Function at 0x402dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x878]
sub esp, 0x878
push 0xffffffffffffffff
push 0x497fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp + 0x874], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x884]
mov edi, dword [ebp + 0x880]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
call fcn.0040b370
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
test edi, edi
je 0x4031fb
test esi, esi
je 0x4031fb
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [eax + 6]
lea esp, [esp]
push 0x20
push 0x4b15ec
push edi
call fcn.004754fb
add esp, 0xc
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x402ebd
lea eax, [ebp - 0x28]
push eax
call fcn.0047a3a9
mov eax, dword [ebp - 0x28]
add esp, 4
cmp eax, 0xd
jne 0x402e79
push 0x3e8
call ebx
dec esi
test esi, esi
jg 0x402e40
jmp 0x402e7c
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x402e87
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], 0
je 0x402eb5
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402eb5
mov ecx, dword [ebp - 0x1c]
push ecx
call eax
mov eax, dword [ebp - 0x14]
jmp 0x40322a
push 0x103
lea edx, [ebp + 0x751]
push 0
push edx
mov byte [ebp + 0x750], 0
call fcn.00472990
lea eax, [ebp + 0x750]
call fcn.00402800
lea eax, [ebp + 0x750]
push eax
lea ecx, [ebp]
push ecx
call fcn.00469520
lea edx, [ebp + 0x438]
push edx
call fcn.00470390
mov ebx, dword [ebp - 0x24]
add esp, 0x18
mov eax, ebx
call fcn.00404620
mov esi, dword [ebp - 0x18]
push 2
push 0
push esi
call fcn.00475476
push esi
call fcn.0047537e
mov ecx, eax
add esp, 0x10
cmp ecx, 0x460
jb 0x4031b8
mov eax, 0xd41d41d5
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
mov edx, eax
imul edx, edx, 0x230
sub ecx, edx
jne 0x4031b8
dec eax
push eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
call fcn.00404570
push 0
push 0
push esi
call fcn.00475476
push 0x230
lea eax, [ebp + 0x520]
push 0
push eax
call fcn.00472990
push esi
push 1
lea ecx, [ebp + 0x520]
push 0x230
push ecx
xor ebx, ebx
call fcn.0047a301
add esp, 0x28
test eax, eax
je 0x40310e
lea ecx, [ecx]
push 0x230
lea edx, [ebp + 0x520]
push edx
mov ecx, 0x8c
lea esi, [ebp + 0x520]
lea edi, [ebp + 0x208]
mov eax, edx
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp]
push ecx
call fcn.00469660
add esp, 0x10
cmp ebx, dword [ebp - 0x14]
je 0x403115
mov eax, dword [ebp + 0x520]
cmp eax, 0x53595348
je 0x403080
cmp eax, 0x4d414749
je 0x403080
cmp eax, 0x5453464c
je 0x403080
cmp eax, 0x54535053
je 0x403080
cmp eax, 0x54535750
je 0x403080
cmp eax, 0x5054464c
je 0x403080
cmp eax, 0x50544452
je 0x403080
cmp eax, 0x50544547
je 0x403080
cmp eax, 0x50545053
je 0x403080
cmp eax, 0x41555550
je 0x403080
cmp eax, 0x4953504b
je 0x403080
cmp eax, 0x41434345
je 0x403080
cmp eax, 0x50544553
je 0x403080
cmp eax, 0x50534143
je 0x403080
cmp eax, 0x50534153
je 0x403080
cmp eax, 0x50544558
je 0x403080
cmp eax, 0x45585445
je 0x403080
cmp eax, 0x5054464f
je 0x403080
cmp eax, 0x464f4558
je 0x403080
cmp eax, 0x50534558
je 0x403080
cmp eax, 0x56495255
jne 0x40319f
push 0x230
lea edx, [ebp + 0x208]
push edx
lea eax, [ebp + 0x438]
push eax
call fcn.00470d50
mov esi, dword [ebp - 0x24]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0xea0ea0eb
imul ecx
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
mov edi, ebx
add ecx, edx
add esp, 0xc
inc ebx
cmp edi, ecx
jb 0x4030c3
call fcn.00475d4f
imul edi, edi, 0x230
add edi, dword [esi + 0xc]
push 0x230
lea edx, [ebp + 0x520]
push 0
mov ecx, 0x8c
lea esi, [ebp + 0x520]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00472990
mov eax, dword [ebp - 0x18]
push eax
push 1
lea ecx, [ebp + 0x520]
push 0x230
push ecx
call fcn.0047a301
add esp, 0x1c
test eax, eax
jne 0x402fa0
xor esi, esi
jmp 0x4031bd
cmp dword [ebp + 0x520], 0x4348454b
jne 0x40319f
lea edx, [ebp + 0x854]
push edx
lea eax, [ebp + 0x438]
push eax
call fcn.00470e00
add esp, 8
mov eax, 0x20
lea ecx, [ebp + 0x854]
lea edx, [ebp + 0x724]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x403160
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x403148
xor esi, esi
jmp 0x4031bd
movzx esi, byte [ecx]
movzx eax, byte [edx]
sub eax, esi
jne 0x40318c
movzx eax, byte [edx + 1]
movzx esi, byte [ecx + 1]
sub eax, esi
jne 0x40318c
movzx eax, byte [edx + 2]
movzx esi, byte [ecx + 2]
sub eax, esi
jne 0x40318c
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
je 0x40310e
mov esi, 0x66
jmp 0x4031bd
mov esi, 0x67
jmp 0x4031bd
mov esi, 0x65
mov edx, dword [ebp - 0x18]
push edx
call fcn.00474bde
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], 0
je 0x4031f7
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4031f7
mov ecx, dword [ebp - 0x1c]
push ecx
call eax
mov eax, esi
jmp 0x40322a
mov dword [ebp - 4], eax
cmp dword [ebp - 0x20], 0
je 0x403225
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403225
mov edx, dword [ebp - 0x1c]
push edx
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x874]
xor ecx, ebp
call fcn.00472a79
add ebp, 0x878
mov esp, ebp
pop ebp
ret 8