Function at 0x427130
Capabilities:
Get file size
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b20ad
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
push ebx
push ebp
xor ebx, ebx
push edi
push ebx
call fcn.004247f0
mov ebp, dword [esp + 0x218]
add esp, 4
cmp ebp, ebx
je 0x427c63
cmp dword [esp + 0x218], ebx
je 0x427c63
cmp dword [0x4f679c], ebx
jne 0x427189
push 0xba0
push 2
jmp 0x427c6a
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xd5]
mov byte [esp + 0xd4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xd4]
push 1
push eax
mov dword [esp + 0x74], ebx
call fcn.0041dfb0
add esp, 8
test eax, eax
jne 0x4271c9
push 0xbac
push 7
jmp 0x427c6a
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x118]
mov dword [esp + 0x114], ebx
rep stosd dword es:[edi], eax
mov ecx, 0xd
lea edi, [esp + 0xa0]
mov dword [esp + 0x9c], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x54]
call fcn.0044ae30
lea ecx, [esp + 0x4c]
mov dword [esp + 0x20c], ebx
call fcn.0044ae30
lea ecx, [esp + 0x24]
mov byte [esp + 0x20c], 1
call fcn.0044ae30
mov eax, dword [esp + 0x21c]
mov byte [esp + 0x20c], 2
cmp eax, ebx
mov dword [esp + 0x64], ebx
je 0x427255
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.00421350
add esp, 8
cmp eax, ebx
je 0x427255
lea ecx, [esp + 0x24]
call fcn.0044b330
mov dword [esp + 0x64], eax
cmp word [esp + 0xa6], bx
push esi
mov dword [esp + 0x14], ebx
jne 0x427b4b
lea edx, [esp + 0x50]
push ebx
lea eax, [esp + 0x5c]
push edx
lea ecx, [esp + 0x120]
push eax
lea edx, [esp + 0xe4]
push ecx
push edx
call fcn.0041e0d0
add esp, 0x14
test eax, eax
je 0x427b5f
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x189]
mov byte [esp + 0x188], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x80]
lea ecx, [esp + 0x5c]
push eax
lea edx, [esp + 0x68]
push ecx
push edx
mov edx, dword [esp + 0x13b]
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x144]
lea ecx, [esp + 0x198]
push 0x40
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x160]
push edx
push eax
push ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0xa4], ebx
call fcn.0041fa10
mov esi, eax
add esp, 0x24
cmp esi, ebx
mov dword [esp + 0x60], esi
je 0x427b73
push esi
call fcn.00410ee0
add esp, 4
cmp eax, ebx
mov dword [esp + 0x7c], eax
je 0x427b87
push esi
call fcn.00422ac0
add esp, 4
lea edx, [esp + 0x4c]
mov word [esp + 0xa8], ax
mov dword [esp + 0x4c], ebx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov eax, dword [esp + 0x4c]
xor edi, edi
mov ebp, eax
push eax
mov eax, dword [esp + 0x220]
or edi, esi
or ebp, ebx
push esi
push eax
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], ebp
call fcn.00429600
add esp, 0xc
test eax, eax
je 0x427b98
cmp ebp, ebx
ja 0x427393
cmp edi, 0x200
jbe 0x42739d
mov dword [esp + 0x18], 0x200
jmp 0x4273ad
cmp edi, 0x1000
mov dword [esp + 0x18], edi
ja 0x427ba9
mov ecx, dword [esp + 0x7c]
push 0x1000
mov edx, dword [ecx]
call dword [edx + 8]
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esp + 0xac]
push eax
call fcn.00422a30
push 0x1000
mov dword [esp + 0x28], eax
call fcn.004a2973
mov ecx, dword [esp + 0x28]
mov edi, eax
push ecx
mov dword [esp + 0x48], edi
call fcn.004a2973
add esp, 0x10
cmp edi, ebx
mov dword [esp + 0x14], eax
je 0x427bf2
cmp eax, ebx
je 0x427bf2
mov ecx, 0x400
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x64]
cmp eax, ebx
je 0x427441
mov eax, dword [esp + 0xfc]
or al, 0x10
mov dword [esp + 0xfc], eax
cmp dword [esp + 0x5c], ebx
je 0x427457
mov eax, dword [esp + 0xfc]
or al, 0x20
mov dword [esp + 0xfc], eax
mov ebp, dword [esp + 0x218]
push ebp
call fcn.004251c0
mov dword [esp + 0x124], eax
mov ecx, dword [esp + 0x50]
xor eax, eax
add esp, 4
or eax, esi
or ecx, ebx
mov edx, eax
mov dword [esp + 0x124], ebx
and edx, 0xfff
mov dword [esp + 0xb0], eax
mov esi, edx
mov dword [esp + 0xb4], ecx
or esi, ebx
je 0x4274ce
cmp ecx, ebx
ja 0x4274a6
cmp eax, 0x1000
jbe 0x4274aa
mov esi, ebx
jmp 0x4274ae
mov edx, eax
mov esi, ecx
mov edi, eax
sub edi, edx
mov edx, ecx
sbb edx, esi
add edi, 0x1000
adc edx, ebx
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edx
jmp 0x4274dc
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc4], ecx
lea ecx, [esp + 0x150]
mov dword [esp + 0x14c], eax
push ecx
lea eax, [esp + 0x18c]
push edx
push eax
call fcn.0042f280
mov ecx, dword [esp + 0x8c]
add esp, 0xc
mov dword [esp + 0x164], ecx
lea ecx, [esp + 0x28]
call fcn.0044af90
xor edx, edx
mov dword [esp + 0xc8], ebx
cmp edx, eax
mov dword [esp + 0xd0], ebx
sbb ecx, ecx
mov dword [esp + 0xd4], 0x1000
and ecx, eax
mov eax, 0xfff001
add ecx, 0x100
mul ecx
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x1c]
shr edx, 4
inc edx
push ecx
shl edx, 0xc
mov dword [esp + 0x140], edx
mov dword [esp + 0xd0], eax
call fcn.00423a90
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 4
mov word [esp + 0xa6], ax
push ebx
push ebx
push ebx
push ebp
call esi
mov edi, dword [esp + 0x21c]
push ebx
push ebx
push ebx
push edi
call esi
mov eax, dword [esp + 0xfc]
lea edx, [esp + 0xd8]
push 1
or al, 1
push edx
push edi
mov dword [esp + 0x108], eax
call fcn.00422250
add esp, 0xc
test eax, eax
je 0x427bba
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x169]
mov byte [esp + 0x168], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x168]
push eax
push ebp
call fcn.00425050
add esp, 8
test eax, eax
je 0x427bc3
lea ecx, [esp + 0x168]
push ecx
call fcn.004250d0
add esp, 4
test eax, eax
je 0x427bcc
lea edx, [esp + 0x168]
push edx
call fcn.004251e0
add esp, 4
test eax, eax
je 0x427bd5
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1c9]
mov byte [esp + 0x1c8], bl
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x21c]
push ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x140]
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x84], 0x40
mov dword [esp + 0x7c], 1
mov dword [esp + 0x20], ebx
xor ebp, ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0xa4], ebx
call esi
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x427745
lea edx, [esp + 0x74]
lea eax, [esp + 0x1c8]
push edx
lea ecx, [esp + 0x8c]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x44]
push eax
mov eax, dword [esp + 0xb0]
push ecx
mov ecx, dword [esp + 0xb0]
lea edx, [esp + 0x38]
push 0x200
push edx
mov edx, dword [esp + 0x238]
push eax
push ecx
push edx
push ebx
mov dword [esp + 0x9c], ebx
call fcn.00428470
add esp, 0x30
xor ecx, ecx
cmp eax, ebx
sete cl
mov esi, ecx
cmp esi, ebx
mov dword [esp + 0x78], esi
jne 0x4279f4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
cmp ecx, eax
ja 0x427941
jae 0x427734
mov dword [esp + 0x24], 1
cmp ecx, ebx
jbe 0x42780a
mov esi, dword [esp + 0x34]
jmp 0x4277f4
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x218]
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42794d
mov ecx, dword [esp + 0x10]
cmp ecx, esi
jae 0x42777b
mov dword [esp + 0x24], 1
cmp ecx, ebx
jbe 0x42780a
mov eax, dword [esp + 0x88]
push eax
call fcn.00410ee0
add esp, 4
cmp eax, ebx
je 0x427959
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], ebx
push ecx
mov ecx, dword [esp + 0x30]
push 0x200
push ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x1e0]
push ecx
mov ecx, eax
call dword [edx + 0x14]
cmp eax, ebx
je 0x427965
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x90]
cmp eax, ecx
jne 0x42796e
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
add ebp, ecx
add edx, ecx
cmp ebp, 0x1000
mov dword [esp + 0x30], edx
jae 0x427828
cmp dword [esp + 0x24], ebx
je 0x42769f
lea eax, [esp + 0x94]
lea ecx, [esp + 0x54]
push eax
lea edx, [esp + 0x90]
push ecx
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x4c]
push ecx
push 0x1000
push edx
mov edx, dword [esp + 0x98]
lea ecx, [esp + 0x1a4]
push eax
mov eax, dword [esp + 0xc8]
push ecx
push edx
push eax
mov dword [esp + 0xb8], ebx
call fcn.0041e2d0
add esp, 0x2c
cmp eax, ebx
jne 0x427977
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
push ecx
push edx
push eax
call fcn.00422a60
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x84]
mov esi, eax
mov eax, dword [esp + 0x21c]
push ebx
push ecx
push esi
push edx
push eax
mov dword [esp + 0x98], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4279d9
cmp dword [esp + 0x84], esi
jb 0x4279e0
cmp dword [esp + 0xc8], ebx
jne 0x4278ed
mov dword [esp + 0xcc], esi
mov eax, dword [esp + 0xc8]
mov edx, dword [esp + 0x38]
inc eax
mov ecx, 0x400
mov dword [esp + 0xc8], eax
xor eax, eax
mov edi, edx
mov dword [esp + 0xd0], esi
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov esi, ecx
xor ebp, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov dword [esp + 0x30], edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [esp + 0x24], ebx
je 0x42769f
mov esi, dword [esp + 0x78]
jmp 0x4279f4
push 0xc97
push 0x20
jmp 0x4279e7
push 0xcac
push 0xd
jmp 0x4279e7
push 0xcbb
push 0xc
jmp 0x4279e7
push 0xcc4
push 0x12
jmp 0x4279e7
push 0xccb
push 0x12
jmp 0x4279e7
jge 0x4279d0
push 0x4f4c50
lea ecx, [esp + 0x1c]
call fcn.00447770
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x60]
push 0xce4
push ecx
push edx
push eax
lea ecx, [esp + 0x28]
push str.Error:_Encrypt_Data_Failed__File__Algrithm_d__DataLen_lu_KeyLen_lu__LINE_d
push ecx
mov byte [esp + 0x228], 3
call fcn.00449050
mov edx, dword [esp + 0x30]
push edx
call fcn.00424560
add esp, 0x1c
lea ecx, [esp + 0x18]
mov byte [esp + 0x210], 2
call fcn.00447cd0
push 0xce8
push 0x11
jmp 0x4279e7
push 0xcf3
jmp 0x4279e5
push 0xcfb
push 0xe
call fcn.00424810
add esp, 8
mov esi, 1
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x427a09
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x54], ebx
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x427a1e
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x427a33
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x427a48
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x2c], ebx
mov edi, dword [esp + 0x21c]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [esp + 0x24], ebx
je 0x427c01
cmp esi, ebx
jne 0x427c01
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0xd8]
push eax
push ecx
call fcn.00421980
add esp, 8
lea ecx, [esp + 0x48]
call fcn.0044ae30
lea ecx, [esp + 0x44]
mov byte [esp + 0x210], 4
call fcn.0044ae30
lea ecx, [esp + 0x40]
mov byte [esp + 0x210], 5
call fcn.0044ae30
lea edx, [esp + 0x40]
lea eax, [esp + 0x44]
push edx
push ebx
push ebx
push eax
push ebx
lea ecx, [esp + 0x5c]
push ebx
lea edx, [esp + 0x40]
push ecx
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x78]
push eax
lea edx, [esp + 0xc4]
push ecx
lea eax, [esp + 0x140]
push edx
lea ecx, [esp + 0x104]
push eax
push ecx
push edi
mov byte [esp + 0x248], 6
call fcn.00421ba0
add esp, 0x38
test eax, eax
je 0x427bde
cmp dword [esp + 0x224], ebx
je 0x427b0b
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [esp + 0x70], 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x210], 5
call fcn.0044af00
lea ecx, [esp + 0x44]
mov byte [esp + 0x210], 4
call fcn.0044af00
lea ecx, [esp + 0x48]
mov byte [esp + 0x210], 2
call fcn.0044af00
jmp 0x427c01
push 0xbc7
push 1
call fcn.00424810
add esp, 8
jmp 0x427c12
push 0xbce
push 8
call fcn.00424810
add esp, 8
jmp 0x427c12
push 0xbe4
push 0xb
call fcn.00424810
add esp, 8
jmp 0x427c12
push 0xbec
push 0xc
call fcn.00424810
add esp, 8
jmp 0x427c12
push 0xbff
push 0x25
call fcn.00424810
add esp, 8
jmp 0x427c12
push 0xc0e
push 0x20
call fcn.00424810
add esp, 8
jmp 0x427c12
push 0xc49
push 0x10
jmp 0x427bf9
push 0xc59
push 0xf
jmp 0x427bf9
push 0xc62
push 0x14
jmp 0x427bf9
push 0xc69
push 0x1f
jmp 0x427bf9
push 0xd2c
push 0x10
call fcn.00424810
add esp, 8
jmp 0x427b13
push 0xc1b
push 0x21
call fcn.00424810
add esp, 8
mov eax, dword [esp + 0x38]
cmp eax, ebx
je 0x427c12
push eax
call fcn.004a299c
add esp, 4
mov eax, dword [esp + 0x14]
pop esi
cmp eax, ebx
je 0x427c28
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0x20c], 1
call fcn.0044af00
lea ecx, [esp + 0x4c]
mov byte [esp + 0x20c], bl
call fcn.0044af00
lea ecx, [esp + 0x54]
mov dword [esp + 0x20c], 0xffffffff
call fcn.0044af00
mov eax, dword [esp + 0x6c]
jmp 0x427c77
push 0xb9a
push 1
call fcn.00424810
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x204]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x204
ret