Function at 0x46fffa
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x424
mov esi, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x420], eax
lea ebx, [esp + 0x14]
mov dword [ebx], 0
call fcn.0046fef4
push ebx
mov dword [esp + 4], eax
push eax
call fcn.0046f998
add esp, 8
mov ebx, eax
mov ebp, 0
cmp eax, 0xffffffff
je 0x470090
mov esi, dword [esp + 0x438]
push esi
call fcn.0045b1e8
add esp, 4
xor ebp, ebp
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
sub eax, ebp
jbe 0x4700a0
mov ecx, dword [esi]
add ecx, ebp
push 0
lea edx, [esp + 0x24]
push edx
push eax
push ecx
push ebx
call edi
add ebp, dword [esp + 0x20]
test eax, eax
jne 0x470061
xor ebp, ebp
mov esi, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
xor eax, eax
mov dword [edi], eax
mov dword [esp + 4], 0
mov dword [esi], eax
jmp 0x4700ff
mov edi, dword [esp + 0x444]
test edi, edi
je 0x470201
xor ebp, ebp
push ebp
push 0x14
push 1
call fcn.004116c4
add esp, 0xc
mov esi, eax
push ebp
push eax
push 0x4703e4
push ebx
call fcn.0046b3fc
add esp, 0x10
mov dword [esi], eax
mov dword [esi + 4], ebx
call fcn.0045b10f
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov dword [esp + 4], esi
mov eax, dword [esp + 0x448]
mov dword [esi + 0x10], eax
xor ebx, ebx
dec ebx
mov esi, dword [esp + 0x440]
mov edi, dword [esp + 0x43c]
push dword [esp + 0x14]
call fcn.00411739
add esp, 4
push dword [esp]
call fcn.00411739
add esp, 4
cmp ebx, 0xffffffff
je 0x470122
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x47012f
push ebp
call fcn.0045b117
add esp, 4
mov ebx, dword [esp + 4]
test ebx, ebx
jne 0x47038c
cmp dword [edi], 0
jne 0x47038c
xor eax, eax
mov dword [edi], eax
mov dword [esi], eax
mov eax, dword [esp + 0x438]
cmp dword [eax + 8], 0x40000
ja 0x47038c
mov eax, 0x4a8376
push eax
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x47038c
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.PageantRequest_08x
call fcn.0045ad89
add esp, 8
mov edi, eax
xor esi, esi
call fcn.004709f4
mov ecx, 0
test al, al
je 0x47027e
call fcn.00470b53
test eax, eax
je 0x47027a
mov esi, eax
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
je 0x47027a
mov ebx, eax
push 1
push eax
call dword [0x4c4444]
test eax, eax
je 0x470273
push 0
push esi
push ebx
call dword [0x4c4448]
test eax, eax
je 0x470273
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x14]
mov esi, ebx
jmp 0x47027e
call fcn.0045b10f
mov ebp, eax
lea esi, [esp + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x470082
mov ecx, ebp
mov edx, esi
push dword [esp + 0x10]
call fcn.004703a7
add esp, 4
test eax, eax
je 0x47020c
mov edi, eax
cmp eax, 0xffffffff
je 0x470082
push ebp
call fcn.0045b146
add esp, 4
mov ecx, dword [esp + 0x43c]
mov dword [ecx], eax
mov esi, dword [esp + 0x440]
mov dword [esi], edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 4], 0
jmp 0x4700ff
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
xor ecx, ecx
push edi
push 0x40000
push 0
push 4
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
inc eax
cmp eax, 1
ja 0x4702ab
push edi
call fcn.00411739
add esp, 4
mov ebx, dword [esp + 4]
jmp 0x47038c
mov dword [esp + 0xc], esi
sub esp, 0x14
movaps xmm0, xmmword [0x4a1a60]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 8], edi
mov edi, eax
mov esi, dword [esp + 0x438]
push esi
call fcn.0045b1e8
add esp, 4
push dword [esi + 8]
push dword [esi]
mov dword [esp + 8], edi
push edi
mov edi, dword [esp + 0x14]
call fcn.00478390
add esp, 0xc
lea esi, [esp + 0x20]
mov dword [esi], 0x804e50ba
push edi
call fcn.00485930
add esp, 4
inc eax
mov dword [esi + 4], eax
mov dword [esi + 8], edi
push esi
push 0
push 0x4a
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x470360
mov eax, dword [esp]
mov ebp, dword [eax]
bswap ebp
lea eax, [ebp - 1]
cmp eax, 0x3fffb
ja 0x470360
add ebp, 4
push 0
push 1
push ebp
call fcn.004116c4
add esp, 0xc
mov esi, eax
push ebp
push dword [esp + 4]
push eax
call fcn.00478390
add esp, 0xc
mov eax, dword [esp + 0x43c]
mov dword [eax], esi
mov eax, dword [esp + 0x440]
mov dword [eax], ebp
push dword [esp]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00411739
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
mov ebx, dword [esp + 4]
je 0x47038c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00475893
mov eax, ebx
add esp, 0x424
pop esi
pop edi
pop ebx
pop ebp
ret