Function at 0x401601
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
push edi
push 0x2711
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [esp + 0x14], eax
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
je 0x4016a2
push dword [esp + 0x238]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov edi, 0x2710
push edi
push 1
push eax
call ebx
add esp, 0x10
mov ebp, eax
cmp ebp, edi
jne 0x40167e
push dword [esp + 0x23c]
push edi
push 1
push dword [esp + 0x20]
call dword [sym.imp.MSVCRT.dll_fwrite]
push dword [esp + 0x248]
mov esi, eax
sub esi, edi
push edi
push 1
push dword [esp + 0x30]
neg esi
sbb esi, esi
inc esi
call ebx
add esp, 0x20
mov ebp, eax
test esi, esi
jne 0x401644
test esi, esi
je 0x4016a2
push dword [esp + 0x23c]
push ebp
push 1
push dword [esp + 0x20]
call dword [sym.imp.MSVCRT.dll_fwrite]
mov esi, eax
add esp, 0x10
sub esi, ebp
neg esi
sbb esi, esi
inc esi
xor edi, edi
cmp dword [esp + 0x23c], edi
je 0x4016bb
push dword [esp + 0x23c]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
cmp dword [esp + 0x238], edi
je 0x4016d2
push dword [esp + 0x238]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
cmp esi, edi
je 0x4018cb
push 0x405634
mov dword [esp + 0x14], edi
push dword [esp + 0x244]
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
xor eax, eax
cmp ebp, edi
pop ecx
setne al
mov esi, eax
pop ecx
cmp esi, edi
je 0x40187b
push 2
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push ebp
call edi
mov esi, eax
add esp, 0xc
neg esi
sbb esi, esi
inc esi
je 0x40187b
push ebp
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
mov esi, eax
pop ecx
test esi, esi
je 0x40187b
lea eax, [ebx - 8]
push 0
push eax
push ebp
call edi
mov esi, eax
add esp, 0xc
neg esi
sbb esi, esi
inc esi
je 0x40187b
and byte [esp + 0x1c], 0
xor eax, eax
lea edi, [esp + 0x1d]
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [esp + 0x24]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x40178d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_atol]
pop ecx
mov edi, eax
jmp 0x401793
mov edi, dword [esp + 0x10]
xor esi, esi
test esi, esi
je 0x40187b
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [esp + 0x18], eax
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
test esi, esi
je 0x401869
sub ebx, edi
push 0
lea eax, [ebx - 8]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll_fseek]
mov esi, eax
add esp, 0xc
neg esi
sbb esi, esi
inc esi
je 0x401869
push ebp
push edi
push 1
push dword [esp + 0x24]
call dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
add esp, 0x10
sub esi, edi
neg esi
sbb esi, esi
inc esi
je 0x401869
push str.cabinet.dll
lea eax, [esp + 0x30]
push dword [esp + 0x248]
push 0x4054c0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x3c]
push 0x4054bc
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x18
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
mov dword [esp + 0x10], eax
test esi, esi
je 0x401869
push eax
push edi
push 1
push dword [esp + 0x24]
call dword [sym.imp.MSVCRT.dll_fwrite]
mov esi, eax
add esp, 0x10
sub esi, edi
neg esi
sbb esi, esi
inc esi
je 0x401869
push 0
push 0
push ebp
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
add ebx, 0xfffffff8
push ebx
push ebp
call fcn.0040288e
mov esi, eax
cmp dword [esp + 0x18], 0
je 0x40187b
push dword [esp + 0x18]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor edi, edi
cmp ebp, edi
je 0x401889
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
cmp dword [esp + 0x10], edi
je 0x40189a
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
cmp esi, edi
je 0x4018cb
push dword [esp + 0x244]
push dword [esp + 0x244]
call fcn.00402fcf
movzx esi, al
cmp esi, edi
jne 0x4018cb
push 0x10
push str.NAI_Agent_Installtion
push str.Fail_to_extract_the_agent_install_package._nPlease_advise_your_Policy_Orchestrator_system_administrator.
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x14], edi
je 0x4018db
push dword [esp + 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret