Function at 0x416e88
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x416e91
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov eax, 0x4dece8
call fcn.004d08c0
mov word [ebp - 0x14], 8
mov ax, word [0x4dda74]
cmp ax, 0x5f
je 0x416ed5
cmp ax, 0x62
je 0x416ed5
cmp ax, 0x63
jne 0x416ef1
mov dword [0x4dec70], 0xfffff448
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
test ebx, ebx
jne 0x416f11
mov dword [0x4dec70], 0xfffff447
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
mov cl, byte [ebx]
test cl, cl
jne 0x416f33
mov dword [0x4dec70], 0xfffff446
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
push ebx
push 0x5cd1a8
lea ecx, [ebp - 0x3828]
push ecx
call fcn.004d26c8
add esp, 0xc
xor esi, esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x3828]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x416ff6
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xe7
je 0x416fb4
cmp esi, 5
jge 0x416f93
inc esi
push 1
call fcn.004d9f54
pop ecx
push 0
call sub.KERNEL32.dll_Sleep
jmp 0x416f4a
mov dword [0x4dec70], 0xfffff433
mov dword [0x4dec74], eax
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
push 0x7530
lea ecx, [ebp - 0x3828]
push ecx
call fcn.00416558
add esp, 8
test eax, eax
jne 0x416f4a
mov dword [0x4dec70], 0xfffff43d
call sub.KERNEL32.dll_GetLastError
mov dword [0x4dec74], eax
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x417086
test edi, edi
jne 0x417011
mov eax, dword [ebp + 0xc]
push eax
call fcn.004cdfec
pop ecx
mov edi, eax
cmp edi, 0x1c00
jle 0x41701e
mov edi, 0x1c00
push edi
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x3828]
push edx
call fcn.004cddfc
add esp, 0xc
push edi
lea ecx, [ebp - 0x3828]
push ecx
call fcn.00416584
add esp, 8
lea edx, [ebp - 0x28]
push 0
push edx
push eax
lea eax, [ebp - 0x3828]
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x417086
mov dword [0x4dec70], 0xfffff429
call sub.KERNEL32.dll_GetLastError
mov dword [0x4dec74], eax
push ebx
call sub.KERNEL32.dll_CloseHandle
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
push 0xa
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4170fa
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x4170a9
mov dword [ebp + 0x18], 0x1c00
push 0
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
push ebx
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x4170ea
mov dword [0x4dec70], 0xfffff41f
call sub.KERNEL32.dll_GetLastError
mov dword [0x4dec74], eax
push ebx
call sub.KERNEL32.dll_CloseHandle
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
mov ecx, dword [ebp - 0x28]
push ecx
mov eax, dword [ebp + 0x14]
push eax
call fcn.004166c8
add esp, 8
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x417145
mov esp, ebp
mov edi, dword [ebp - 0x3834]
mov esi, dword [ebp - 0x3830]
mov ebx, dword [ebp - 0x382c]
pop ebp
ret