Function at 0x4177f0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x41e3b0]
push ebx
mov ebx, dword [esp + 0x150]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [esp + 0x154]
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [esp + 0x20], 0
test eax, eax
je 0x417860
push ebx
call fcn.00401aa0
push eax
lea eax, [esp + 0x30]
push 0x41de30
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x417899
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417953
push 0x41b328
jmp 0x417944
mov edx, dword [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [0x41e3b0]
test eax, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
je 0x417913
push ebx
lea eax, [esp + 0x2c]
push 0x41de20
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 0x41de50
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x417971
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417953
push 0x41b350
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push 0
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.IMAGEHLP.dll_ImageNtHeader]
test eax, eax
jne 0x4179b4
mov eax, dword [0x41e3b0]
push 0x41b374
test eax, eax
je 0x4179fe
jmp 0x4179d3
mov edx, dword [esp + 0x10]
push edx
call fcn.00417620
add esp, 4
test eax, eax
je 0x417a0c
mov eax, dword [0x41e3b0]
test eax, eax
je 0x4179f8
push 0x41de04
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
jmp 0x417f3d
mov eax, dword [0x41b1ac]
push eax
push esi
call fcn.004043a0
add esp, 8
jmp 0x417f3d
mov eax, dword [0x41e3b4]
test eax, eax
je 0x417a88
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00416370
mov ebx, eax
mov eax, dword [0x41e3b0]
add esp, 4
test eax, eax
je 0x417a88
lea edx, [esp + 0x28]
push 0x41ddf8
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x417a53
lea eax, [esp + 0x28]
push 0x41ddf0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x417a63
lea ecx, [esp + 0x28]
push 0x41b9c4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3d0]
test eax, eax
je 0x417b49
mov eax, dword [0x41e3d4]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call sub.realign.dll_ReBasePEImage
mov ebx, eax
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417b49
mov edx, dword [0x41e3d4]
lea eax, [esp + 0x28]
push edx
push 0x41dddc
push eax
call ebp
add esp, 0xc
cmp ebx, 5
ja case.default.0x417acf
jmp dword [ebx*4 + 0x418114]
push 0x41ddf0
jmp 0x417b19
lea edx, [esp + 0x28]
push 0x41ddd0
push edx
jmp 0x417b1e
lea eax, [esp + 0x28]
push 0x41ddb8
push eax
jmp 0x417b1e
push 0x41dda8
jmp 0x417b19
lea edx, [esp + 0x28]
push 0x41dd8c
push edx
jmp 0x417b1e
lea eax, [esp + 0x28]
push 0x41b850
push eax
jmp 0x417b1e
push 0x41b9c4
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3c0]
test eax, eax
je 0x417c73
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call sub.realign.dll_WipeReloc
mov ebx, eax
cmp ebx, 0xf0000000
jae 0x417bf7
cmp ebx, 0x1e
jbe 0x417bf7
push 0x41dd74
push 0
push 0x180
push 0x467
push esi
mov dword [esp + 0x2c], ebx
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push ebx
lea edx, [esp + 0x2c]
push 0x41dd5c
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
lea eax, [ebx + ebx*4]
xor edx, edx
lea ecx, [esp + 0x28]
lea eax, [eax + eax*4]
shl eax, 2
div dword [esp + 0x1c]
push eax
push 0x41dd44
push ecx
call ebp
add esp, 0xc
jmp 0x417c4e
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417c73
lea eax, [esp + 0x28]
push 0x41dd30
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 0xfffffffc
je 0x417c3e
cmp ebx, 0xfffffffd
je 0x417c32
cmp ebx, 0xfffffffe
je 0x417c26
push 0x41b9c4
jmp 0x417c43
lea edx, [esp + 0x28]
push 0x41ddb8
push edx
jmp 0x417c48
lea eax, [esp + 0x28]
push 0x41dd20
push eax
jmp 0x417c48
push 0x41dd10
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3b8]
test eax, eax
je 0x417d9e
mov al, byte [0x41e3bc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call sub.realign.dll_RealignPE
mov ebx, eax
cmp ebx, 0xf0000000
jae 0x417d30
cmp ebx, 0x1e
jbe 0x417d30
push 0x41dcfc
push 0
push 0x180
push 0x467
push esi
mov dword [esp + 0x2c], ebx
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push ebx
lea eax, [esp + 0x2c]
push 0x41dd5c
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
lea eax, [ebx + ebx*4]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 2
div dword [esp + 0x1c]
lea edx, [esp + 0x28]
push eax
push 0x41dd44
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
push eax
jmp 0x417d7e
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417d9e
lea ecx, [esp + 0x28]
push 0x41dcec
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
sub ebx, 3
je 0x417d69
dec ebx
je 0x417d5d
lea edx, [esp + 0x28]
push 0x41b9c4
push edx
jmp 0x417d73
lea eax, [esp + 0x28]
push 0x41dcd8
push eax
jmp 0x417d73
lea ecx, [esp + 0x28]
push 0x41dcc4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3c8]
test eax, eax
je 0x417e56
mov eax, dword [esp + 0x10]
push eax
call fcn.00404080
mov ebx, eax
mov eax, dword [0x41e3b0]
add esp, 4
test eax, eax
je 0x417e56
lea ecx, [esp + 0x28]
push 0x41dcac
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 7
ja case.0x417ddc.1
jmp dword [ebx*4 + 0x41812c]
push 0x41ddf0
jmp 0x417e26
lea eax, [esp + 0x28]
push 0x41b7b0
push eax
jmp 0x417e2b
lea ecx, [esp + 0x28]
push 0x41dc98
push ecx
jmp 0x417e2b
push 0x41dc88
jmp 0x417e26
lea eax, [esp + 0x28]
push 0x41b850
push eax
jmp 0x417e2b
lea ecx, [esp + 0x28]
push 0x41b7bc
push ecx
jmp 0x417e2b
push 0x41b9c4
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3c4]
test eax, eax
je 0x417ed1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.00418150
mov ebx, eax
mov eax, dword [0x41e3b0]
add esp, 8
test eax, eax
je 0x417ed1
lea eax, [esp + 0x28]
push 0x41dc70
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x417e9c
lea ecx, [esp + 0x28]
push 0x41ddf0
push ecx
jmp 0x417ea6
lea edx, [esp + 0x28]
push 0x41b9c4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41d994]
test eax, eax
je 0x417ee7
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004162d0
add esp, 4
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push edx
call ebx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push 0
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0
push ecx
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], 1
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov edx, dword [esp + 0x10]
push 0x8000
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x418103
mov eax, dword [0x41e3cc]
test eax, eax
je 0x41800f
mov ecx, dword [esp + 0x15c]
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.IMAGEHLP.dll_BindImageEx]
mov ebx, eax
mov eax, dword [0x41e3b0]
test eax, eax
je 0x41800b
lea edx, [esp + 0x28]
push 0x41dc5c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x417fd6
mov eax, dword [esp + 0x15c]
push 0xb
push eax
call fcn.00417390
add esp, 8
test eax, eax
je 0x417fd6
lea ecx, [esp + 0x28]
push 0x41ddf0
push ecx
jmp 0x417fe0
lea edx, [esp + 0x28]
push 0x41b9c4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov ebx, dword [esp + 0x1c]
mov eax, dword [0x41e3b0]
test eax, eax
je 0x4180ee
push str._____________________________________________________
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
push 0x41dc10
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [esp + 0x18]
xor edx, edx
lea ecx, [esp + 0x28]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
div ebx
push eax
push 0x41dd44
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 0x41dbf8
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3b0]
test eax, eax
jne 0x418103
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x41dbe4
push esi
call fcn.004043e0
add esp, 8
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret