Function at 0x402310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push 0x448940
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
push 2
push 0
push 0xffffffffffffffec
push esi
call edi
cmp eax, 0xffffffff
jne 0x40236d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 4]
push 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 4
jb 0x4027f4
mov ecx, dword [ebp - 8]
mov edx, ecx
and edx, 0xff00
mov eax, ecx
shl eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff0000
shr ecx, 0x10
or eax, ecx
shl edx, 8
shr eax, 8
or edx, eax
cmp edx, 0x38424452
jne 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 4
jb 0x4027f4
mov ecx, dword [ebp - 0x14]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
cmp edx, 5
jne 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 4
jb 0x4027f4
mov ecx, dword [ebp - 0xc]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
push 0
shl eax, 8
or edx, eax
push 0
push edx
push esi
mov dword [ebp - 0xc], edx
call edi
cmp eax, 0xffffffff
je 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 4
jb 0x4027f4
mov ecx, dword [ebp - 8]
mov edx, ecx
and edx, 0xff00
mov eax, ecx
shl eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff0000
shr ecx, 0x10
or eax, ecx
shl edx, 8
shr eax, 8
or edx, eax
cmp edx, 0x38424452
jne 0x4027f4
lea eax, [ebp - 0x18]
push eax
push section..data
push esi
call fcn.00402810
push 0x449144
push 0x449140
push esi
call fcn.00402810
add esp, 0x18
lea eax, [ebp - 4]
push 0
push eax
push 1
push 0x44914d
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x449151
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x44914f
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x449150
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x44914e
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x449154
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
mov ecx, dword [0x449154]
mov edx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov eax, ecx
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
movzx eax, byte [0x449157]
and ecx, 0xff00
shl edx, 8
or ecx, eax
or edx, ecx
mov dword [0x449154], edx
cmp edx, 3
jne 0x402750
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
mov ecx, dword [ebp - 0x10]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
push edx
push 0x40
mov dword [ebp - 0x10], edx
call edi
mov dword [0x449158], eax
test eax, eax
je 0x4027fb
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
mov edi, 0x449160
push 0
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
call ebx
test eax, eax
je 0x4027f4
mov eax, dword [edi]
bswap eax
mov dword [edi], eax
add edi, 4
cmp edi, 0x449178
jl 0x402673
mov edi, 0x449178
nop dword [eax]
lea eax, [ebp - 4]
push eax
push edi
push esi
call fcn.00402810
add edi, 4
add esp, 0xc
cmp edi, 0x449190
jl 0x4026a0
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x449190
push esi
call ebx
test eax, eax
je 0x4027f4
mov ecx, dword [0x449190]
mov edx, ecx
mov eax, ecx
shl edx, 0x10
and eax, 0xff00
shr ecx, 8
or edx, eax
and ecx, 0xff00
movzx eax, byte [0x449193]
push 0
or ecx, eax
shl edx, 8
lea eax, [ebp - 4]
or edx, ecx
push eax
push 1
push 0x449152
push esi
mov dword [0x449190], edx
call ebx
test eax, eax
je 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x449153
push esi
call ebx
test eax, eax
je 0x4027f4
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x449194
push esi
call ebx
test eax, eax
je 0x4027f4
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0x44914c
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
cmp byte [0x44914c], 0
je 0x4027e2
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
mov ecx, dword [ebp - 0x10]
mov edx, ecx
mov eax, ecx
and edx, 0xff0000
shr eax, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff00
shl ecx, 0x10
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
push edx
push 0x40
mov dword [ebp - 0x10], edx
call edi
mov dword [0x44915c], eax
test eax, eax
je 0x4027fb
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push eax
push esi
call ebx
test eax, eax
je 0x4027f4
cmp dword [ebp - 4], 1
jb 0x4027f4
lea eax, [ebp - 0x18]
push eax
push 0x449148
push esi
call fcn.00402810
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret