Function at 0x6553d0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b841b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x65542b
mov eax, dword [ebx]
sub esp, 0xc
lea ecx, [ebp - 0x40]
push 3
push 1
push SysReAllocString
push eax
call fcn.00415b70
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x655483
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 8
lea eax, [ebp - 0x58]
push eax
push esi
call ebx
test eax, eax
jne 0x655467
call fcn.00415b30
cmp dword [ebp - 0x58], 0x53534e53
je 0x65548a
cmp dword [ebp - 0x54], 1
je 0x65548a
test esi, esi
je 0x655483
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor bl, bl
jmp 0x6558e3
lea eax, [ebp - 0x44]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x50], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x48], eax
cmp eax, 0xffffffff
jne 0x6554c1
call fcn.00415b30
test eax, eax
js 0x65555c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x98], eax
mov ecx, dword [ebp - 0x44]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor dl, dl
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x18], ecx
mov edi, 8
mov byte [ebp - 0x91], dl
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 1
test ecx, ecx
jb 0x65582e
ja 0x655510
cmp eax, edi
jbe 0x65582e
nop
push 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x34], 0
push eax
push edi
push esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x655539
call fcn.00415b30
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 2
lea eax, [ebp - 0x34]
push eax
push esi
call ebx
test eax, eax
jne 0x65556d
call fcn.00415b30
test eax, eax
jmp 0x655571
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x98], eax
jmp 0x6554c4
cmp dword [ebp - 0x14], 2
jne 0x655701
mov eax, dword [ebp - 0x34]
test ax, ax
je 0x655701
push ecx
lea ecx, [ebp - 0x92]
movzx eax, ax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
mov byte [ebp - 0x92], 0
call fcn.0041e2a0
push 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
movzx eax, word [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
push ecx
push eax
push ebx
push esi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x6555de
call fcn.00415b30
test eax, eax
jmp 0x6555e4
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x14], eax
jne 0x6556f5
movzx ecx, word [ebp - 0x34]
add edi, 2
mov eax, dword [ebx]
add edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x48], eax
cmp al, 6
jne 0x6556a8
mov edi, dword [ebx + 0xd]
test edi, edi
je 0x6556a8
cmp edi, ecx
jae 0x6556a8
push 0
push edi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.0041b2e0
mov byte [ebp - 4], 3
lea eax, [ebx + 0x11]
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
push edi
cmovae ecx, dword [ebp - 0x70]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.004057b0
add esp, 0x14
mov byte [ebp - 4], 4
call fcn.00451010
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.0058a560
lea ecx, [ebp - 0x90]
test al, al
je 0x655697
mov byte [ebp - 0x91], 1
call fcn.00404490
lea ecx, [ebp - 0x70]
call fcn.00407a10
jmp 0x6556ca
call fcn.00404490
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.00407a10
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
push ecx
cmp dword [ebp - 0x1c], eax
je 0x6556c1
mov ecx, eax
call fcn.004788e0
add dword [ebp - 0x20], 0xc
jmp 0x6556ca
push eax
lea ecx, [ebp - 0x24]
call fcn.00655e20
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040f050
xor eax, eax
cmp eax, dword [ebp - 0x18]
ja 0x655701
mov edi, dword [ebp - 0x14]
jb 0x6556ea
cmp edi, dword [ebp - 0x98]
jae 0x655701
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x655510
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040f050
cmp byte [ebp - 0x91], 0
je 0x65582e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x655722
push esi
call edi
mov dword [ebp - 0x40], 0
mov ebx, dword [ebp - 0x38]
cmp dword [ebx + 0x14], 8
jb 0x65572d
mov ebx, dword [ebx]
sub esp, 0xc
lea ecx, [ebp - 0x40]
push 2
push 2
push 0x40000000
push ebx
call fcn.00415b70
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x6558b5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x38]
push eax
push 8
lea eax, [ebp - 0x58]
push eax
push esi
call ebx
test eax, eax
jne 0x655787
call fcn.00415b30
test eax, eax
je 0x655787
test esi, esi
je 0x6558b5
push esi
call edi
xor esi, esi
mov byte [ebp - 0x91], 0
jmp 0x655842
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
cmp edi, eax
je 0x65582e
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push edi
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.004788e0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
movzx eax, ax
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x4c]
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push esi
call ebx
test eax, eax
jne 0x6557e0
call fcn.00415b30
mov ebx, eax
jmp 0x6557e2
xor ebx, ebx
movzx eax, word [ebp - 0x18]
lea ecx, [ebp - 0x14]
push 0
push ecx
push eax
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x655802
call fcn.00415b30
jmp 0x655804
xor eax, eax
test ebx, ebx
jne 0x6558a0
test eax, eax
jne 0x6558a0
lea ecx, [ebp - 0x30]
call fcn.0040f050
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add edi, 0xc
cmp edi, dword [ebp - 0x38]
jne 0x6557a0
test esi, esi
je 0x65583b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov byte [ebp - 0x91], 1
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x6558dd
mov ebx, dword [ebp - 0x20]
cmp edi, ebx
je 0x655862
mov ecx, edi
call fcn.0040f050
add edi, 0xc
cmp edi, ebx
jne 0x655854
mov ecx, dword [ebp - 0x1c]
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x24]
sub ecx, edi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, edi
shl ecx, 2
cmp ecx, 0x1000
jb 0x6558be
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x6558be
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test esi, esi
je 0x6558ad
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea ecx, [ebp - 0x30]
call fcn.0040f050
mov byte [ebp - 0x91], 0
jmp 0x655842
push ecx
push edi
call fcn.0076d313
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov bl, byte [ebp - 0x91]
test esi, esi
je 0x6558ee
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret 4