Function at 0x423814
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
or esi, 0xffffffff
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x467ff0]
push esi
push ebx
mov dword [ebp - 8], ecx
call fcn.00401592
mov ecx, dword [0x465b20]
push 1
push ebx
push esi
push 0x459f14
call fcn.00401592
mov edi, dword [ebp + 8]
mov byte [ebp - 1], bl
mov byte [ebp - 0xc], bl
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
jmp 0x4238ce
inc esi
movsx eax, byte [esi]
push eax
call fcn.00441c9f
cmp eax, 0x43
pop ecx
je 0x4238bc
cmp eax, 0x4d
je 0x42387d
cmp eax, 0x54
jne 0x4238c0
mov byte [ebp - 1], 1
jmp 0x4238c0
lea eax, [esi + 1]
push eax
call fcn.00401058
cmp edx, ebx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
ja 0x423a5b
jb 0x4238a2
cmp eax, 0x40000000
ja 0x423a5b
push 0x459be0
push esi
call fcn.00438f35
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x423a5b
dec esi
jmp 0x4238c0
mov byte [ebp - 0xc], 1
cmp byte [esi], bl
mov edi, esi
je 0x4238ce
lea edi, [esi + 1]
cmp byte [edi], bl
je 0x4238ce
inc edi
push edi
call fcn.00401a22
mov esi, eax
cmp byte [esi], 0x2a
pop ecx
je 0x42385d
push ebx
push 0x8000000
push 3
push ebx
push 3
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [ebp + 8], edx
je 0x423a5b
cmp byte [ebp - 0xc], bl
je 0x423929
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0xf]
cmp cl, bl
jne 0x423916
mov eax, dword [eax + 4]
mov cl, byte [eax + 0xf]
cmp cl, 2
jne 0x423929
mov ecx, dword [ebp - 0x14]
push edx
call fcn.00442674
jmp 0x423a5e
push edx
call fcn.00437ecc
mov edi, eax
and eax, edx
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 0x14], edx
je 0x423a53
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
and ecx, eax
cmp ecx, 0xffffffff
jne 0x423963
cmp edx, ebx
ja 0x423a53
jb 0x423963
cmp edi, 0x40000000
ja 0x423a53
cmp eax, edx
ja 0x423974
jb 0x42396e
cmp dword [ebp - 0x20], edi
jae 0x423974
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x465b20]
xor esi, esi
inc esi
push esi
push ebx
push 0xffffffffffffffff
push 0x45871c
call fcn.00401592
mov eax, edi
or eax, dword [ebp - 0x14]
jne 0x423996
mov ebx, esi
jmp 0x4239a6
mov ecx, dword [ebp - 8]
push ebx
push esi
push edi
push ebx
call fcn.00401592
cmp eax, esi
je 0x4239b6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x423a5e
mov ecx, dword [ebp - 8]
call fcn.00401d39
push ebx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x423a25
cmp byte [ebp - 1], bl
mov eax, dword [ebp - 0x10]
mov byte [eax + esi], bl
je 0x423a05
push ebx
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push 0x45d4b8
push 0x45c9f4
push esi
call fcn.0041a645
add esp, 0x20
cmp byte [ebp - 0xc], bl
je 0x423a10
mov esi, dword [ebp - 0x10]
dec esi
jmp 0x423a19
push esi
call fcn.00455c50
pop ecx
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.00401d1e
mov dword [eax], esi
jmp 0x423a46
mov ecx, dword [ebp - 8]
mov byte [esi], bl
call fcn.00401d1e
push 1
push ebx
push 0xffffffffffffffff
mov dword [eax], ebx
mov ecx, dword [0x465b20]
push 0x459f14
call fcn.00401592
push dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.0041c5b7
jmp 0x423a5e
xor ebx, ebx
inc ebx
jmp 0x4239a6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4