c
ret
mov ebp, dword [esp + 0x10]
xor esi, esi
push esi
push esi
push dword [esp + 0x20]
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4ca21c
mov eax, dword [esp + 0x38]
cmp eax, 0x10
jb 0x4ca194
mov ecx, dword [esp + 0x24]
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
cmp eax, 0x1000
jb 0x4ca20e
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00450606
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
jmp 0x4ca194
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push esi
mov esi, dword [esp + 0x44]
inc eax
push ecx
sub ebx, eax
add eax, esi
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ca249
cmp ebx, dword [esp + 0x14]
jne 0x4ca249
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esp + 0x38]
cmp eax, 0x10
jb 0x4ca198
mov ecx, dword [esp + 0x24]
inc eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x40], eax
cmp eax, 0x1000
jb 0x4ca283
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00450606
mov eax, dword [esp + 0x48]
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
jmp 0x4ca198