Function at 0x656110
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b9b4b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x831184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x65616b
mov eax, dword [ebx]
sub esp, 0xc
lea ecx, [ebp - 0x40]
push 3
push 1
push SysReAllocString
push eax
call fcn.00415b70
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x6561c3
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 8
lea eax, [ebp - 0x58]
push eax
push esi
call ebx
test eax, eax
jne 0x6561a7
call fcn.00415b30
cmp dword [ebp - 0x58], 0x53534e53
je 0x6561ca
cmp dword [ebp - 0x54], 1
je 0x6561ca
test esi, esi
je 0x6561c3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor bl, bl
jmp 0x656623
lea eax, [ebp - 0x44]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x50], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x48], eax
cmp eax, 0xffffffff
jne 0x656201
call fcn.00415b30
test eax, eax
js 0x65629c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x44]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor dl, dl
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x18], ecx
mov edi, 8
mov byte [ebp - 0x91], dl
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
test ecx, ecx
jb 0x65656e
ja 0x656250
cmp eax, edi
jbe 0x65656e
nop
push 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x34], 0
push eax
push edi
push esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x656279
call fcn.00415b30
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 2
lea eax, [ebp - 0x34]
push eax
push esi
call ebx
test eax, eax
jne 0x6562ad
call fcn.00415b30
test eax, eax
jmp 0x6562b1
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x98], eax
jmp 0x656204
cmp dword [ebp - 0x14], 2
jne 0x656441
mov eax, dword [ebp - 0x34]
test ax, ax
je 0x656441
push ecx
lea ecx, [ebp - 0x92]
movzx eax, ax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
mov byte [ebp - 0x92], 0
call fcn.0041e2a0
push 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
movzx eax, word [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
push ecx
push eax
push ebx
push esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x65631e
call fcn.00415b30
test eax, eax
jmp 0x656324
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x14], eax
jne 0x656435
movzx ecx, word [ebp - 0x34]
add edi, 2
mov eax, dword [ebx]
add edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x48], eax
cmp al, 6
jne 0x6563e8
mov edi, dword [ebx + 0xd]
test edi, edi
je 0x6563e8
cmp edi, ecx
jae 0x6563e8
push 0
push edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.0041b2e0
mov byte [ebp - 4], 3
lea eax, [ebx + 0x11]
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
push edi
cmovae ecx, dword [ebp - 0x70]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004057b0
add esp, 0x14
mov byte [ebp - 4], 4
call fcn.00451ae0
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.0058b550
lea ecx, [ebp - 0x90]
test al, al
je 0x6563d7
mov byte [ebp - 0x91], 1
call fcn.00404490
lea ecx, [ebp - 0x70]
call fcn.00407a10
jmp 0x65640a
call fcn.00404490
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00407a10
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
push ecx
cmp dword [ebp - 0x1c], eax
je 0x656401
mov ecx, eax
call fcn.004795e0
add dword [ebp - 0x20], 0xc
jmp 0x65640a
push eax
lea ecx, [ebp - 0x24]
call fcn.00656b60
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040f050
xor eax, eax
cmp eax, dword [ebp - 0x18]
ja 0x656441
mov edi, dword [ebp - 0x14]
jb 0x65642a
cmp edi, dword [ebp - 0x98]
jae 0x656441
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x656250
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040f050
cmp byte [ebp - 0x91], 0
je 0x65656e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x656462
push esi
call edi
mov dword [ebp - 0x40], 0
mov ebx, dword [ebp - 0x38]
cmp dword [ebx + 0x14], 8
jb 0x65646d
mov ebx, dword [ebx]
sub esp, 0xc
lea ecx, [ebp - 0x40]
push 2
push 2
push 0x40000000
push ebx
call fcn.00415b70
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x6565f5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x38]
push eax
push 8
lea eax, [ebp - 0x58]
push eax
push esi
call ebx
test eax, eax
jne 0x6564c7
call fcn.00415b30
test eax, eax
je 0x6564c7
test esi, esi
je 0x6565f5
push esi
call edi
xor esi, esi
mov byte [ebp - 0x91], 0
jmp 0x656582
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
cmp edi, eax
je 0x65656e
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push edi
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.004795e0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
movzx eax, ax
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x4c]
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x656520
call fcn.00415b30
mov ebx, eax
jmp 0x656522
xor ebx, ebx
movzx eax, word [ebp - 0x18]
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x656542
call fcn.00415b30
jmp 0x656544
xor eax, eax
test ebx, ebx
jne 0x6565e0
test eax, eax
jne 0x6565e0
lea ecx, [ebp - 0x30]
call fcn.0040f050
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 0xc
cmp edi, dword [ebp - 0x38]
jne 0x6564e0
test esi, esi
je 0x65657b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov byte [ebp - 0x91], 1
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x65661d
mov ebx, dword [ebp - 0x20]
cmp edi, ebx
je 0x6565a2
mov ecx, edi
call fcn.0040f050
add edi, 0xc
cmp edi, ebx
jne 0x656594
mov ecx, dword [ebp - 0x1c]
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x24]
sub ecx, edi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 2
cmp ecx, 0x1000
jb 0x6565fe
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x6565fe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test esi, esi
je 0x6565ed
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea ecx, [ebp - 0x30]
call fcn.0040f050
mov byte [ebp - 0x91], 0
jmp 0x656582
push ecx
push edi
call fcn.0076e8f3
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov bl, byte [ebp - 0x91]
test esi, esi
je 0x65662e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076eb7e
mov esp, ebp
pop ebp
ret 4