Function at 0x404c27
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x14], ebp
call fcn.004050de
mov ebx, dword [esp + 0x20]
cmp ebx, ebp
jne 0x404c46
mov ebx, 0x40902c
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
mov edi, pe_nt_image_headers32
push edi
push 3
push ebp
push 1
push 0xc0000000
push ebx
mov dword [0x40ffcc], ebp
call esi
mov dword [0x40ffc0], eax
cmp eax, 0xffffffff
jne 0x404cb1
push ebp
push edi
push 3
push ebp
push 1
mov ebp, 0x80000000
push ebp
push ebx
call esi
mov dword [0x40ffc0], eax
cmp eax, 0xffffffff
jne 0x404c9c
push 0
push edi
push 3
push 0
push 3
push ebp
push ebx
call esi
mov dword [0x40ffc0], eax
mov dword [0x40ffcc], 1
cmp eax, 0xffffffff
je 0x404e9e
xor ebp, ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 3
mov edi, eax
pop ebx
mov dword [0x40ffd8], ebp
cmp edi, ebx
jl 0x404d1c
push ebp
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
push dword [0x40ffc0]
call esi
cmp dword [esp + 0x18], ebx
jne 0x404d0d
push ebx
lea eax, [esp + 0x14]
push 0x4090dc
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x404d0d
mov dword [0x40ffd8], 0xfde9
sub edi, ebx
jmp 0x404d1c
push ebp
push ebp
push ebp
push dword [0x40ffc0]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebp
jle 0x404d52
lea eax, [edi + 2]
push eax
push ebp
push dword [0x40fd74]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x40ffd0], eax
cmp eax, ebp
je 0x404ed4
push ebp
lea ecx, [esp + 0x1c]
push ecx
push edi
push eax
push dword [0x40ffc0]
call esi
mov edi, dword [esp + 0x18]
mov eax, dword [0x40ffd0]
cmp eax, ebp
je 0x404ed4
xor ecx, ecx
mov word [eax + edi], cx
mov esi, dword [0x40ffd0]
lea eax, [esi + edi]
mov dword [0x40ffd4], eax
mov edi, 0x40ffdc
mov bl, 0xa
cmp esi, eax
jae 0x404ed4
mov al, byte [esi]
cmp al, 0x20
je 0x404d8c
cmp al, 9
jne 0x404d8f
inc esi
jmp 0x404d82
mov al, byte [esi]
cmp al, 0x3b
jne 0x404dcf
inc esi
cmp byte [esi], 0x20
jne 0x404d9c
inc esi
push esi
push 2
push dword [esp + 0x1c]
push edi
call fcn.00404bf7
add esp, 0x10
mov dword [esp + 0x14], eax
jmp 0x404dc5
mov al, byte [esi]
cmp al, bl
je 0x404e82
cmp al, 0xd
je 0x404e82
inc esi
cmp byte [esi], 0
jne 0x404db2
jmp 0x404e82
cmp al, 0x5b
jne 0x404e19
inc esi
push esi
push 1
push dword [esp + 0x1c]
push edi
call fcn.00404bf7
add esp, 0x10
mov dword [esp + 0x14], eax
jmp 0x404df9
mov al, byte [esi]
cmp al, 0x5d
je 0x404e03
cmp al, bl
je 0x404dfe
cmp al, 0xd
je 0x404dfe
inc esi
cmp byte [esi], 0
jne 0x404dea
cmp byte [esi], 0x5d
jne 0x404e82
mov byte [esi], 0
jmp 0x404e10
cmp al, bl
je 0x404e85
cmp al, 0xd
je 0x404e86
inc esi
mov al, byte [esi]
test al, al
jne 0x404e08
jmp 0x404e86
cmp al, bl
je 0x404e86
cmp al, 0xd
je 0x404e86
mov edx, esi
jmp 0x404e34
cmp al, 0x3d
je 0x404e38
cmp al, 0xd
je 0x404e38
cmp al, bl
je 0x404e38
inc esi
mov al, byte [esi]
test al, al
jne 0x404e25
lea eax, [esi - 1]
jmp 0x404e4a
mov cl, byte [eax]
cmp cl, 0x20
je 0x404e49
cmp cl, 9
jne 0x404e4e
dec eax
cmp eax, edx
ja 0x404e3d
mov byte [eax + 1], 0
inc esi
mov al, byte [esi]
cmp al, 0x20
je 0x404e52
cmp al, 9
je 0x404e52
push esi
push edx
push dword [esp + 0x1c]
push edi
call fcn.00404bf7
add esp, 0x10
mov dword [esp + 0x14], eax
jmp 0x404e7d
mov al, byte [esi]
cmp al, bl
je 0x404e82
cmp al, 0xd
je 0x404e82
inc esi
cmp byte [esi], 0
jne 0x404e72
mov byte [esi], 0
inc esi
mov al, byte [esi]
cmp al, bl
je 0x404e85
cmp al, 0xd
je 0x404e85
cmp esi, dword [0x40ffd4]
jb 0x404d82
jmp 0x404ed4
xor esi, esi
push ebx
mov dword [0x40ffc0], esi
mov dword [0x40ffd8], esi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
push dword [0x40fd74]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x40ffc4], eax
cmp eax, esi
je 0x404ed4
push ebx
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [0x40ffc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4