Function at 0x422b09
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x422b1a
push eax
pop eax
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ecx
mov ecx, 0x395e
pop ecx
push ebx
push ecx
sub esp, 0x168
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x114], 0x6583c0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x12c]
mov dword [esp], eax
mov dword [ebp - 0x110], 0x65bae4
mov dword [ebp - 0x10c], ebp
mov dword [ebp - 0x108], 0x4234a5
mov dword [ebp - 0x104], esp
call fcn.005687c0
mov eax, 0xe873971
mov edx, 0x82f0f00d
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x78], eax
mov eax, 0x2ab870f0
push ecx
mov ecx, 0x5595
mov ecx, 0x16b9
mov ecx, 0x1d16
mov ecx, 0x3149
pop ecx
mov dword [ebp - 0x74], edx
mov edx, 0x7e6e1632
mov dword [ebp - 0x70], eax
mov eax, 0xb6649a3c
mov dword [ebp - 0x6c], edx
mov edx, 0xc3bca05c
mov dword [ebp - 0x68], eax
mov eax, 0x5de36181
mov dword [ebp - 0x64], edx
mov edx, 0xf7f20dec
mov dword [ebp - 0x60], eax
mov eax, 0xef7392d
jmp 0x422bec
mov dword [ebp - 0x5c], edx
mov edx, 0x829ff07f
mov dword [ebp - 0x58], eax
mov eax, 0x2ad17096
mov dword [ebp - 0x54], edx
mov edx, 0x7e0b165e
mov dword [ebp - 0x50], eax
mov eax, 0xb64a9a4f
mov dword [ebp - 0x4c], edx
mov edx, 0xc3d2a035
movaps xmm0, xmmword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov eax, 0x5de361e8
xorps xmm0, xmmword [ebp - 0x78]
mov dword [ebp - 0x44], edx
jmp 0x422c42
mov edx, 0xf7f20dec
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x78]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
movaps xmmword [ebp - 0x78], xmm0
movaps xmm0, xmmword [ebp - 0x48]
xorps xmm0, xmmword [ebp - 0x68]
movaps xmmword [ebp - 0x68], xmm0
call fcn.00653f30
push eax
mov eax, 0x4015
mov eax, 0x7e1b
mov eax, 0x61ed
mov eax, 0x716
pop eax
push edx
mov edx, 0x4cb3
mov edx, 0x12b3
pop edx
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
mov dword [ebp - 0x128], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x138], eax
call fcn.0062fa00
mov edi, dword [ebp - 0x130]
xor eax, eax
mov ecx, 3
push edx
mov edx, 0x63b2
mov edx, 0x16bb
mov edx, 0x161c
mov edx, 0x4823
pop edx
cmp dword [ebp - 0x138], 0xffffffff
rep stosd dword es:[edi], eax
je 0x4237a2
mov eax, dword [ebp - 0x138]
mov dword [esp + 4], 0
mov dword [ebp - 0x128], 2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edx
push edx
mov dword [ebp - 0x13c], eax
mov dword [esp], eax
call fcn.006572d0
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0xf0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
push eax
mov eax, 0x66c6
pop eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x138]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x422dbd
mov eax, dword [ebp - 0x144]
push eax
mov eax, 0x45ad
mov eax, 0x204e
pop eax
mov dword [esp], eax
call fcn.006572a0
jmp 0x4237a2
mov dword [ebp - 0x128], 2
mov eax, dword [ebp - 0x138]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x44]
push edi
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x58], 0
push edx
mov edx, 0x3f4e
mov edx, 0x7ddc
pop edx
mov dword [esp], eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x1000000
mov word [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x128], 4
call fcn.0040665a
mov eax, dword [ebp - 0x78]
push esi
mov dword [ebp - 0x140], eax
test eax, eax
jmp 0x422e76
je 0x4230ad
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x138], eax
cmp eax, 2
jbe 0x423796
mov eax, dword [ebp - 0x140]
mov dword [esp + 8], 3
mov dword [esp + 4], 0x66347c
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x422ed1
add dword [ebp - 0x140], 3
sub dword [ebp - 0x138], 3
cmp dword [ebp - 0x58], 0
jne 0x423796
mov byte [ebp - 0x24], 1
jmp 0x423796
cmp dword [ebp - 0x138], 0xffffffff
je 0x4230ad
mov eax, dword [ebp - 0x138]
mov dword [esp + 4], 0x676018
inc eax
push ecx
pop ecx
mov dword [esp], eax
mov dword [ebp - 0x148], eax
call fcn.006572e0
mov dword [ebp - 0x13c], eax
test eax, eax
je 0x4230ad
mov edi, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x148]
xor eax, eax
mov esi, dword [ebp - 0x140]
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
mov edi, dword [ebp - 0x13c]
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xe0], 0x67ba84
test eax, eax
mov dword [ebp - 0x138], eax
setne al
setne byte [ebp - 0x140]
cmp dword [ebp - 0x50], 0
mov dword [ebp - 0xc8], 0
movzx eax, al
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x158], eax
jne 0x422fe5
mov dword [esp], 0
lea edx, [ebp - 0x50]
lea eax, [ebp - 0xec]
mov dword [ebp - 0x128], 3
jmp 0x422fbc
call fcn.0040426e
cmp byte [ebp - 0x140], 0
je 0x422fe5
test al, al
je 0x422fe5
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x58]
mov dword [esp], eax
call fcn.0058576c
push ebx
test eax, eax
js 0x4230ad
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x128], 3
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xb0]
mov dword [esp + 0xc], eax
jmp 0x42300d
lea eax, [ebp - 0xc8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xe0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xec]
mov dword [esp], eax
call fcn.0058f330
sub esp, 0x14
test al, al
je 0x423088
mov eax, dword [ebp - 0x158]
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x58]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x98]
push ecx
pop ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp + 8], eax
jmp 0x423068
mov eax, dword [ebp - 0xc8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
call 0x585b10
sub esp, 0x18
jmp 0x422fdd
cmp dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x13c]
je 0x4230a1
mov dword [esp], eax
call fcn.006572a0
jmp 0x4230ad
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x54], eax
jmp 0x4230be
lea ecx, [ebp - 0x78]
call fcn.0062a010
jmp 0x4230d7
lea eax, [ebp - 0xec]
mov dword [ebp - 0xe4], 0
mov ecx, eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xec], eax
call fcn.006284f0
lea eax, [ebp - 0xec]
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x3c]
jmp 0x423134
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x138], eax
je 0x4231ab
mov dword [esp], 0x14
mov dword [ebp - 0x128], 5
call fcn.00657370
mov ecx, eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x18]
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0xec]
mov dword [esp], eax
nop
nop
call fcn.006489e0
mov eax, dword [ebp - 0x138]
inc dword [ebp - 0xe4]
push ecx
mov dword [esp], eax
call fcn.0064ed50
jmp 0x423119
mov eax, dword [ebp - 0xec]
mov edx, 0x82fa9c16
mov dword [ebp - 0x140], eax
mov eax, 0x68984b7d
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], edx
lea eax, [ebp - 0xec]
cmp dword [ebp - 0x140], eax
je 0x42347f
mov eax, dword [ebp - 0x140]
push edx
mov edx, 0x40f7
pop edx
lea ecx, [ebp - 0xe0]
mov eax, dword [eax + 8]
mov dword [ebp - 0x128], 5
mov dword [esp], eax
call fcn.0040665a
mov edx, dword [ebp - 0x154]
push eax
jmp 0x42321f
jmp 0x42323a
jmp 0x423255
jmp 0x423266
jmp 0x423281
lea ecx, [ebp - 0xe0]
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x94], edx
mov edx, 0x7e0b165e
mov dword [ebp - 0x98], eax
mov eax, 0x2ad17096
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], edx
movaps xmm0, xmmword [ebp - 0x98]
mov dword [ebp - 0x138], eax
mov eax, 0xef7392d
mov dword [ebp - 0x134], edx
mov edx, 0x829ff07f
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x74], edx
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x98]
mov dword [esp], eax
mov dword [ebp - 0x6c], edx
xorps xmm0, xmmword [ebp - 0x78]
movaps xmmword [ebp - 0x98], xmm0
call fcn.0059f2e0
push edx
test al, al
je 0x423461
mov eax, 0x6683587d
mov edx, 0x829ff07f
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x94], edx
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x8c], edx
movaps xmm0, xmmword [ebp - 0x98]
xorps xmm0, xmmword [ebp - 0x78]
mov dword [ebp - 0x148], eax
movaps xmmword [ebp - 0x98], xmm0
test eax, eax
je 0x423461
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x13c], 0
je 0x4233ba
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x148]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x128], 6
nop
call fcn.00404192
mov ebx, dword [ebp - 0x13c]
test al, al
mov eax, dword [ebp - 0x138]
mov edx, dword [ebx + 0xc]
cmove eax, ebx
cmove edx, dword [ebx + 8]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], edx
jmp 0x42336c
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x138], eax
je 0x423461
mov eax, dword [ebp - 0x138]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x128], 6
call fcn.00404192
test al, al
je 0x423552
jmp 0x423461
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x98]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x128], 6
call fcn.00404192
mov ebx, dword [ebp - 0x138]
test al, al
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebx + 0xc]
cmove eax, ebx
push edx
mov edx, 0x16a
mov edx, 0x6e8f
pop edx
cmove edx, dword [ebx + 8]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], edx
cmp dword [ebp - 0x138], 0
jne 0x4233f1
jmp 0x42344f
mov edi, dword [ebp - 0x13c]
cmp dword [ebp - 0x148], edi
jne 0x42359c
lea ecx, [ebp - 0xe0]
call fcn.0062a010
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
mov dword [ebp - 0x140], eax
jmp 0x4231cd
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call fcn.006572a0
mov ecx, dword [ebp - 0x140]
call fcn.006284f0
lea ecx, [ebp - 0x58]
call fcn.005862e8
jmp 0x4237a2
mov eax, dword [ebp - 0x138]
add eax, 0x20
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x138]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x13c], eax
jmp 0x423597
jmp 0x42343f
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x128], 6
call fcn.00404192
test al, al
jne 0x423461
mov eax, dword [ebp - 0x13c]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x423461
mov dword [esp], eax
lea ecx, [ebp - 0xc8]
jmp 0x4235e7
push edx
pop edx
mov dword [ebp - 0x128], 6
call fcn.0040665a
mov eax, dword [ebp - 0xc8]
mov edx, dword [ebp - 0xc4]
push edi
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x128], 9
add edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00405df4
push esi
mov ebx, dword [ebp - 0x14c]
lea eax, [ebp - 0x98]
push esi
mov dword [ebp - 0x128], 7
mov dword [esp + 8], 0x663232
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00653f30
mov edx, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x74]
mov ecx, 7
lea esi, [ebp - 0x90]
mov eax, dword [ebp - 0x98]
jmp 0x423677
add ebx, edx
cmp eax, esi
je 0x423683
mov ecx, dword [ebp - 0x90]
cmp ebx, ecx
jbe 0x4236d1
lea esi, [ebp - 0x70]
mov ecx, 7
cmp dword [ebp - 0x78], esi
je 0x423698
nop
mov ecx, dword [ebp - 0x70]
cmp ebx, ecx
ja 0x4236d1
mov dword [esp + 0xc], edx
lea ecx, [ebp - 0x78]
push eax
mov eax, 0x675f
pop eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x128], 8
call fcn.00632710
sub esp, 0x10
jmp 0x4236fe
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x128], 8
mov dword [esp], eax
call fcn.006312b0
jmp 0x4236fd
push ebx
mov dword [esp], eax
lea ecx, [ebp - 0xb0]
call fcn.00634090
push ecx
lea ecx, [ebp - 0x98]
call fcn.0062fa00
lea ecx, [ebp - 0x78]
call fcn.0062fa00
cmp dword [ebp - 0xac], 0
je 0x42377b
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
lea eax, [ebp - 0xb0]
je 0x42375c
mov dword [esp], eax
mov dword [ebp - 0x128], 0xa
call fcn.00634394
mov eax, dword [ebp - 0x130]
push edx
add dword [eax + 4], 0x18
jmp 0x42377b
nop
mov dword [esp], ecx
mov ecx, dword [ebp - 0x130]
mov dword [esp + 4], eax
mov dword [ebp - 0x128], 0xa
call 0x6274a8
push eax
push eax
lea ecx, [ebp - 0xb0]
call fcn.0062fa00
lea ecx, [ebp - 0xc8]
call fcn.0062a010
jmp 0x423461
cmp dword [ebp - 0x138], 0
jmp 0x422ed8
lea eax, [ebp - 0x12c]
mov dword [esp], eax
call fcn.00568a90
mov eax, dword [ebp - 0x130]
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret