Function at 0x423b03
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
lea eax, [ebp - 0x154]
push edi
mov edi, ecx
push eax
call fcn.00423583
lea eax, [ebp - 0x154]
push eax
call fcn.0040e7f9
test al, al
pop ecx
je 0x42413d
xor ebx, ebx
lea eax, [ebp - 0x154]
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x20], esi
je 0x42413d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
push ebx
push 0xfffffffffffffffc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call esi
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x30]
sub eax, 4
push eax
mov dword [ebp - 4], eax
call fcn.004258e9
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x423bbe
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42413d
lea ecx, [ebp - 0x40]
push ebx
push ecx
push dword [ebp - 4]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call esi
lea ecx, [ebp - 0x18]
call fcn.0041c7ab
push dword [ebp - 4]
lea ecx, [ebp - 0x18]
push dword [ebp - 8]
call fcn.0041ca2d
lea ecx, [ebp - 0x18]
call fcn.0041ccc6
test al, al
je 0x42412c
lea ecx, [ebp - 0x18]
call fcn.0041ccc6
test al, al
je 0x42412c
cmp dword [ebp - 0x18], 2
jb 0x42412c
lea ecx, [ebp - 0x3c]
call fcn.0041c7ab
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041c9c9
cmp al, 0x5c
jne 0x423c63
push 1
lea ecx, [ebp - 0x18]
call fcn.0041c9c9
push 2
lea ecx, [ebp - 0x18]
call fcn.0041d2e3
lea esi, [eax + 6]
lea ecx, [ebp - 0x18]
push esi
push ebx
call fcn.0041d67b
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041c966
push esi
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041cd8f
xor esi, esi
cmp dword [ebp - 0x18], ebx
mov byte [ebp - 0x19], bl
jbe 0x423dad
push esi
lea ecx, [ebp - 0x18]
call fcn.0041c9c9
cmp al, 0xd
je 0x423c89
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x423c71
jmp 0x423dad
cmp esi, 0xffffffff
je 0x423dad
push esi
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041d67b
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c87f
push ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041d093
mov esi, eax
cmp esi, 0xffffffff
je 0x423da5
lea ecx, [ebp - 0x2c]
call fcn.0041d704
lea eax, [eax + esi + 1]
push eax
push 0x42ec58
mov dword [ebp - 4], eax
call fcn.00425540
pop ecx
test eax, eax
pop ecx
jge 0x423cde
mov byte [ebp - 0x19], 1
cmp byte [edi + 0x92], bl
jne 0x423da5
push dword [ebp - 4]
push 0x42ec54
call fcn.00425540
pop ecx
test eax, eax
pop ecx
jge 0x423da5
inc esi
lea ecx, [ebp - 0x18]
push esi
push ebx
call fcn.0041d093
mov esi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xc], esi
lea eax, [esi + 1]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0041d093
cmp esi, 0xffffffff
mov dword [ebp - 8], eax
je 0x423da5
cmp eax, 0xffffffff
je 0x423da5
mov esi, 0x47f028
push 0x47f668
mov ecx, esi
call fcn.0041b21e
push 0x7fffffff
push 0x47f668
mov ecx, esi
call fcn.0041bd98
push 0x47f668
mov ecx, esi
call fcn.00416e92
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
sub eax, dword [ebp - 0xc]
lea esi, [eax - 1]
push esi
push dword [ebp - 4]
call fcn.0041d67b
push eax
lea ecx, [ebp - 0x50]
call fcn.0041c87f
push esi
lea ecx, [ebp - 0x18]
push dword [ebp - 4]
call fcn.0041cd8f
push ebx
mov ecx, 0x47f668
push dword [ebp - 4]
call fcn.0041d704
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d406
lea ecx, [ebp - 0x50]
call fcn.0041c8e1
lea ecx, [ebp - 0x2c]
call fcn.0041c8e1
push 1
push ebx
push str.Backups:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d0b6
push 1
push ebx
push str.Files:_r_n
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041d0b6
cmp eax, esi
jge 0x423ddb
push dword [ebp - 0x20]
jmp 0x42411c
push 1
mov esi, str.Shared:_r_n
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.0041d0b6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
add ecx, eax
cmp dword [edi + 0x7c], ebx
mov dword [ebp - 0xc], ecx
jle 0x423e8f
mov dword [ebp - 8], ebx
push ebx
push dword [edi + 0x8c]
call fcn.0040e7c6
pop ecx
cmp eax, ebx
pop ecx
je 0x423e87
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c81b
cmp byte [ebp - 0x19], bl
jne 0x423e4b
push ebx
push 0x7c
lea ecx, [ebp - 0x2c]
call fcn.0041d093
cmp eax, 0xffffffff
je 0x423e4b
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041cd8f
push ebx
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc]
call fcn.0041d704
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d406
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add eax, ecx
push ebx
push eax
push 0x42cc50
lea ecx, [ebp - 0x18]
call fcn.0041d406
inc dword [ebp - 8]
lea ecx, [ebp - 0x2c]
call fcn.0041c8e1
push dword [ebp - 8]
jmp 0x423e0d
lea ecx, [edi + 0x78]
call fcn.0041d9d7
cmp dword [edi + 0x54], ebx
jbe 0x423f27
push 1
push ebx
push str.Backups:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d0b6
push str.Backups:_r_n
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
add ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x2c]
call fcn.0041c7ab
push dword [ebp - 4]
lea ecx, [edi + 0x54]
call fcn.0041d3b8
test al, al
je 0x423f12
lea eax, [ebp - 0x2c]
lea ecx, [edi + 0x54]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041d315
push ebx
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc]
call fcn.0041d704
push eax
lea ecx, [ebp - 0x18]
call fcn.0041d406
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add eax, ecx
push ebx
push eax
push 0x42cc50
lea ecx, [ebp - 0x18]
call fcn.0041d406
jmp 0x423ec5
push 0x42f138
lea ecx, [edi + 0x54]
call fcn.0041c8f8
lea ecx, [ebp - 0x2c]
call fcn.0041c8e1
cmp dword [edi + 0x10], ebx
jle 0x423f97
push 1
push ebx
push str.Files:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d0b6
push str.Files:_r_n
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
add ecx, eax
push ebx
mov dword [ebp - 0xc], ecx
push dword [edi + 0x20]
call fcn.0040e7c6
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x423f8f
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp - 0xc]
push eax
call fcn.0041d406
push ebx
push dword [ebp - 4]
call esi
add eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push 0x42cc50
call fcn.0041d406
inc dword [ebp - 8]
push dword [ebp - 8]
jmp 0x423f52
lea ecx, [edi + 0xc]
call fcn.0041d9d7
cmp dword [edi + 0x28], ebx
jle 0x424007
push 1
push ebx
push str.Directories:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d0b6
push str.Directories:_r_n
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
add ecx, eax
push ebx
mov dword [ebp - 0xc], ecx
push dword [edi + 0x38]
call fcn.0040e7c6
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x423fff
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp - 0xc]
push eax
call fcn.0041d406
push ebx
push dword [ebp - 4]
call esi
add eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push 0x42cc50
call fcn.0041d406
inc dword [ebp - 8]
push dword [ebp - 8]
jmp 0x423fc2
lea ecx, [edi + 0x24]
call fcn.0041d9d7
push 1
push ebx
push str.Registry:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041d0b6
push str.Registry:_r_n
mov dword [ebp - 4], eax
call esi
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x18]
add esi, eax
mov eax, dword [ebp - 0x18]
sub eax, esi
push eax
push esi
call fcn.0041d67b
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c87f
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
sub eax, esi
push eax
push esi
call fcn.0041cd8f
lea ecx, [ebp - 0x2c]
mov dword [ebp - 8], ebx
call fcn.0041d704
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], eax
mov esi, 0x47f500
jbe 0x42408a
mov dword [ebp - 4], 0x47f3f0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.004235c8
add dword [ebp - 4], 0x44
cmp dword [ebp - 4], esi
jl 0x42406c
cmp dword [edi + 0x40], ebx
jg 0x424094
cmp dword [edi + 0x64], ebx
jle 0x42409b
mov ecx, edi
call fcn.00422411
mov dword [ebp - 4], 0x47f3f0
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.004225f6
add dword [ebp - 4], 0x44
cmp dword [ebp - 4], esi
jl 0x4240a2
lea ecx, [ebp - 0x2c]
call fcn.0041c8e1
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041caab
lea ecx, [ebp - 0x3c]
call fcn.0041cc15
lea ecx, [ebp - 0x3c]
call fcn.0041cc15
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0041c966
lea eax, [ebp - 0x44]
push ebx
push eax
lea ecx, [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.0041d704
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edi
call esi
lea eax, [ebp - 0x44]
push ebx
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.0041c8e1
jmp 0x424135
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.0041c8e1
pop edi
pop esi
mov al, 1
pop ebx
leave
ret