Function at 0x415020
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor bl, bl
cmp byte [ebp + 8], 1
push esi
push edi
mov byte [ebp - 0x10e], bl
jne 0x415481
cmp byte [ebp + 0xc], 1
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov byte [ebp - 0x10d], bl
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jne 0x41533c
lea eax, [ebp - 0x10c]
push str.IsiPlc.CTX
push eax
call fcn.00415740
mov eax, dword [0x4bfd20]
add esp, 8
mov ecx, dword [0x4bfd08]
mov edi, dword [0x4bfd1c]
shl edi, 4
add edi, dword [0x4bfd1c]
lea ecx, [eax + ecx*8]
mov eax, dword [0x4bfd10]
add ecx, dword [0x4bfd0c]
add eax, 0xc2
lea edx, [eax + ecx*2]
imul ecx, dword [0x4bfd14], 0x51
add ecx, dword [0x4bfd18]
lea eax, [ecx + edx*2]
mov ecx, dword [0x4bfd24]
add edi, eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], edi
test ecx, ecx
jle 0x41514b
mov ebx, dword [0x4bfd28]
add ebx, 0x88
mov esi, dword [ebx - 0x84]
xor edi, edi
test esi, esi
jle 0x41511d
mov eax, dword [ebx]
nop
mov ecx, dword [eax + 4]
lea eax, [eax + 0x88]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [edx*4 + 0x46f018]
imul ecx, dword [eax - 0x88]
add edi, ecx
sub esi, 1
jne 0x4150f0
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebx - 0x88]
add ebx, 0x8c
imul eax, edi
mov edi, dword [ebp - 0x114]
add edi, eax
sub ecx, 1
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x118], ecx
jne 0x4150e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [ebp - 0x10c]
push 0
push 0x80000080
push 3
push 0
push 3
push 0xc0000000
push eax
call esi
mov dword [0x4f7b8c], eax
cmp eax, 0xffffffff
je 0x4151a0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
je 0x4151ad
push dword [0x4f7b8c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4f7b8c], 0xffffffff
push str.File_IsiPlc.CTX:_size_mismatch
jmp 0x4151a5
push str.File_IsiPlc.CTX_missing
call fcn.0040e800
add esp, 4
mov eax, dword [0x4f7b8c]
cmp eax, 0xffffffff
jne 0x415235
push 0
push 0x80000080
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x10c]
push eax
call esi
mov dword [0x4f7b8c], eax
cmp eax, 0xffffffff
je 0x415225
push edi
push 8
push dword [0x47ceb0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
mov esi, eax
lea eax, [ebp - 0x11c]
push eax
push edi
push esi
push dword [0x4f7b8c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
push dword [0x47ceb0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x4f7b8c]
mov byte [ebp - 0x10d], 1
jmp 0x41522c
mov byte [ebp - 0x10d], 0
cmp eax, 0xffffffff
je 0x41538d
push str.ISIPLC_MAIN_MEMORY
push 0
push 0
push 4
push 0
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x4f7b90], eax
test eax, eax
je 0x415393
push 0
push 0
push 0
push 0xf001f
push eax
call esi
mov ecx, eax
mov dword [0x4f7b94], ecx
test ecx, ecx
je 0x415393
mov edx, dword [0x4bfd18]
add edx, ecx
mov dword [0x4c18b9], ecx
mov ecx, dword [0x4bfd08]
shl ecx, 4
mov dword [0x4c18bd], edx
push 0x184
push 0
lea eax, [ecx + edx]
mov dword [0x4c18c1], eax
lea ecx, [edx + ecx*2]
mov eax, dword [0x4bfd10]
mov dword [0x4c18c5], ecx
lea ecx, [ecx + eax*2]
mov eax, dword [0x4bfd0c]
mov dword [0x4c18c9], ecx
lea edx, [ecx + eax*4]
mov ecx, dword [0x4bfd1c]
mov eax, ecx
mov dword [0x4c18cd], edx
shl eax, 4
add eax, edx
add ecx, eax
imul eax, dword [0x4bfd14], 0x51
mov dword [0x4c18d1], ecx
add ecx, eax
mov eax, dword [0x4bfd20]
mov dword [0x4c18d5], ecx
lea ecx, [ecx + eax*4]
lea eax, [ecx + 0x184]
mov dword [0x4c18d9], ecx
push ecx
mov dword [0x4c18dd], eax
call fcn.0043d400
mov eax, dword [0x4c18d9]
add esp, 0xc
cmp byte [ebp - 0x10d], 1
jne 0x415321
or byte [eax + 0x2e], 1
jmp 0x415325
or byte [eax + 0x2f], 1
cmp dword [0x4c165c], 0
mov bl, 1
je 0x415399
push 1
call fcn.004158f0
add esp, 4
jmp 0x415399
push str.ISIPLC_MAIN_MEMORY
push 0x184
push 0
push 4
push 0
push 0xffffffffffffffff
call ebx
mov dword [0x4f7b90], eax
test eax, eax
je 0x415389
push 0
push 0
push 0
push 0xf001f
push eax
call esi
mov dword [0x4f7b94], eax
test eax, eax
je 0x415389
push 0x184
push 0
push eax
mov dword [0x4c18d9], eax
call fcn.0043d400
add esp, 0xc
mov bl, 1
jmp 0x415399
xor bl, bl
jmp 0x415399
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov bl, byte [ebp - 0x10e]
push str.ISIPLC_MAIN_MEM_INFO
push 0x8c30
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x4f7b9c], eax
test eax, eax
je 0x41545e
push 0
push 0
push 0
push 0xf001f
push eax
call esi
mov esi, eax
mov dword [0x4f7ba0], esi
test esi, esi
je 0x41545e
cmp byte [ebp + 0xc], 1
jne 0x415401
movups xmm0, xmmword [0x4bfd08]
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x4bfd18]
movups xmmword [esi + 0x10], xmm0
mov eax, dword [0x4bfd28]
mov dword [esi + 0x20], eax
jmp 0x415412
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
push 0x8c0c
lea eax, [esi + 0x24]
push 0
push eax
call fcn.0043d400
add esp, 0xc
mov byte [esi + 0x2c], 1
lea eax, [esi + 0x24]
mov dword [0x4daa1c], eax
push str.ISIPLC_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
pop edi
mov dword [0x4f7b98], eax
mov al, bl
pop esi
mov byte [0x4c18b8], bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov byte [0x4c18b8], bl
mov al, bl
mov dword [0x4daa1c], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
push dword [0x4f7b98]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [0x4b08e1], bl
je 0x4154aa
cmp byte [0x4c18b8], 1
jne 0x4154aa
push 0
call fcn.004158f0
add esp, 4
push 0
push dword [0x4f7b94]
mov byte [0x4c18b8], bl
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
push dword [0x4f7b94]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call edi
push dword [0x4f7b90]
call esi
mov eax, dword [0x4f7b8c]
cmp eax, 0xffffffff
je 0x4154eb
push eax
call esi
mov dword [0x4f7b8c], 0xffffffff
push dword [0x4f7ba0]
call edi
push dword [0x4f7b9c]
call esi
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
mov dword [0x4daa1c], 0
pop ebx
call fcn.0043b572
mov esp, ebp
pop ebp
ret