Function at 0x446aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [0x4ddf18]
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov dword [esp + 0x1c], ecx
mov ecx, ebx
push 0
mov dword [esp + 0x3c], ebx
call fcn.0047b2f0
mov edi, dword [ebp + 8]
or eax, 0xffffffff
mov dword [esp + 0x14], eax
or edx, 0xffffffff
mov eax, dword [0x4d89c0]
mov byte [esp + 0xe], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x24], edx
mov esi, dword [eax + 0xfc]
and esi, 0x7fffffff
mov dword [esp + 0x28], esi
nop dword [eax]
mov eax, edi
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x446b0f
cmp ecx, 9
jne 0x446b14
add eax, 2
jmp 0x446b02
cmp word [eax], 0x2a
jne 0x446c2b
movzx esi, word [eax + 2]
lea edi, [eax + 2]
test esi, 0xffffff80
jne 0x446b3f
push 2
push esi
call fcn.00498ea3
add esp, 8
test eax, eax
je 0x446b3f
and esi, 0xffffffdf
movzx eax, si
add eax, 0xffffffbd
cmp eax, 0x11
ja case.0x446b51.68
movzx eax, byte [eax + 0x447000]
jmp dword [eax*4 + 0x446fec]
mov byte [esp + 0x18], 1
jmp case.0x446b51.68
lea esi, [edi + 2]
mov ecx, esi
call fcn.00403e00
test al, al
mov edx, 0xa
mov eax, 0x10
cmovne edx, eax
push edx
push 0
push esi
call fcn.00495ba9
add esp, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
mov edx, 0x4c89b4
mov ecx, edi
call fcn.004053e1
mov edi, eax
test edi, edi
je 0x446bd9
sub edi, 2
jmp case.0x446b51.68
lea eax, [edi + 2]
push eax
call fcn.00495cca
add esp, 4
mov dword [esp + 0x28], eax
jmp 0x446b8c
mov byte [esp + 0xe], 1
cmp word [edi], 0
je 0x446b00
add edi, 2
cmp word [edi], 0
je 0x446b00
add edi, 2
jmp 0x446b00
mov eax, dword [0x4d89c0]
mov dword [eax + 0x30], 0x57
test byte [eax + 0x100], 1
jne 0x446c0d
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4c8740
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
push 0x4c602c
push 0
push 0x4c8740
call fcn.00434ec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x8000000
push 3
push 0
push 3
push closesocket
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, 0xffffffff
jne 0x446c67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4d89c0]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jmp 0x446bec
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0
push eax
push edi
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [esp + 0x30], esi
cmp esi, 0xffffffff
jne 0x446c9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x446ca9
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov eax, esi
and eax, ecx
cmp eax, 0xffffffff
jne 0x446cca
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ecx, dword [0x4d89c0]
push edi
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4d89c0]
jmp 0x446be5
mov edx, dword [esp + 0x24]
cmp ecx, edx
jb 0x446ce0
mov eax, dword [esp + 0x14]
ja 0x446cdc
cmp esi, eax
jbe 0x446ce0
mov esi, eax
mov ecx, edx
test ecx, ecx
jne 0x446fcc
cmp esi, 0xfffffffd
ja 0x446fcc
mov eax, esi
or eax, ecx
jne 0x446d29
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4d89c0]
mov dword [eax + 0x30], 0
mov ecx, dword [0x4db768]
push 1
push 0
push 0xffffffffffffffff
push 0x4b41e8
call fcn.0047b2f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0x18], 0
je 0x446df3
mov al, byte [ebx + 0x17]
test al, al
jne 0x446d41
mov eax, dword [ebx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
je 0x446df3
push 0
mov ecx, esi
mov byte [esp + 0x13], 1
shr ecx, 1
mov eax, esi
and eax, 1
push 1
add ecx, eax
push ecx
push 0
mov ecx, ebx
call fcn.0047b2f0
cmp eax, 1
jne 0x446e26
push 0
push eax
mov ecx, ebx
call fcn.00401490
mov edi, eax
test edi, edi
je 0x446e22
push 0
lea eax, [esp + 0x24]
push eax
push esi
mov esi, dword [esp + 0x28]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ecx, dword [0x4d89c0]
push esi
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x446f78
cmp byte [esp + 0x18], 0
jne 0x446f13
mov eax, dword [esp + 0x20]
cmp eax, 3
jb 0x446e38
cmp byte [edi], 0xef
jne 0x446e38
cmp byte [edi + 1], 0xbb
jne 0x446e38
cmp byte [edi + 2], 0xbf
jne 0x446e38
add eax, 0xfffffffd
push 0xfde9
push eax
lea eax, [edi + 3]
push eax
jmp 0x446e5f
lea eax, [esi + 2]
mov byte [esp + 0xf], 0
push eax
call fcn.00495d48
mov edi, eax
add esp, 4
test edi, edi
jne 0x446d84
mov ecx, dword [esp + 0x10]
push 0x4c602c
push eax
push str.Out_of_memory.
call fcn.004351a0
mov edi, dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jb 0x446e50
cmp byte [edi], 0xff
jne 0x446e50
cmp byte [edi + 1], 0xfe
jne 0x446e50
lea ecx, [edi + 2]
add eax, 0xfffffffe
jmp 0x446e72
mov ecx, dword [esp + 0x28]
cmp ecx, 0x4b0
je 0x446e70
push ecx
push eax
push edi
mov ecx, ebx
call fcn.0047bea0
test eax, eax
jne 0x446e8b
mov dword [esp + 0x14], eax
jmp 0x446e8b
mov ecx, edi
push 0
push 1
shr eax, 1
push eax
push ecx
mov ecx, ebx
call fcn.0047b2f0
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x14], eax
test edi, edi
je 0x446e98
push edi
call fcn.00495d53
add esp, 4
push 0
push 1
mov ecx, ebx
call fcn.00401490
cmp byte [esp + 0xe], 0
mov edi, eax
je 0x446f9a
cmp byte [ebx + 0x17], 0
jne 0x446ebb
mov esi, dword [ebx + 0xc]
jmp 0x446ebd
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x446ed5
test byte [esi + 0x15], 8
je 0x446ed0
mov ecx, esi
call fcn.004013b0
lea eax, [esi + 0xc]
jmp 0x446eda
mov eax, 0x4db430
mov eax, dword [eax]
mov edx, 0x4d0128
shr eax, 1
mov ecx, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push 0x4d0b8c
call fcn.00478ae0
add esp, 0x18
mov ecx, ebx
push dword [esp + 0x28]
call fcn.00418280
jmp 0x446f9a
mov al, byte [ebx + 0x17]
test al, al
jne 0x446f20
mov eax, dword [ebx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
jne 0x446f53
mov edx, dword [esp + 0x20]
mov ecx, edi
call fcn.0047b120
push edi
lea esi, [eax - 1]
neg esi
sbb esi, esi
call fcn.00495d53
add esp, 4
add esi, 1
jne 0x446d0a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esp + 0x20]
test bl, 1
je 0x446f61
mov byte [ebx + edi], 0
inc ebx
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov word [ebx + edi], ax
call fcn.00405428
mov dword [eax], ebx
mov ebx, dword [esp + 0x2c]
jmp 0x446f9a
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.00405428
cmp byte [esp + 0xf], 0
mov dword [eax], 0
jne 0x446f9a
push edi
call fcn.00495d53
add esp, 4
push dword [esp + 0x18]
mov ecx, ebx
call fcn.00418380
test eax, eax
je 0x446e2d
mov eax, dword [esp + 0x14]
test eax, eax
mov ecx, dword [esp + 0x10]
sete al
movzx eax, al
push eax
call fcn.00434f60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
push 0x4c602c
push 0
push str.Out_of_memory.
call fcn.004351a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4