Function at 0x4ff345
Capabilities:
Read file on windows

Disassembly:
pop edi
cmp dword [esp + 0x70], 0x982e7aeb
jne 0x4ff23d
jge 0x4ff21c
inc edi
jnp 0x4ff275
arpl word [edi + 0x5c], cx
dec edi
pop esp
insd dword es:[edi], dx
cmp dword [ecx - 8], 0x4212a8
pop ebp
inc edi
jns 0x4ff294
push 0x67
pop edx
pop edx
mov dword [eax], 0x2a
jne 0x4ff229
pop ecx
mov ecx, dword [ebp - 0x18]
push ebx
pop esp
mov eax, dword [ebp + 0x10]
pop ebx
cmp dword [esp + 0x14], 0x6298c457
jne 0x4ff290
push eax
inc eax
push ebx
push esi
dec ecx
imul ebx, dword [edi + ebx*2 + 0x5d], 0x43
imul bx, word [ebx + 0x50], 0x58
inc ecx
push esi
pop esi
inc eax
insd dword es:[edi], dx
pushal
jns 0x4ff2d1
dec ebx
push esp
insb byte es:[edi], dx
dec esp
dec esi
popal
push esi
outsb dx, byte [esi]
pop eax
inc esp
push si
dec ecx
push 0x63584041
inc esi
arpl word [esi + edx*2 + 0x67], dx
dec ebx
pop eax
arpl word [esi + 0x63], ax
push esp
push esi
dec ebx
inc edi
push edx
pop ebx
pop edx
pop ebp
bound ecx, qword [eax + 0x4c]
dec esp
inc edx
pop eax
pushal
outsb dx, byte [esi]
dec eax
pop eax
pushal
pushal
pop edi
pop esi
cmp esi, 0x571760b3
pushal
pop ss
push edi
jne 0x4ff2d7
outsb dx, byte [esi]
pop esi
push ebx
popal
inc ebp
imul esp, dword [esi + 0x42], 0x69784d4c
pop ebp
jns 0x4ff2f5
pushaw
pop eax
push esi
dec ebx
inc edi
inc ebx
dec edx
inc edx
inc eax
insd dword es:[edi], dx
push eax
inc edi
inc edi
pop esi
popal
push ecx
dec esp
pop ebx
pop cx
imul ecx, dword [edi + 0x55], 0x41
imul edx, dword [esi + ecx*2 + 0x40], 0x66
pop eax
inc esi
inc esp
pop eax
pop edi
inc esp
pop esp
imul ecx, dword [esi + 0x57], 0x5d64784c
js 0x4ff337
pop ebp
insd dword es:[edi], dx
dec ebp
pop ebp
pop ebp
ret
add al, 5
push esp
pop ecx
pop edx
popal
insd dword es:[edi], dx
dec ecx
imul ebp, dword [edi + 0x4d], 0x458bc30b
or byte [ebx - 0x3d], dl
push 0x10
cmp dword [esp - 0x18], 0x6dd2be29
je 0x4ff2f9
call 0x4ff345
push 0x51
inc eax
insd dword es:[edi], dx
dec edx
pop ebx
dec edi
jnp 0x4ff383
imul ebx, dword [esi + 0x69], 0x6a
inc edi
insb byte es:[edi], dx
dec esp
push 0x43
push 0x67
inc esi
push edx
pop ebx
dec esi
push ebp
push ebx
imul eax, dword [bx + di + 0x42], 0x62
dec ebx
outsb dx, byte gs:[esi]
bound ecx, qword [ebx + 0x65]
outsb dx, byte [esi]
pop ebp
inc eax
inc esp
imul eax, dword [bp + di + 0x4e], 0x44816a5a
and al, 0
rcl byte [edx]
inc dword [ecx + 0x3d1c247c]
pop es
mov ecx, 0xda440fef
call 0x4ff3af
je 0x4ff364
jne 0x4ff365
pop esp
pop edi
dec edi
dec edi
dec eax
jne 0x4ff37e
lea eax, [ebx + edi]
jnp 0x4ff3e5
mov ecx, dword [ebp - 0x20]
cmp dword [eax + 4], ebx
add eax, dword [ebp - 0x748]
imul esp, dword [eax + 0x6d], 0x840f535c
rol byte [eax], cl
add byte [eax], al
je 0x4ff456
add byte [eax - 1], bl
jne 0x4ff398
pop eax
push dword [ebp + 0x10]
leave
je 0x4ff38e
push ecx
arpl word [eax + 0x22], dx
enter 0xffffffffffffc933, 0x52
push eax
and cl, al
xor ecx, ecx
push edx
outsd dx, dword [esi]
imul edi, dword [ecx + 0x6e], 0x57
push edi
dec esp
dec dword fs:[eax + 0x18]
push eax
imul edx, ecx, 0xee8c1ea
lea eax, [ebp - 0x14]
mov eax, dword [esi + 0x1c]
int1
add ecx, dword [ecx + 0x79]
push dword [esp]
add dword [esp], 0xfff315c0
add dword [esp + 4], 0xe2
ret
dec eax
outsd dx, dword [esi]
je 0x4ff3ec
mov eax, edx
cmp al, 0x41
inc ecx
jns 0x4ff447
add eax, 0x8d4f4f00
dec ebp
aam 0x83
mov dword [edx], 0x6840576e
push ecx
dec ebx
dec ecx
imul ebp, dword [edx + 0x6b], 0x44
jmp 0x56851c
and bh, 2
add byte [eax], al
cmp dword [esp + 0x1c], 0xa8952757
jne 0x4ff45f
push dword [ebp + 0x24]
outsb dx, byte [si]
add edi, 0x10
call 0x4ff4c3
dec ebx
insd dword es:[edi], dx
outsb dx, byte [esi]
dec ebx
dec edx
dec esp
outsb dx, byte [esi]
dec ebp
js 0x4ff4b2
push eax
push esp
pop edi
push ecx
jns 0x4ff4c3
jns 0x4ff4da
dec ecx
inc edi
pushal
pop ebx
insb byte es:[edi], dx
insb byte es:[edi], dx
dec edi
pop edi
pop esi
push eax
push edx
outsd dx, dword [esi]
pop edi
pop esi
dec esi
inc edx
pop esp
pushal
outsd dx, dword [esi]
inc ebx
arpl word [ebx + 0x56], dx
push esi
push ecx
pop edi
dec edi
pop ecx
inc ecx
arpl word [edi + 0x6c], dx
pop eax
push eax
imul esp, dword [esi + 0x4b], 0x62444242
pop esp
push ebx
push edi
pop esp
push dword [esp]
add dword [esp], 0xfff0d034
add dword [esp + 4], 0xa7
ret
push 0x7b
imul esp, dword [ebp + 0x69], 0x4d404d5b
pop ebx
push eax
push esp
pop cx
inc edi
inc eax
push eax
pop esi
arpl word [eax + ecx*2 + 0x59], sp
pop esi
jns 0x4ff53c
dec edx
pop ebp
imul esp, dword [edi + 0x6a], 0x64694249
dec ecx
inc edx
invalid
inc ebp
pop ebx
push esp
arpl word [esi + 0x51], sp
insb byte es:[edi], dx
pop edx
inc edi
pop edx
inc dx
pop edi
insb byte es:[edi], dx
cmp ebp, 0xcc772a57
je 0x54f3db
push 9
pop esi
cmp dword [esp - 0x20], 0x6677c255
je 0x510a5a
mov dword [eax], esi
cmp ecx, 0x1d7ca609
jne 0x4ff569
je 0x4ff55d
pop ebp
push eax
dec ebp
push eax
mov eax, dword [ebp - 0x3a4]
jmp 0x6392619a
invalid
pop eax
pop edi
je 0x4ff575
push edx
push 0xeb657f55
add eax, 0x20e8cc
add byte [eax], al
call 0x4ff58e
inc esp
push edi
imul ecx, dword [ecx + 0x6b], 0x435c495e
pop esp
inc ebx
pop esi
pop ecx
outsb dx, byte [esi]
push esp
push 0x6a486757
inc edx
dec edx
insd dword es:[edi], dx
push eax
outsb dx, byte [esi]
arpl word [esi + 0x4e], dx
inc ebp
jnp 0x4ff5d8
dec edx
popal
push dword [esp]
add dword [esp], 0xfff0ce49
add dword [esp + 4], 0xa2
ret
jnp 0x4ff653
dec esi
push eax
jnp 0x4ff631
dec sp
imul esp, dword [ecx + edx*2 + 0x4c], 0x40
dec ebp
push 0x53547863
outsd dx, dword [esi]
pop ebp
outsb dx, byte [esi]
insd dword es:[di], dx
imul edx, dword [ecx + 0x69], 0x5f
pop eax
pop esp
dec ebx
push eax
jns 0x4ff659
pop ebp
push 0x54654663
js 0x4ff670
pop ecx
pop edx
dec ebx
bound esp, qword [ebp + 0x42]
arpl word [esi + 0x67], cx
pop esp
dec esi
push esp
cmp dword [esp + 0x38], 0x6484fc75
je 0x4ff63f
mov eax, esi
cmp dword [esp + 0x58], 0x1eec424d
jne 0x4ff68a
sete al
pop edi
inc edi
imul edx, dword [esi - 0x41], 0
add al, byte [eax]
add byte [ecx + 0x50], ch
push ebx
pop edi
jns 0x4ff69f
call fcn.004fb335
push ebp
inc edx
popal
add esp, 0x10
inc edx
dec ebp
push edi
push dword [ebp + 8]
popal
dec ebx
pop eax
pop ecx
push edi
jmp 0x4ff5ec
push ebp
push eax
arpl word [eax + 0x5a], ax
dec eax
pop edi
push 0x22
call fcn.004fb2bc
jae 0x4ff674
pop esi
pop ecx
mov byte [ebp - 0xc], 0x20
cmp dword [ebp + 0xc], 0x7ff00000
add byte [eax], al
invalid
pop eax
jne 0x4ff66c
mov eax, dword [ebp + 0xc]
pop esp
inc ebp
or al, 0x5c
jae 0x4ff688
push ecx
test edx, edx
inc edx
push 0x89664542
mov ebp, 0xfffff6d0
push ecx
dec eax
mov ecx, dword [ebp - 0x10]
cmp dword [esp + 0x24], 0x8dcf018b
cmove edi, edi
mov dword fs:[0], ecx
dec ebp
invalid
cmp eax, 0xb436df31
jne 0x4ff6da
dec esi
jnp 0x4ff70a
insb byte es:[edi], dx
pop esi
dec esi
push eax
imul ecx, dword [ecx + 0x47], 0x6c58415a
pop ebx
push esp
dec ebx
jnp 0x4ff701
push 0x45564469
inc ecx
dec esi
pop edi
push eax
jnp 0x4ff720
imul ebp, dword [esi + 0x6b], 0x54
push 0x5f
push 0x5f
dec esi
inc esi
push 0x7b4d
push edx
dec edi
push eax
pop ecx
cmp dword [esp + 0x20], 0xe9719f85
je 0x4ff729
pop edi
cmp edi, 0x90e68d81
je 0x58f315
loop 0x4ff778
or ecx, dword [esi + 0x5f]
push 0x45
push ecx
imul eax, dword [edi + 0x6a], 0x6c
inc ebp
leave
cmp dword [esp + 0x14], 0x18c93bb7
jne 0x4ff732
call fcn.004ff4fb
je 0x4ff759
cmp byte [esi + 0x69], al
and ecx, 0x3ff
inc esi
imul eax, dword [ecx + 0x3ffe1], 0xf00a6a00
dec dword [ecx]
push 0xa
lock dec dword [ecx]
sahf
inc esp
pop ecx
outsd dx, dword [esi]
ret
add cl, ch
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebp
mov ecx, dword [ebp + 0x10]
mov al, 1
outsd dx, dword [esi]
jnp 0x4ff7ba
je 0x4ff776
or ah, ah
test ecx, 0x200
cmp ebx, eax
mov dword [eax + 0x18], 9
call fcn.004ff7b6
sbb byte [ecx], cl
add byte [eax], al
add al, ch
xor al, 0
add byte [eax], al
push edx
push esi
inc edx
push ecx
pop esi
mov dword [ebp - 8], eax
jmp 0x4ff68b
dec edi
xor byte [ecx], dh
je 0x4ff7d4
call fcn.004ff81b
inc esi
insd dword es:[edi], dx
fnstsw ax
fnstsw ax
pop esi
pop ebp
dec ecx
pop ebp
je 0x4ff82d
cmp edi, eax
inc edx
dec esi
push ebx
pop ecx
dec ecx
push 0x56
call fcn.004f6bad
outsd dx, dword [esi]
push edi
inc edx
push edx
pop edx
dec ebp
pop edi
dec ebx
imul eax, dword fs:[ebx + 0x47], 0x39
jne 0x4ff7f6
fld qword [eax]
dec ebx
dec edx
cmp dword [ebp + 0xc], 0
jmp 0x4ff826
add dword [esp + 4], 0xad
ret
add bl, al
inc esi
dec esp
inc edi
pop ebx
jmp 0x5da5bbbf
and al, 0
movsd dword es:[edi], dword [esi]
mov edx, 0x4481ffef
and al, 4
lock add byte [eax], al
add bl, al
movzx eax, al
push ebx
inc edx
dec ebp
insb byte es:[edi], dx
mov edx, edi
push edi
mov edx, dword [ebp + 0xc]
inc eax
pop edx
pop ebx
xor edx, edx
inc ebx
lea eax, [ebp - 0x68]
inc ecx
inc esi
outsd dx, dword [esi]
push 0x62584f61
or eax, 0xffffffff
inc ebx
mov eax, esi
mov dl, byte [edi]
push edi
push ebp
and eax, 0x1f
ret
arpl word [ebx + 0x59], dx
arpl word [edx + 0x4a], sp