Function at 0x425fb8
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
lea eax, [ebp - 0x154]
push edi
mov edi, ecx
push eax
call fcn.00425a1d
lea eax, [ebp - 0x154]
push eax
call fcn.0040f0b8
test al, al
pop ecx
je 0x4265ff
xor ebx, ebx
lea eax, [ebp - 0x154]
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x20], esi
je 0x4265ff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
push ebx
push 0xfffffffffffffffc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 4], eax
call esi
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x30]
sub eax, 4
push eax
mov dword [ebp - 4], eax
call fcn.00427db9
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
jne 0x426073
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4265ff
lea ecx, [ebp - 0x40]
push ebx
push ecx
push dword [ebp - 4]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call esi
lea ecx, [ebp - 0x18]
call fcn.0041e62f
push dword [ebp - 4]
lea ecx, [ebp - 0x18]
push dword [ebp - 8]
call fcn.0041e8b1
lea ecx, [ebp - 0x18]
call fcn.0041eb4a
test al, al
je 0x4265ee
lea ecx, [ebp - 0x18]
call fcn.0041eb4a
test al, al
je 0x4265ee
cmp dword [ebp - 0x18], 2
jb 0x4265ee
lea ecx, [ebp - 0x3c]
call fcn.0041e62f
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041e84d
cmp al, 0x5c
jne 0x426118
push 1
lea ecx, [ebp - 0x18]
call fcn.0041e84d
push 2
lea ecx, [ebp - 0x18]
call fcn.0041f167
lea esi, [eax + 6]
lea ecx, [ebp - 0x18]
push esi
push ebx
call fcn.0041f4ff
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041e7ea
push esi
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041ec13
xor esi, esi
cmp dword [ebp - 0x18], ebx
mov byte [ebp - 0x19], bl
jbe 0x42626f
push esi
lea ecx, [ebp - 0x18]
call fcn.0041e84d
cmp al, 0xd
je 0x42613e
inc esi
cmp esi, dword [ebp - 0x18]
jb 0x426126
jmp 0x42626f
cmp esi, 0xffffffff
je 0x42626f
push esi
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041f4ff
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041e703
push ebx
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041ef17
mov esi, eax
cmp esi, 0xffffffff
je 0x426267
lea ecx, [ebp - 0x2c]
call fcn.0041f593
lea eax, [eax + esi + 1]
push eax
push 0x430ce4
mov dword [ebp - 4], eax
call fcn.00427a10
pop ecx
test eax, eax
pop ecx
jge 0x426193
mov byte [ebp - 0x19], 1
test byte [0x4812a4], 0x40
jne 0x426267
cmp byte [edi + 0x92], bl
jne 0x426267
push dword [ebp - 4]
push 0x430ce0
call fcn.00427a10
pop ecx
test eax, eax
pop ecx
jge 0x426267
inc esi
lea ecx, [ebp - 0x18]
push esi
push ebx
call fcn.0041ef17
mov esi, eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xc], esi
lea eax, [esi + 1]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0041ef17
cmp esi, 0xffffffff
mov dword [ebp - 8], eax
je 0x426267
cmp eax, 0xffffffff
je 0x426267
mov esi, 0x4810c0
push 0x481744
mov ecx, esi
call fcn.0041cf5a
push 0x7fffffff
push 0x481744
mov ecx, esi
call fcn.0041dbff
push 0x481744
mov ecx, esi
call fcn.00418851
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
sub eax, dword [ebp - 0xc]
lea esi, [eax - 1]
push esi
push dword [ebp - 4]
call fcn.0041f4ff
push eax
lea ecx, [ebp - 0x50]
call fcn.0041e703
push esi
lea ecx, [ebp - 0x18]
push dword [ebp - 4]
call fcn.0041ec13
push ebx
mov ecx, 0x481744
push dword [ebp - 4]
call fcn.0041f593
push eax
lea ecx, [ebp - 0x18]
call fcn.0041f28a
lea ecx, [ebp - 0x50]
call fcn.0041e765
lea ecx, [ebp - 0x2c]
call fcn.0041e765
push 1
push ebx
push str.Backups:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041ef3a
push 1
push ebx
push str.Files:_r_n
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.0041ef3a
cmp eax, esi
jge 0x42629d
push dword [ebp - 0x20]
jmp 0x4265de
push 1
mov esi, str.Shared:_r_n
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.0041ef3a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
add ecx, eax
cmp dword [edi + 0x7c], ebx
mov dword [ebp - 0xc], ecx
jle 0x426351
mov dword [ebp - 8], ebx
push ebx
push dword [edi + 0x8c]
call fcn.0040f085
pop ecx
cmp eax, ebx
pop ecx
je 0x426349
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041e69f
cmp byte [ebp - 0x19], bl
jne 0x42630d
push ebx
push 0x7c
lea ecx, [ebp - 0x2c]
call fcn.0041ef17
cmp eax, 0xffffffff
je 0x42630d
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041ec13
push ebx
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc]
call fcn.0041f593
push eax
lea ecx, [ebp - 0x18]
call fcn.0041f28a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add eax, ecx
push ebx
push eax
push 0x42ea2c
lea ecx, [ebp - 0x18]
call fcn.0041f28a
inc dword [ebp - 8]
lea ecx, [ebp - 0x2c]
call fcn.0041e765
push dword [ebp - 8]
jmp 0x4262cf
lea ecx, [edi + 0x78]
call fcn.0041f8b8
cmp dword [edi + 0x54], ebx
jbe 0x4263e9
push 1
push ebx
push str.Backups:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041ef3a
push str.Backups:_r_n
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ebx
add ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x2c]
call fcn.0041e62f
push dword [ebp - 4]
lea ecx, [edi + 0x54]
call fcn.0041f23c
test al, al
je 0x4263d4
lea eax, [ebp - 0x2c]
lea ecx, [edi + 0x54]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041f199
push ebx
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc]
call fcn.0041f593
push eax
lea ecx, [ebp - 0x18]
call fcn.0041f28a
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
add eax, ecx
push ebx
push eax
push 0x42ea2c
lea ecx, [ebp - 0x18]
call fcn.0041f28a
jmp 0x426387
push 0x4311c8
lea ecx, [edi + 0x54]
call fcn.0041e77c
lea ecx, [ebp - 0x2c]
call fcn.0041e765
cmp dword [edi + 0x10], ebx
jle 0x426459
push 1
push ebx
push str.Files:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041ef3a
push str.Files:_r_n
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
add ecx, eax
push ebx
mov dword [ebp - 0xc], ecx
push dword [edi + 0x20]
call fcn.0040f085
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x426451
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp - 0xc]
push eax
call fcn.0041f28a
push ebx
push dword [ebp - 4]
call esi
add eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push 0x42ea2c
call fcn.0041f28a
inc dword [ebp - 8]
push dword [ebp - 8]
jmp 0x426414
lea ecx, [edi + 0xc]
call fcn.0041f8b8
cmp dword [edi + 0x28], ebx
jle 0x4264c9
push 1
push ebx
push str.Directories:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041ef3a
push str.Directories:_r_n
mov dword [ebp - 4], eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ebx
add ecx, eax
push ebx
mov dword [ebp - 0xc], ecx
push dword [edi + 0x38]
call fcn.0040f085
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x4264c1
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp - 0xc]
push eax
call fcn.0041f28a
push ebx
push dword [ebp - 4]
call esi
add eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push 0x42ea2c
call fcn.0041f28a
inc dword [ebp - 8]
push dword [ebp - 8]
jmp 0x426484
lea ecx, [edi + 0x24]
call fcn.0041f8b8
push 1
push ebx
push str.Registry:_r_n
lea ecx, [ebp - 0x18]
call fcn.0041ef3a
push str.Registry:_r_n
mov dword [ebp - 4], eax
call esi
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0x18]
add esi, eax
mov eax, dword [ebp - 0x18]
sub eax, esi
push eax
push esi
call fcn.0041f4ff
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041e703
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
sub eax, esi
push eax
push esi
call fcn.0041ec13
lea ecx, [ebp - 0x2c]
mov dword [ebp - 8], ebx
call fcn.0041f593
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], eax
mov esi, 0x4815d8
jbe 0x42654c
mov dword [ebp - 4], 0x4814c8
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00425a7d
add dword [ebp - 4], 0x44
cmp dword [ebp - 4], esi
jl 0x42652e
cmp dword [edi + 0x40], ebx
jg 0x426556
cmp dword [edi + 0x64], ebx
jle 0x42655d
mov ecx, edi
call fcn.004248c9
mov dword [ebp - 4], 0x4814c8
push dword [ebp - 4]
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00424aae
add dword [ebp - 4], 0x44
cmp dword [ebp - 4], esi
jl 0x426564
lea ecx, [ebp - 0x2c]
call fcn.0041e765
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x3c]
push eax
call fcn.0041e92f
lea ecx, [ebp - 0x3c]
call fcn.0041ea99
lea ecx, [ebp - 0x3c]
call fcn.0041ea99
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
push eax
call fcn.0041e7ea
lea eax, [ebp - 0x44]
push ebx
push eax
lea ecx, [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.0041f593
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push edi
call esi
lea eax, [ebp - 0x44]
push ebx
push eax
lea eax, [ebp - 0x30]
push 4
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.0041e765
jmp 0x4265f7
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.0041e765
pop edi
pop esi
mov al, 1
pop ebx
leave
ret