Function at 0x41b1c1
Capabilities:
Clear file content
Get file size
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
xor eax, eax
or dword [ebp - 0xc], 0xffffffff
lea edi, [ebp - 0x4c]
or dword [ebp - 0x10], 0xffffffff
stosd dword es:[edi], eax
mov esi, ecx
mov edx, SysReAllocString
mov word [ebp - 4], 0xbbef
mov byte [ebp - 2], 0xbf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
push 4
push ecx
push 7
mov ecx, 0x406154
mov dword [ebp - 8], edi
call fcn.0041b0d5
mov ebx, eax
test ebx, ebx
jns 0x41b231
push ebx
call fcn.004314fa
jmp 0x41b5a9
push esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x41b24f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
jmp 0x41b226
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x41b25f
cmp esi, 0xffffffff
je 0x41b25f
mov eax, esi
jmp 0x41b261
xor eax, eax
lea ecx, [ebp - 0x4c]
push ecx
push 0
push 3
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
jne 0x41b2ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x2c], edi
cmp eax, 0x3e5
jne 0x41b2b9
test esi, esi
je 0x41b295
cmp esi, 0xffffffff
je 0x41b295
mov eax, esi
jmp 0x41b297
xor eax, eax
push 1
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x41b23f
test esi, esi
je 0x41b2d7
cmp esi, 0xffffffff
je 0x41b2d7
mov eax, esi
jmp 0x41b2d9
test eax, eax
jg 0x41b2c1
mov ebx, eax
jmp 0x41b2ca
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x41b5a9
jmp 0x41b226
xor eax, eax
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x41b301
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
push ebx
call fcn.004314fa
jmp 0x41b58d
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
test eax, eax
jg 0x41b321
jl 0x41b311
test ecx, ecx
jne 0x41b316
xor ebx, ebx
push ebx
jmp 0x41b2f7
test eax, eax
jg 0x41b321
jl 0x41b321
cmp ecx, 4
ja 0x41b32b
mov eax, 0x8000ffff
mov ebx, eax
push eax
jmp 0x41b2f7
test eax, eax
jne 0x41b321
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
lea ecx, [ebp - 0x20]
call fcn.00432f2b
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x41b35e
mov ebx, 0x8007000e
push ebx
call fcn.004314fa
jmp 0x41b58a
test esi, esi
je 0x41b36b
cmp esi, 0xffffffff
je 0x41b36b
mov eax, esi
jmp 0x41b36d
xor eax, eax
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x41b390
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
jmp 0x41b353
test esi, esi
je 0x41b39d
cmp esi, 0xffffffff
je 0x41b39d
mov eax, esi
jmp 0x41b39f
xor eax, eax
push 0
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x38]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b380
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x24], eax
je 0x41b3c6
mov eax, 0x8000ffff
mov ebx, eax
push eax
jmp 0x41b354
mov cl, byte [edi]
cmp cl, 0xff
jne 0x41b554
cmp byte [edi + 1], 0xfe
jne 0x41b554
lea eax, [ebp - 0x10]
mov edx, 0xc0000000
push eax
push ecx
push ecx
push 2
push ecx
push 0
mov ecx, 0x40616c
call fcn.0041b0d5
mov ebx, eax
test ebx, ebx
js 0x41b353
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x41b411
cmp esi, 0xffffffff
je 0x41b411
mov eax, esi
xor ebx, ebx
jmp 0x41b415
xor ebx, ebx
mov eax, ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x41b440
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
push ebx
call fcn.004314fa
mov esi, dword [ebp - 0xc]
jmp 0x41b58a
test esi, esi
je 0x41b44b
mov eax, esi
cmp esi, 0xffffffff
jne 0x41b44d
mov eax, ebx
push ebx
lea ecx, [ebp - 0x28]
push ecx
push 3
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41b424
mov eax, dword [ebp - 0x38]
lea edx, [edi + 2]
add eax, 0xfffffffe
test esi, esi
je 0x41b477
mov ecx, esi
cmp esi, 0xffffffff
jne 0x41b479
mov ecx, ebx
push ecx
lea edi, [ebp - 0x28]
push edi
push eax
call fcn.0041acb5
mov ebx, eax
test ebx, ebx
js 0x41b432
test esi, esi
je 0x41b499
cmp esi, 0xffffffff
je 0x41b499
mov eax, esi
xor edi, edi
jmp 0x41b49d
xor edi, edi
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x41b424
test esi, esi
je 0x41b4c0
cmp esi, 0xffffffff
je 0x41b4c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042ff3c
mov ebx, eax
test ebx, ebx
js 0x41b432
lea eax, [ebp - 0x18]
push eax
push edi
push 0x406138
push dword [ebp - 0x1c]
call fcn.004307e7
mov ebx, eax
test ebx, ebx
js 0x41b432
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
push edi
push 0x40616c
push esi
call fcn.004307e7
mov ebx, eax
test ebx, ebx
js 0x41b432
lea eax, [ebp - 0x14]
push eax
push edi
push 0x406154
push esi
call fcn.004307e7
mov ebx, eax
test ebx, ebx
js 0x41b432
push edi
push edi
push 3
push edi
mov edi, dword [ebp - 8]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x41b54f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
push ebx
call fcn.004314fa
mov esi, dword [ebp - 0xc]
jmp 0x41b58d
cmp dword [ebp - 0x34], 0
jl 0x41b3bc
jg 0x41b569
cmp eax, 3
jb 0x41b3bc
cmp cl, byte [ebp - 4]
jne 0x41b3bc
mov al, byte [edi + 1]
cmp al, byte [ebp - 3]
jne 0x41b3bc
mov al, byte [edi + 2]
cmp al, byte [ebp - 2]
jne 0x41b3bc
mov edi, dword [ebp - 8]
test esi, esi
je 0x41b596
cmp esi, 0xffffffff
jne 0x41b598
xor esi, esi
lea eax, [ebp - 0x4c]
push eax
push 0
push 3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
push ebx
call fcn.00431467
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x41b5bc
push eax
call fcn.00431523
test edi, edi
je 0x41b5c6
push edi
call fcn.00431523
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41b5d3
push eax
call fcn.00431523
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41b5e0
push eax
call fcn.00431523
lea ecx, [ebp - 0x30]
call fcn.0042dbea
lea ecx, [ebp - 0x20]
call fcn.0042dbea
lea ecx, [ebp - 0x10]
call fcn.004316b4
lea ecx, [ebp - 0xc]
call fcn.004316b4
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret