Function at 0x405e5b
Capabilities:
Get file size
Write file on windows

Disassembly:
add cl, ch
add eax, dword [eax]
add byte [eax], al
cdq
jb 0x405ac5
push eax
call 0x405b1e
je 0x405b82
jns 0x405ad6
pop eax
pop eax
mov eax, 0x401198
pop edi
pop esi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.00405ae0
mov dword [ebp - 4], eax
jmp 0x405b49
push eax
call 0x405b53
je 0x405bb7
jns 0x405b0b
pop eax
pop eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00405ba0
add esp, 8
mov dword [ebp - 8], eax
cmp eax, eax
je 0x405b78
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
je 0x405b80
in al, 0x1d
je 0x405b88
add al, byte [eax]
add byte [eax], al
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx + 0x5e5ff845], cl
jne 0xd9ecb4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [edx], ch
push 0x80
push 3
push 0
push 3
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4c], eax
cmp eax, eax
je 0x405bfb
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x405c03
in al, 0x1d
je 0x405c0b
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add bh, al
inc ebp
cld
add byte [eax], al
add byte [eax], al
jne 0xd9ed37
mov dword [ebp - 4], 0
jmp 0x405c20
push eax
call 0x405c2a
je 0x405c8e
jns 0x405be2
pop eax
pop eax
push 0
lea ecx, [ebp - 0x50]
push ecx
push 0x40
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x50], 0x3c
jbe 0x405d3c
mov ecx, dword [ebp - 0x48]
and ecx, 0xff
cmp ecx, 0x4d
jne 0x405d3c
mov edx, dword [ebp - 0x47]
and edx, 0xff
cmp edx, 0x5a
jne 0x405d3c
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x50]
push edx
push 4
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, eax
je 0x405ca8
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x405cb0
in al, 0x1d
je 0x405cb8
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx + 0x5589b855], cl
mov al, 0x83
jge 0x405c77
jne 0xd9ede4
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 0
je 0x405d3c
add byte [edx + esi*2 - 0x75], dh
inc ebp
mov al, 0x83
ror byte [edx], 0x50
mov eax, dword [ebp - 0x50]
add eax, 0xa
push eax
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 4], eax
cmp eax, eax
je 0x405cec
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x405cf4
in al, 0x1d
je 0x405cfc
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx + 0x74000c7d], al
or byte [ebx + 0x558b0c4d], cl
mov al, 0x89
adc dword [edx], ebp
jne 0xd9ee28
cmp dword [ebp + 0xc], 0
je 0x405d10
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x50]
mov dword [ecx], edx
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x405d30
push eax
call 0x405d3a
je 0x405d9e
jns 0x405cf2
pop eax
pop eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, eax
je 0x405d56
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x405d5e
in al, 0x1d
je 0x405d66
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx + 0x5e5ffc45], cl
jne 0xd9ee92
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [edx], ch
push 0x80
push 3
push 0
push 3
push 3
add ebp, dword [edx + 3]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x48], eax
cmp eax, eax
je 0x405ddb
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x405de3
in al, 0x1d
je 0x405deb
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add cl, ch
add eax, dword [eax]
add byte [eax], al
cdq
jb 0x405daa
jne 0xd9ef17
jmp 0x405df9
push eax
call 0x405e03
je 0x405e67
jns 0x405dbb
pop eax
pop eax
push 0
lea ecx, [ebp - 0x4c]
push ecx
push 0x40
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x1c15ff50
adc byte [eax], al
cmp dword [ebp - 0x4c], 0x3c
jbe 0x405ef8
mov ecx, dword [ebp - 0x44]
and ecx, 0xff
cmp ecx, 0x4d
jne 0x405ef8
add byte [ebx - 0x1d7e42ab], cl
inc dword [eax]
add byte [eax], al
mov edx, dword [ebp - 0x43]
and edx, 0xff
cmp edx, 0x5a
jne 0x405ef8
jmp 0x405e51
push eax
call 0x405e5b
je 0x405ebf
jns 0x405e13
pop eax
pop eax
push 0
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x50], eax
jmp 0x405e74
inc eax
add byte [ecx + 0x3e9b045], cl
add byte [eax], al
add byte [ecx - 0x17af4e8e], bl
add al, 0
add byte [eax], al
push eax
call 0x405e7e
je 0x405ee2
jns 0x405e36
pop eax
pop eax
push 0
push 0
push 0x38
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x4c]
push edx
push 4
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push 0
push 0
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x4c]
push eax
push 4
lea ecx, [ebp + 0x10]
push ecx
dec ebp
adc byte [ecx - 0x75], dl
push ebp
mov eax, 0x815ff52
adc byte [eax], al
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x405ed4
push eax
call 0x405ede
je 0x405f42
jns 0x405e96
pop eax
pop eax
push 0
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x405f00
push eax
call 0x405f0a
je 0x405f6e
jns 0x405ec2
pop eax
pop eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
ror byte [edi], 0x84
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi], bl
jns 0x405f28