Function at 0x461bc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x4fd228]
push ebx
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov dword [esp + 0x24], ecx
mov ecx, eax
push 0
mov dword [esp + 0x20], eax
call fcn.004b55f0
mov esi, dword [ebp + 8]
or eax, 0xffffffff
mov dword [esp + 0x2c], eax
or edx, 0xffffffff
mov eax, dword [0x4f90f4]
mov byte [esp + 0xe], 0
mov byte [esp + 0xd], 0
mov dword [esp + 0x30], edx
mov ebx, dword [eax + 0xfc]
and ebx, 0x7fffffff
mov dword [esp + 0x28], ebx
mov edi, esi
nop word [eax + eax]
movzx eax, word [edi]
cmp eax, 0x20
je 0x461c2d
cmp eax, 9
jne 0x461c32
add edi, 2
jmp 0x461c20
cmp eax, 0x2a
jne 0x461db8
movzx ebx, word [edi + 2]
lea esi, [edi + 2]
test ebx, 0xffffff80
je 0x461c4e
xor ecx, ecx
jmp 0x461c5c
push 2
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
add esp, 8
mov ecx, eax
mov eax, ebx
and eax, 0xffffffdf
test ecx, ecx
cmove eax, ebx
add eax, 0xffffffbd
cmp eax, 0x11
ja case.0x461c79.68
movzx eax, byte [eax + 0x462428]
jmp dword [eax*4 + 0x462414]
mov byte [esp + 0xd], 1
jmp case.0x461c79.68
lea ecx, [edi + 4]
call fcn.00450280
movzx ecx, word [esi]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
test cx, cx
je 0x461ce1
mov edi, ecx
nop dword [eax]
nop dword [eax + eax]
mov ecx, 0x4e6614
mov edx, 0x20
nop word [eax + eax]
cmp di, dx
je 0x461d19
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x461cc0
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x461cb0
mov eax, dword [0x4f90f4]
mov dword [eax + 0x30], 0x57
test byte [eax + 0x100], 1
jne 0x461d9a
mov ecx, dword [0x4fb9e4]
push 1
push 0
push 0xffffffffffffffff
push 0x4e613c
call fcn.004b55f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add esi, 0xfffffffe
jmp case.0x461c79.68
lea eax, [edi + 4]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
movzx ecx, word [esi]
add esp, 4
mov dword [esp + 0x28], eax
test cx, cx
je 0x461ce1
mov edi, ecx
nop dword [eax]
mov eax, 0x4e6614
mov edx, 0x20
nop word [eax + eax]
cmp di, dx
je 0x461d19
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x461d50
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x461d40
jmp 0x461ce1
mov byte [esp + 0xe], 1
cmp word [esi], 0
je 0x461c18
add esi, 2
cmp word [esi], 0
je 0x461c18
add esi, 2
jmp 0x461c18
mov ecx, dword [esp + 0x18]
push 0x4cfc30
push 0
push 0x4e613c
call fcn.0044e0b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x8000000
push 3
push 0
push 3
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x461df3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4f90f4]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jmp 0x461cf4
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 0
push eax
push ebx
mov dword [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x40], esi
cmp esi, 0xffffffff
jne 0x461e2a
call edi
test eax, eax
jne 0x461e37
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov eax, esi
and eax, ecx
cmp eax, 0xffffffff
jne 0x461e53
call edi
mov ecx, dword [0x4f90f4]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f90f4]
jmp 0x461ced
mov edx, dword [esp + 0x30]
cmp ecx, edx
jb 0x461e69
mov eax, dword [esp + 0x2c]
ja 0x461e65
cmp esi, eax
jbe 0x461e69
mov esi, eax
mov ecx, edx
test ecx, ecx
jne 0x4623f6
cmp esi, 0xfffffffd
ja 0x4623f6
mov eax, esi
or eax, ecx
jne 0x461eb2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f90f4]
mov dword [eax + 0x30], 0
mov ecx, dword [0x4fb9e4]
push 1
push 0
push 0xffffffffffffffff
push 0x4cfcf8
call fcn.004b55f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0xd], 0
je 0x461f1d
mov edi, dword [esp + 0x10]
lea eax, [edi + 0x17]
mov dword [esp + 0x14], eax
mov al, byte [eax]
test al, al
jne 0x461ed0
mov eax, dword [edi + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
je 0x461f28
push 0
mov ecx, esi
mov byte [esp + 0x13], 1
shr ecx, 1
mov eax, esi
and eax, 1
push 1
add ecx, eax
push ecx
push 0
mov ecx, edi
call fcn.004b55f0
cmp eax, 1
jne 0x461f19
push 0
push eax
mov ecx, edi
call fcn.00401690
mov edi, eax
test edi, edi
jne 0x461f6e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor edi, edi
jmp 0x461f03
mov eax, dword [esp + 0x10]
add eax, 0x17
mov dword [esp + 0x14], eax
lea eax, [esi + 2]
mov byte [esp + 0xf], 0
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
test edi, edi
jne 0x461f6e
mov ecx, dword [esp + 0x18]
push 0x4cfc30
push edi
push 0x4e3be8
call fcn.0044e550
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [esp + 0x38]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4f90f4]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x46234a
cmp byte [esp + 0xd], 0
jne 0x4622c3
mov ecx, dword [esp + 0x34]
cmp ecx, 3
jb 0x461fe9
cmp byte [edi], 0xef
jne 0x461fe9
cmp byte [edi + 1], 0xbb
jne 0x461fe9
cmp byte [edi + 2], 0xbf
jne 0x461fe9
lea eax, [ecx - 3]
mov ecx, dword [esp + 0x10]
push 0xfde9
push eax
lea eax, [edi + 3]
push eax
call fcn.004b6200
neg eax
sbb eax, eax
and esi, eax
mov dword [esp + 0x2c], esi
jmp 0x462026
cmp ecx, 2
jb 0x46205b
cmp byte [edi], 0xff
jne 0x46205b
cmp byte [edi + 1], 0xfe
jne 0x46205b
mov dl, 1
test dl, dl
lea eax, [ecx - 2]
push 0
cmove eax, ecx
mov ecx, dword [esp + 0x14]
shr eax, 1
test dl, dl
push 1
push eax
lea eax, [edi + 2]
cmove eax, edi
push eax
call fcn.004b55f0
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x2c], eax
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, dword [esp + 0x14]
add esp, 4
mov ecx, edi
push 0
push 1
call fcn.00401690
cmp byte [esp + 0xe], 0
mov ecx, eax
mov dword [esp + 0x24], ecx
je 0x462344
cmp byte [edi + 0x17], 0
jne 0x46207e
mov esi, dword [edi + 0xc]
jmp 0x462080
mov eax, dword [esp + 0x28]
xor dl, dl
cmp eax, 0x4b0
je 0x461ffb
push eax
push ecx
mov ecx, dword [esp + 0x18]
push edi
call fcn.004b6200
test eax, eax
jne 0x462026
mov dword [esp + 0x2c], eax
jmp 0x462026
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x46209c
test byte [esi + 0x15], 8
je 0x462097
mov ecx, esi
call fcn.004014f0
mov ecx, dword [esp + 0x24]
lea edi, [esi + 0xc]
jmp 0x4620a1
mov edi, 0x4ffb08
mov edi, dword [edi]
xor ebx, ebx
or eax, 0xffffffff
shr edi, 1
xor esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ebx
cmp word [ecx], bx
je 0x462279
cmp edi, 0x1388
jb 0x462226
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
push 0x4ee4ec
push ecx
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 8
mov dword [esp + 0x3c], eax
test eax, eax
je 0x46218f
mov edx, dword [esp + 0x20]
sub eax, edx
dec dword [esp + 0x1c]
inc dword [esp + 0x28]
sar eax, 1
mov dword [esp + 0x40], eax
lea ecx, [eax + esi]
mov dword [esp + 0x38], ecx
inc ecx
cmp ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
jb 0x462155
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
sar eax, 1
push eax
mov eax, dword [esp + 0x3c]
inc eax
push eax
push edi
push ecx
or ecx, 0xffffffff
call fcn.004b1bc0
mov dword [esp + 0x40], eax
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 0x18
test eax, eax
je 0x4621cd
mov edx, dword [esp + 0x20]
mov ebx, eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x46216d
add eax, eax
push eax
push edx
lea eax, [ebx + esi*2]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [esp + 0x44]
add esp, 0xc
mov ecx, dword [esp + 0x3c]
mov eax, 0xa
mov word [ebx + esi*2], ax
add ecx, 4
inc esi
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x1c], 0
jne 0x4620d1
jmp 0x462193
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x28], 0
je 0x462279
mov eax, ecx
sub eax, dword [esp + 0x24]
sar eax, 1
sub edi, eax
je 0x4621fe
lea eax, [edi + esi]
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x30]
jb 0x4621e9
lea eax, [eax*2 + 2]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
test eax, eax
jne 0x4621e3
test ebx, ebx
je 0x4621dc
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call eax
add esp, 4
xor esi, esi
jmp 0x46227b
mov ecx, dword [esp + 0x20]
mov ebx, eax
lea eax, [edi + edi]
push eax
push ecx
lea eax, [ebx + esi*2]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [esp + 0x4c]
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2], ax
lea eax, [esi*2 + 2]
push eax
push ebx
push dword [esp + 0x2c]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
push ebx
call eax
add esp, 4
jmp 0x46227b
mov ebx, ecx
nop dword [eax + eax]
push 0x4ee4ec
push ebx
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x462279
mov ecx, esi
lea ebx, [esi + 2]
sub ecx, dword [esp + 0x24]
mov eax, edi
sar ecx, 1
sub eax, ecx
lea eax, [eax*2 - 2]
push eax
lea eax, [esi + 4]
push eax
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, 0xa
dec edi
mov word [esi], ax
sub dword [esp + 0x1c], 1
jne 0x462230
mov esi, edi
mov eax, dword [esp + 0x10]
cmp byte [eax + 0x17], 0
jne 0x46228a
mov edi, dword [eax + 0xc]
jmp 0x46228c
mov edi, eax
cmp byte [edi + 0x17], 1
jne 0x4622b0
test byte [edi + 0x15], 8
je 0x46229f
mov ecx, edi
call fcn.004014f0
mov ebx, dword [esp + 0x14]
lea eax, [esi + esi]
add edi, 0xc
mov dword [edi], eax
jmp 0x462398
mov ebx, dword [esp + 0x14]
lea eax, [esi + esi]
mov edi, 0x4ffb08
mov dword [edi], eax
jmp 0x462398
mov ecx, dword [esp + 0x10]
mov al, byte [ecx + 0x17]
test al, al
jne 0x4622d4
mov eax, dword [ecx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
jne 0x4622fd
mov edx, dword [esp + 0x34]
mov ecx, edi
call fcn.004b5420
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp esi, 1
jne 0x4623c2
jmp 0x461e93
mov ebx, dword [esp + 0x34]
test bl, 1
je 0x46230b
mov byte [edi + ebx], 0
inc ebx
xor eax, eax
mov word [ebx + edi], ax
mov edi, ecx
cmp byte [edi + 0x17], al
jne 0x46231d
mov esi, dword [edi + 0xc]
jmp 0x46231f
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x46233d
test byte [esi + 0x15], 8
je 0x462332
mov ecx, esi
call fcn.004014f0
add esi, 0xc
mov dword [esi], ebx
mov ebx, dword [esp + 0x14]
jmp 0x46239c
mov esi, 0x4ffb08
mov dword [esi], ebx
mov ebx, dword [esp + 0x14]
jmp 0x46239c
mov ebx, dword [esp + 0x14]
xor eax, eax
mov word [edi], ax
cmp byte [ebx], al
jne 0x462360
mov eax, dword [esp + 0x10]
mov esi, dword [eax + 0xc]
jmp 0x462364
mov esi, dword [esp + 0x10]
cmp byte [esi + 0x17], 1
jne 0x46237c
test byte [esi + 0x15], 8
je 0x462377
mov ecx, esi
call fcn.004014f0
add esi, 0xc
jmp 0x462381
mov esi, 0x4ffb08
cmp byte [esp + 0xf], 0
mov dword [esi], 0
jne 0x462398
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov edi, dword [esp + 0x10]
cmp byte [ebx], 0
jne 0x4623a4
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x4623cd
cmp dword [0x4fe6fc], 0
je 0x4623cd
push ecx
mov ecx, 0x4fe6f0
call fcn.00406b50
test eax, eax
jne 0x4623e1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [edi + 0x15]
and al, 0x86
cmp byte [esp + 0xd], 0
mov byte [edi + 0x15], al
je 0x4623e1
or al, 1
mov byte [edi + 0x15], al
cmp dword [esp + 0x2c], 0
jne 0x461e93
mov eax, dword [0x4f90f4]
jmp 0x461ced
mov ecx, dword [esp + 0x18]
push 0x4cfc30
push 0
push 0x4e3be8
call fcn.0044e550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4