Function at 0x421e30
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d470a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x190
mov eax, dword [0x56b06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x181], dl
mov eax, ecx
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x190], 0xffffffff
lea eax, [ebp - 0x198]
mov dword [ebp - 4], 0
push 0
push eax
mov edx, 0x4e07b0
mov dword [ebp - 0x198], 0x1a
lea ecx, [ebp - 0xf8]
call fcn.00428540
add esp, 8
cmp byte [ebp - 0x181], 0
mov edx, str.Yandexui
mov eax, str.Yandexui_yd2
mov byte [ebp - 4], 1
cmove edx, eax
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421ef0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xf8]
call fcn.00413720
mov dword [ebp - 0xa0], 0
xor ecx, ecx
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x19c], 0x18
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xe4]
cmp edx, 8
jb 0x421f98
mov ecx, dword [ebp - 0xf8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421f8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42258a
push edx
push ecx
call fcn.004835cc
add esp, 8
push 0x80
xor eax, eax
mov dword [ebp - 0xe8], 0
cmp dword [ebp - 0x9c], 8
lea ecx, [ebp - 0x190]
push 3
mov word [ebp - 0xf8], ax
lea eax, [ebp - 0xb0]
cmovae eax, dword [ebp - 0xb0]
push 1
push SysReAllocStringLen
push eax
mov dword [ebp - 0xe4], 7
call fcn.0041ddc0
test eax, eax
je 0x422099
mov esi, dword [ebp - 0x190]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x26
jne 0x422099
push ecx
lea eax, [ebp - 0x189]
mov byte [ebp - 0x189], 0
push eax
push 0x26
lea ecx, [ebp - 0xd4]
call fcn.00420830
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xd0]
mov edi, dword [ebp - 0xd4]
sub eax, edi
mov dword [ebp - 0x188], eax
je 0x422127
push 0
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x198], 0
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x422121
mov byte [ebp - 4], 3
test edi, edi
je 0x422099
mov ecx, dword [ebp - 0xcc]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x42208f
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42258f
push ecx
push edi
call fcn.004835cc
add esp, 8
cmp dword [ebp - 0x9c], 8
lea eax, [ebp - 0xb0]
push 2
cmovae eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0x190]
push 2
push 0
push 0x40000000
push eax
call fcn.0041ddc0
mov esi, dword [ebp - 0x190]
test eax, eax
je 0x42234e
lea eax, [ebp - 0xd8]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0xd8], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x40
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x198], edi
test edi, edi
je 0x422594
jmp 0x42224e
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0xf
mov byte [ebp - 0xf8], 0
cmp edi, dword [ebp - 0xd0]
je 0x422157
push eax
push edi
lea ecx, [ebp - 0xf8]
call fcn.00409010
mov ecx, dword [ebp - 0x194]
lea edx, [ebp - 0xf8]
mov byte [ebp - 4], 5
call fcn.00421ce0
mov edx, dword [ebp - 0xe4]
cmp edx, 0x10
jb 0x4221a6
mov ecx, dword [ebp - 0xf8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42219c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42259e
push edx
push ecx
call fcn.004835cc
add esp, 8
test edi, edi
je 0x4221da
mov ecx, dword [ebp - 0xcc]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x4221d0
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225a3
push ecx
push edi
call fcn.004835cc
add esp, 8
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x42221a
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x422210
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225a8
push edx
push ecx
call fcn.004835cc
add esp, 8
xor eax, eax
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
cmp esi, 0xffffffff
je 0x422243
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x194]
jmp 0x42256c
push edi
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 6
call fcn.004225f0
mov byte [ebp - 4], 7
mov edx, dword [eax]
mov ecx, edx
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
lea eax, [ecx + 1]
mov dword [ebp - 0x188], eax
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422290
sub ecx, dword [ebp - 0x188]
push ecx
push edx
lea ecx, [ebp - 0xc8]
call fcn.00409010
mov eax, dword [ebp - 0x180]
lea ecx, [ebp - 0x17c]
cmp eax, ecx
je 0x4222c3
push eax
call fcn.004b4845
add esp, 4
push edi
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0xb4], 0x10
lea eax, [ebp - 0xc8]
mov ecx, dword [ebp - 0xb8]
cmovae eax, dword [ebp - 0xc8]
test ecx, ecx
je 0x422377
push 0
lea edx, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x422377
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xb4]
cmp edx, 0x10
jb 0x42234e
mov ecx, dword [ebp - 0xc8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x422344
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225ad
push edx
push ecx
call fcn.004835cc
add esp, 8
cmp byte [ebp - 0x181], 0
je 0x422422
mov edx, 0x56c034
lea ecx, [ebp - 0xe0]
call fcn.00421ce0
mov ecx, eax
mov eax, 0x1a
jmp 0x422439
mov edi, dword [ebp - 0x194]
lea edx, [ebp - 0xc8]
mov ecx, edi
call fcn.00421ce0
mov edx, dword [ebp - 0xb4]
cmp edx, 0x10
jb 0x4223c4
mov ecx, dword [ebp - 0xc8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4223ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225b2
push edx
push ecx
call fcn.004835cc
add esp, 8
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
mov edx, dword [ebp - 0x9c]
cmp edx, 8
jb 0x422545
mov ecx, dword [ebp - 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42253b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225b7
jmp 0x42253b
mov edx, 0x56c04c
lea ecx, [ebp - 0xc8]
call fcn.00421ce0
mov ecx, eax
mov eax, 0x1c
mov edi, dword [ebp - 0x194]
or eax, 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [edi], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
test al, 4
je 0x4224d9
mov edx, dword [ebp - 0xb4]
and eax, 0xfffffffb
mov dword [ebp - 0x188], eax
cmp edx, 0x10
jb 0x4224be
mov ecx, dword [ebp - 0xc8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4224ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225bc
push edx
push ecx
call fcn.004835cc
mov eax, dword [ebp - 0x188]
add esp, 8
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0xf
mov byte [ebp - 0xc8], 0
test al, 2
je 0x4223df
mov edx, dword [ebp - 0xcc]
cmp edx, 0x10
jb 0x42251b
mov ecx, dword [ebp - 0xe0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x422511
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4225c1
push edx
push ecx
call fcn.004835cc
add esp, 8
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0xf
mov byte [ebp - 0xe0], 0
jmp 0x4223df
push edx
push ecx
call fcn.004835cc
add esp, 8
xor eax, eax
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
mov dword [ebp - 0xa0], eax
cmp esi, 0xffffffff
je 0x42256a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048358b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004b1db8
call fcn.004b1db8
push 0x8007000e
call fcn.00421000
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
call fcn.004b1db8
int3