Function at 0x56ecb0
Capabilities:
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x23c
push ebx
mov ebx, dword [esp + 0x254]
mov eax, dword [ebx + 0x2c]
push ebp
mov ebp, dword [ebx + 0x30]
push esi
push edi
push 0x40000
push 0x42
mov esi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
mov dword [esp + 0x20], 0
push 0
je 0x56f0b2
mov ecx, dword [esp + 0x268]
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
je 0x56f05d
mov eax, dword [esi + 0x20]
test eax, eax
je 0x56ed82
push 0x104
lea edx, [ebx + 0x54]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [0x5d2618]
lea ecx, [esp + 0x50]
add esp, 0xc
test ecx, ecx
mov word [esp + 0x24a], 0
je 0x56ed68
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x44]
push eax
call fcn.00597b50
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx]
push 0xaaaaaa0
call dword [edx + 0xc]
push 0
push 0
push 0
call fcn.0058c670
push 0
push 0
push 0
mov dword [esp + 0x38], eax
call fcn.0058c670
test ebp, ebp
mov dword [esp + 0x24], eax
jl 0x56efd5
jg 0x56edb6
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x56efd5
mov ebx, dword [esp + 0x25c]
mov ebp, dword [esp + 0x258]
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x56efce
mov ecx, dword [esp + 0x18]
test ecx, ecx
jl 0x56eded
jg 0x56ede4
cmp dword [esp + 0x14], 0x40000
jb 0x56eded
mov eax, 0x40000
xor ecx, ecx
jmp 0x56edf1
mov eax, dword [esp + 0x14]
cmp ebx, ecx
mov dword [esp + 0x34], 0
jg 0x56ee11
jl 0x56ee03
cmp ebp, eax
ja 0x56ee11
mov eax, ebp
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
mov ecx, dword [esp + 0x20]
test ecx, ecx
mov dword [esp + 0x1c], 0
push 0
je 0x56ee2d
lea edx, [esp + 0x20]
push edx
push eax
push edi
push ecx
jmp 0x56ee3c
mov edx, dword [esp + 0x254]
lea ecx, [esp + 0x20]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x56efb3
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push eax
push edi
push ecx
call fcn.0058c670
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
sub edx, eax
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x18]
sbb edx, ecx
push ecx
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x34]
push edx
push eax
sub ebp, eax
mov eax, dword [esp + 0x34]
push edi
push eax
sbb ebx, ecx
mov dword [esp + 0x44], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x56ef79
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edi
push edx
call fcn.0058c670
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x56eedb
mov edx, dword [esp + 0x30]
mov ecx, eax
mov eax, dword [ecx]
push 0
push edx
call dword [eax + 0x10]
mov ecx, dword [esi + 0x20]
call fcn.005979b0
cmp eax, 0x8004e00c
mov dword [esp + 0x10], eax
je 0x56efce
mov eax, dword [esp + 0x34]
test eax, eax
je 0x56ef5d
mov eax, dword [esp + 0x254]
cmp eax, dword [esi + 0x10a8]
jge 0x56ef5d
mov eax, dword [esp + 0x20]
test eax, eax
je 0x56ef01
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x254]
lea ecx, [esp + 0x44]
push ecx
inc eax
push eax
lea edx, [esi + 0x868]
push edx
mov ecx, esi
mov dword [esp + 0x260], eax
call fcn.0056a300
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x56ef96
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x3c], eax
mov ebp, eax
mov eax, dword [esp + 0x18]
test eax, eax
jg 0x56edc4
jl 0x56efce
mov eax, dword [esp + 0x14]
test eax, eax
ja 0x56edc4
jmp 0x56efce
push 0
push str.ExtractInternalNoCompression
push 0xaaaaaaa9
mov ecx, esi
call fcn.0056a380
mov dword [esp + 0x10], 0x8004e009
jmp 0x56efce
push 0
push str.ExtractInternalNoCompression
push 0xaaaaaaa4
mov ecx, esi
call fcn.0056a380
mov dword [esp + 0x10], 0x8004e00d
jmp 0x56efce
push 0
push str.ExtractInternalNoCompression
push 0xaaaaaaaa
mov ecx, esi
call fcn.0056a380
mov dword [esp + 0x10], 0x8004e008
mov ebx, dword [esp + 0x260]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x56efe5
mov ecx, eax
mov edx, dword [ecx]
push 0
call dword [edx + 0xc]
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x56f050
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
mov eax, edx
mov dword [esp + 0x1c], ecx
push eax
mov ecx, edx
mov edx, dword [esp + 0x30]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [ebx + 0x44]
mov ecx, dword [esp + 0x264]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x2c]
cmp edx, dword [ebx + 0x20]
jne 0x56f035
mov eax, dword [esp + 0x24]
cmp eax, dword [ebx + 0x1c]
je 0x56f050
push 0
push str.ExtractInternalNoCompression
push 0xaaaaaaaf
mov ecx, esi
call fcn.0056a380
mov dword [esp + 0x10], 0x8004e00b
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x56f078
push 0
push str.ExtractInternalNoCompression
push 0xaaaaaaa2
mov ecx, esi
call fcn.0056a380
mov dword [esp + 0x10], 0x8004e006
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x56f0a1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret 0x18
push str.ExtractInternalNoCompression
push 0xaaaaaaa3
mov ecx, esi
call fcn.0056a380
pop edi
pop esi
pop ebp
mov eax, 0x8007000e
pop ebx
add esp, 0x23c
ret 0x18