Function at 0x409d50
Capabilities:
Create thread
Read file on windows

Disassembly:
sub esp, 0x414
push ebx
push esi
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x428]
lea edx, [esp + 0x20]
push ecx
xor ebx, ebx
push edx
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call fcn.0040c0f0
add esp, 0x10
test eax, eax
jne 0x409d90
pop edi
pop esi
pop ebx
add esp, 0x414
ret
cmp dword [esp + 0x1c], 2
jne 0x409f20
mov ecx, dword [esp + 0xc]
push ebp
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push ecx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x409efc
cmp dword [esp + 0x438], ebx
je 0x409e00
mov ecx, dword [esp + 0x430]
cmp ecx, ebx
je 0x409dea
or eax, 0xffffffff
push ecx
mov ecx, dword [0x43cba0]
push eax
call fcn.0041fa40
jmp 0x409e45
mov eax, dword [esp + 0x434]
push ecx
mov ecx, dword [0x43cba0]
push eax
call fcn.0041fa40
jmp 0x409e45
mov eax, dword [esp + 0x430]
cmp eax, ebx
je 0x409e31
mov ecx, dword [0x43cba0]
push eax
mov edx, dword [ecx + 0x5c]
push edx
call fcn.004201e0
cmp eax, ebx
je 0x409efc
mov ecx, dword [0x43cba0]
push eax
call fcn.0041faa0
jmp 0x409e45
mov eax, dword [esp + 0x434]
mov ecx, dword [0x43cba0]
push ebx
push eax
call fcn.0041fc40
mov esi, eax
cmp esi, ebx
je 0x409efc
mov ecx, dword [esp + 0x428]
mov dword [esp + 0x18], ebx
push ecx
call fcn.0041ee10
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 4
lea edx, [esp + 0x18]
mov dword [esi + 0x94], eax
push ebx
push edx
lea eax, [esp + 0x2c]
push 0x400
push eax
push edi
mov dword [esp + 0x30], 1
call ebp
test eax, eax
je 0x409ec3
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
mov ecx, esi
call fcn.0041e780
mov ecx, esi
call fcn.0041ea60
cmp dword [esp + 0x18], ebx
jbe 0x409ec7
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x2c]
push 0x400
push ecx
push edi
call ebp
test eax, eax
jne 0x409e8e
mov dword [esp + 0x1c], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xd8]
cmp eax, ebx
je 0x409ef1
cmp dword [eax + 0x15c8], ebx
je 0x409ef1
mov dword [eax + 0x15c8], ebx
mov ecx, dword [0x43cba0]
call fcn.004092f0
mov ecx, esi
call fcn.0041e5e0
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call fcn.0041ee00
mov eax, dword [esp + 0x14]
push eax
call fcn.0041ee00
add esp, 8
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x414
ret
push 0x30
call fcn.00406d30
add esp, 4
cmp eax, ebx
je 0x409f3b
mov ecx, eax
call fcn.004096f0
mov esi, eax
cmp esi, ebx
jne 0x409f47
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x414
ret
mov edi, dword [esp + 0x10]
cmp byte [edi], bl
je 0x409f74
cmp byte [edi], 0x3a
jne 0x409f68
lea ecx, [esi + 0x10]
lea edx, [edi + 1]
push ecx
push edx
call fcn.004203f0
add esp, 8
test eax, eax
jne 0x409f72
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x409f4f
jmp 0x409f74
mov byte [edi], bl
mov eax, dword [esp + 0x424]
push eax
call fcn.0041ee10
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x18], edx
mov eax, dword [esp + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x42c]
add esp, 4
cmp eax, ebx
je 0x409fb2
push eax
call fcn.0041ee10
add esp, 4
jmp 0x409fb4
xor eax, eax
mov ecx, dword [esp + 0x42c]
mov dword [esi + 0x1c], eax
push ecx
mov dword [esi + 0x28], ebx
call fcn.0041ee10
mov edx, dword [esp + 0x434]
add esp, 4
mov dword [esi + 0x14], edx
lea edx, [esp + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x434]
push edx
push ebx
mov dword [esi + 0x2c], eax
mov ecx, dword [0x43cba4]
push esi
push 0x409720
push ebx
mov dword [esi], ecx
push ebx
mov dword [0x43cba4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x414
ret