Function at 0x41efe0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b1ccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
xor ebx, ebx
push edi
cmp word [esi + 0xa], bx
mov dword [esp + 0x44], ebx
jne 0x41f683
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0xb0]
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x30]
xor edx, edx
push eax
mov dl, byte [edi + 0x17]
mov eax, dword [edi + 0x1c]
lea ecx, [esp + 0x64]
push 0x40
push ecx
mov ecx, dword [edi + 0x30]
push edx
push eax
push ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x70], ebx
call fcn.0041fa10
mov ebp, eax
add esp, 0x24
cmp ebp, ebx
mov dword [esp + 0x20], ebp
je 0x41f68c
push ebp
call fcn.00410ee0
add esp, 4
cmp eax, ebx
mov dword [esp + 0x48], eax
je 0x41f695
push ebp
call fcn.00422ac0
add esp, 4
mov word [esi + 8], ax
mov eax, dword [esp + 0xa4]
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0xa8]
mov ebp, eax
push ecx
push ebp
push edx
call fcn.00429600
add esp, 0xc
test eax, eax
je 0x41f69e
mov ecx, dword [esp + 0x48]
push 0x1000
mov eax, dword [ecx]
call dword [eax + 8]
mov cx, word [esi + 8]
push eax
push ecx
mov dword [esp + 0x24], eax
call fcn.00422a30
mov edx, dword [esp + 0xcc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
add esp, 8
cmp eax, ebx
mov eax, dword [esp + 0xac]
mov dword [edx], 1
je 0x41f11d
or dword [eax + 0x24], 0x10
cmp dword [esp + 0x34], ebx
je 0x41f127
or dword [eax + 0x24], 0x20
mov eax, dword [esp + 0xa4]
push eax
call fcn.0041fbd0
mov edx, dword [esp + 0x2c]
mov dword [edi + 8], eax
xor ecx, ecx
xor eax, eax
or ecx, ebp
mov dword [edi + 0xc], ebx
or edx, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
mov eax, edx
and eax, 0xfff
add esp, 4
mov ecx, eax
or ecx, ebx
je 0x41f198
cmp edi, ebx
ja 0x41f16e
cmp edx, 0x1000
jbe 0x41f183
mov ecx, eax
mov eax, edx
sub eax, ecx
mov ebp, ebx
mov ecx, edi
sbb ecx, ebp
add eax, 0x1000
adc ecx, ebx
jmp 0x41f19c
mov ecx, edx
mov eax, edx
sub eax, ecx
mov ebp, edi
mov ecx, edi
sbb ecx, ebp
add eax, 0x1000
adc ecx, ebx
jmp 0x41f19c
mov eax, edx
mov ecx, edi
mov dword [esi + 0x20], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x24], edi
mov edi, dword [esp + 0xb0]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x24]
lea eax, [edi + 0x38]
mov dword [edi + 0x34], edx
push eax
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.0042f280
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0xcc]
add esp, 0xc
mov dword [edi + 0x4c], eax
mov ecx, ebp
xor edi, edi
call fcn.0044af90
test eax, eax
jbe 0x41f1ec
mov edi, 1
mov ecx, dword [esp + 0xc8]
call fcn.0044af90
test eax, eax
jbe 0x41f1fd
inc edi
mov ecx, ebp
call fcn.0044af90
test eax, eax
jbe 0x41f213
mov ecx, ebp
call fcn.0044af90
mov ebp, eax
jmp 0x41f215
xor ebp, ebp
mov ecx, dword [esp + 0xc8]
call fcn.0044af90
add ebp, eax
mov eax, dword [esp + 0xcc]
cmp eax, ebx
je 0x41f287
mov ecx, dword [esp + 0xd0]
cmp ecx, ebx
je 0x41f287
cmp word [eax + 0xc], bx
mov dword [esp + 0x18], ebx
jbe 0x41f287
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edx
call fcn.00423df0
add esp, 4
test eax, eax
je 0x41f262
mov eax, dword [esp + 0x10]
inc edi
add ebp, dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xcc]
mov eax, dword [esp + 0x18]
add ecx, 0x28
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov cx, word [edx + 0xc]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x41f247
lea eax, [edi + edi*4]
lea ecx, [ebp + eax*8 + 0xd8]
mov eax, 0xfff001
mul ecx
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0x1c]
shr edx, 4
inc edx
shl edx, 0xc
mov dword [eax + 0x24], edx
mov dx, word [esi + 8]
push edx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0x1000
call fcn.0041f6e0
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 4
mov word [esi + 6], ax
mov eax, dword [esp + 0xa4]
push ebx
push ebx
push ebx
push eax
call ebp
mov edi, dword [esp + 0xa8]
push ebx
push ebx
push ebx
push edi
call ebp
mov ebp, dword [esp + 0xac]
mov ecx, dword [esp + 0xc8]
mov eax, dword [ebp + 0x24]
or al, 1
mov dword [ebp + 0x24], eax
call fcn.0044af90
neg eax
sbb eax, eax
inc eax
push eax
push ebp
push edi
call fcn.00422250
add esp, 0xc
test eax, eax
je 0x41f6a7
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
or ecx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
jne 0x41f358
mov edx, dword [esp + 0xb0]
push ebx
push ebx
mov eax, dword [edx + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x18], 1
mov dword [esp + 0x10], ebx
jmp 0x41f55d
push 0x1000
call fcn.004a2973
mov ecx, dword [esp + 0x20]
mov ebp, eax
push ecx
call fcn.004a2973
mov edx, dword [esp + 0xb8]
add esp, 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], ebx
mov eax, dword [edx + 0x24]
push ebx
push ebx
push eax
push edi
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0x400
xor eax, eax
mov edi, ebp
push ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0xa8]
lea eax, [esp + 0x30]
push eax
push 0x1000
push ebp
push ecx
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41f484
cmp dword [esp + 0x2c], ebx
je 0x41f48d
lea edx, [esp + 0x30]
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x5c]
push 0x1000
push ebp
lea edx, [esp + 0x70]
push ecx
mov cx, word [esi + 8]
push edx
push eax
push ecx
mov dword [esp + 0x6c], ebx
call fcn.0041e2d0
add esp, 0x2c
cmp eax, ebx
jne 0x41f49a
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
mov cx, word [esi + 8]
push edx
push eax
push ecx
call fcn.00422a60
mov ecx, dword [esp + 0xb4]
add esp, 0xc
lea edx, [esp + 0x50]
mov edi, eax
mov eax, dword [esp + 0x14]
push ebx
push edx
push edi
push eax
push ecx
mov dword [esp + 0x64], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41f4fe
cmp dword [esp + 0x50], edi
jb 0x41f505
mov eax, dword [esi + 0x28]
cmp eax, ebx
jne 0x41f478
mov dword [esi + 0x2c], edi
inc eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], eax
jmp 0x41f391
push 0x223e
push 0xd
jmp 0x41f50c
mov dword [esp + 0x18], 1
jmp 0x41f51c
jge 0x41f4f5
push 0x4f4c50
lea ecx, [esp + 0x14]
call fcn.00447770
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
push 0x2253
push edx
push eax
push ecx
lea edx, [esp + 0x20]
push str.Error:_Encrypt_Data_Failed__File__Algrithm_d__DataLen_lu_KeyLen_lu__LINE_d
push edx
mov dword [esp + 0xb4], ebx
call fcn.00449050
mov eax, dword [esp + 0x28]
push eax
call fcn.00424560
add esp, 0x1c
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00447cd0
push 0x2257
push 0x11
jmp 0x41f50c
push 0x2262
jmp 0x41f50a
push 0x226a
push 0xe
call fcn.0041b3d0
add esp, 8
mov dword [esp + 0x10], 1
cmp ebp, ebx
je 0x41f529
push ebp
call fcn.004a299c
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x41f53e
push eax
call fcn.004a299c
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x41f54f
push eax
call fcn.004a299c
add esp, 4
mov ebp, dword [esp + 0xac]
mov edi, dword [esp + 0xa8]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [esp + 0x18], ebx
je 0x41f6bd
cmp dword [esp + 0x10], ebx
jne 0x41f6bd
cmp dword [esp + 0xd8], ebx
je 0x41f5bd
cmp dword [esp + 0xdc], ebx
je 0x41f5bd
lea ecx, [esp + 0x20]
push 1
push ecx
push ebx
push edi
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x20]
xor edx, edx
or edx, eax
mov eax, dword [esp + 0xb0]
xor ebp, ebp
or ecx, ebp
mov ebp, dword [esp + 0xac]
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x30], ebx
call fcn.0044af90
test eax, eax
je 0x41f5df
mov ecx, dword [esp + 0xc0]
call fcn.0044b330
jmp 0x41f5e3
mov eax, dword [esp + 0x30]
push eax
push ebp
call fcn.00421980
mov ecx, dword [esp + 0xd0]
add esp, 8
call fcn.0044af90
test eax, eax
je 0x41f60b
mov ecx, dword [esp + 0xc8]
call fcn.0044b330
mov ebx, eax
push ebx
push ebp
call fcn.004219d0
mov edx, dword [esp + 0xe8]
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xe0]
push edx
mov edx, dword [esp + 0xe0]
push eax
mov eax, dword [esp + 0xe0]
push ecx
mov ecx, dword [esp + 0xe0]
push edx
mov edx, dword [esp + 0xe0]
push eax
mov eax, dword [esp + 0xdc]
push ecx
mov ecx, dword [esp + 0xdc]
push edx
mov edx, dword [esp + 0xdc]
push eax
mov eax, dword [esp + 0xd8]
push ecx
push edx
push esi
push eax
push ebp
push edi
call fcn.00421ba0
add esp, 0x40
test eax, eax
je 0x41f6ae
mov dword [esp + 0x44], 1
jmp 0x41f6bd
push 0x21a4
push 1
jmp 0x41f6b5
push 0x21ba
push 0xb
jmp 0x41f6b5
push 0x21c2
push 0xc
jmp 0x41f6b5
push 0x21d4
push 0x25
jmp 0x41f6b5
push 0x2219
jmp 0x41f6b3
push 0x22ab
push 0x10
call fcn.0041b3d0
add esp, 8
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x90
ret