Function at 0x4527e0
Capabilities:
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x474
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
je 0x452bbc
cmp eax, 3
jne 0x45292e
mov ebx, dword [esp + 0x490]
mov esi, dword [esp + 0x494]
mov eax, ebx
lea edi, [esp + 0x78]
push 0x419
mov ecx, dword [eax]
mov dword [esp + 0x6c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x70], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x74], ecx
xor ecx, ecx
mov cx, word [ebx + 2]
mov edx, dword [eax + 0xc]
mov eax, ecx
mov dword [esp + 0x78], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x490]
lea ecx, [esp + 0x6c]
push ecx
push esi
mov byte [esp + 0x74], 2
call dword [fcn.00467f58]
test al, al
jne 0x452872
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x474
ret
lea edx, [esp + 0x68]
push 0x419
push edx
push esi
mov byte [esp + 0x74], 1
call dword [fcn.00467f54]
test al, al
jne 0x4528b7
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x79
jne 0x452bd8
lea eax, [esp + 0x68]
push 0x419
push eax
push esi
mov byte [esp + 0x74], 1
call dword [fcn.00467f54]
test al, al
je 0x452892
mov edi, dword [esp + 0x49c]
xor ecx, ecx
mov cx, word [ebx + 4]
lea esi, [esp + 0x68]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [ebx + 4]
pop edi
pop esi
pop ebp
mov cl, byte [esp + eax + 0x5c]
mov eax, dword [esp + 0x48c]
mov byte [eax + 3], cl
mov dx, word [ebx + 4]
mov cl, byte [esp + edx + 0x5d]
xor edx, edx
mov byte [eax + 7], cl
mov dx, word [ebx + 4]
mov cl, byte [esp + edx + 0x5e]
xor edx, edx
mov byte [eax + 8], cl
mov dx, word [ebx + 4]
mov cl, byte [esp + edx + 0x5f]
xor edx, edx
mov byte [eax + 9], cl
mov dx, word [ebx + 4]
pop ebx
mov cl, byte [esp + edx + 0x5c]
mov byte [eax + 0xa], cl
mov eax, 1
add esp, 0x474
ret
cmp dword [0x467f40], ebx
jne 0x4529ab
cmp eax, 2
je 0x4529ab
mov esi, dword [esp + 0x48c]
mov edi, dword [esp + 0x490]
mov ecx, dword [esp + 0x494]
mov edx, esi
xor eax, eax
push edi
mov ax, word [edi + 2]
sar edx, 8
mov byte [esp + 0x14], dl
mov ebx, dword [esp + 0x14]
push eax
push ecx
push esi
push ebx
call fcn.004526d0
add esp, 0x14
test eax, eax
jne 0x45297f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret
mov edx, dword [esp + 0x498]
mov ecx, dword [esp + 0x49c]
xor eax, eax
push edx
mov ax, word [edi + 4]
push eax
push ecx
push esi
push ebx
call fcn.004525a0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret
mov ebp, dword [esp + 0x490]
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
xor edx, edx
mov ecx, ebp
mov dx, word [ebp + 2]
mov byte [esp + 0x17], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1c], al
mov eax, dword [esp + 0x494]
mov dword [esp + 0x20], edx
mov edx, dword [ecx]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], edx
mov esi, dword [esp + 0x48c]
mov eax, dword [ecx + 4]
push ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], ebx
mov edx, dword [ecx + 8]
mov word [esp + 0x18], 0x2c
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x18]
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x44], eax
push 0x50
push edx
lea eax, [esp + 0x24]
push 0x50
push eax
push 0x4d014
push esi
mov byte [esp + 0x38], 1
mov byte [esp + 0x3a], 0x10
mov byte [esp + 0x3b], 0x18
mov dword [esp + 0x44], 0x64
mov dword [esp + 0x4c], 0x30
mov byte [esp + 0x50], 0xdd
mov byte [esp + 0x51], 0xfe
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov cl, byte [esp + 0x16]
test cl, cl
jne 0x452bd8
cmp eax, ebx
je 0x452bd8
xor ecx, ecx
mov cx, word [ebp + 4]
add ecx, 5
push ecx
call fcn.00453168
mov ebx, eax
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov byte [esp + 0x1b], al
mov byte [esp + 0x1d], al
xor edx, edx
mov eax, ebp
mov dx, word [ebp + 4]
add esp, 4
mov ecx, dword [eax]
add edx, 5
mov dword [esp + 0x20], edx
mov dword [esp + 0x30], ecx
mov edx, dword [eax + 4]
push 0
mov dword [esp + 0x38], edx
mov word [esp + 0x18], 0x2c
mov ecx, dword [eax + 8]
mov byte [esp + 0x1c], 1
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x18]
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x44], edx
push 0x50
push ecx
lea edx, [esp + 0x24]
push 0x50
push edx
push 0x4d014
push esi
mov byte [esp + 0x3a], 0x10
mov byte [esp + 0x3c], 1
mov byte [esp + 0x3b], 0x18
mov dword [esp + 0x44], 0x64
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0x30
mov byte [esp + 0x50], 0xd1
mov byte [esp + 0x51], 0xfe
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov cl, byte [esp + 0x16]
test cl, cl
jne 0x452ba6
test eax, eax
je 0x452ba6
mov edi, dword [esp + 0x49c]
xor ecx, ecx
mov cx, word [ebp + 4]
mov esi, ebx
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x49c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov cx, word [ebp + 4]
mov dl, byte [ecx + ebx]
xor ecx, ecx
mov byte [eax + 3], dl
mov cx, word [ebp + 4]
mov dl, byte [ecx + ebx + 1]
xor ecx, ecx
mov byte [eax + 7], dl
mov cx, word [ebp + 4]
mov dl, byte [ecx + ebx + 2]
xor ecx, ecx
mov byte [eax + 8], dl
mov cx, word [ebp + 4]
mov dl, byte [ecx + ebx + 3]
xor ecx, ecx
mov byte [eax + 9], dl
mov cx, word [ebp + 4]
mov dl, byte [ecx + ebx + 4]
mov byte [eax + 0xa], dl
call fcn.004539c5
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret
push ebx
call fcn.004539c5
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret
mov edi, dword [esp + 0x490]
mov dword [esp + 0x10], ebx
push edi
mov dword [esp + 0x68], ebx
call fcn.004527c0
add esp, 4
test al, al
jne 0x452be5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x474
ret
mov esi, dword [esp + 0x48c]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x10]
push ebx
push eax
push 0x10
push edi
push esi
call ebp
mov ax, word [edi + 2]
cmp ax, bx
je 0x452c1e
mov edx, dword [esp + 0x494]
lea ecx, [esp + 0x10]
push ebx
and eax, 0xffff
push ecx
push eax
push edx
push esi
call ebp
mov ax, word [edi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ax, bx
je 0x452c44
mov edx, dword [esp + 0x49c]
lea ecx, [esp + 0x64]
push ebx
and eax, 0xffff
push ecx
push eax
push edx
push esi
call ebp
mov edi, dword [esp + 0x498]
lea eax, [esp + 0x10]
push ebx
push eax
push 0x10
push edi
push esi
call ebp
push edi
call fcn.004527b0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x474
ret