Function at 0x403900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497f76
mov eax, dword fs:[0]
push eax
sub esp, 0x8d4
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, edx
lea ecx, [ebp - 0x8c8]
mov dword [ebp - 0x8bc], edi
mov dword [ebp - 0x8cc], 1
call fcn.0040b370
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x8c0], eax
test esi, esi
je 0x403dda
test edi, edi
je 0x403dda
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea edi, [eax + 6]
lea esp, [esp]
push 0x20
push 0x4b15ec
push esi
call fcn.004754fb
add esp, 0xc
mov dword [ebp - 0x8d0], eax
test eax, eax
jne 0x403a15
lea eax, [ebp - 0x8d4]
push eax
call fcn.0047a3a9
mov eax, dword [ebp - 0x8d4]
add esp, 4
cmp eax, 0xd
jne 0x4039c2
push 0x3e8
call ebx
dec edi
test edi, edi
jg 0x403980
jmp 0x4039c8
mov dword [ebp - 0x8c0], eax
test edi, edi
jne 0x4039d6
mov dword [ebp - 0x8c0], 0x64
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x8c8], 0
je 0x403a0a
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403a0a
mov ecx, dword [ebp - 0x8c4]
push ecx
call eax
mov eax, dword [ebp - 0x8c0]
jmp 0x403e0f
push 0x103
lea edx, [ebp - 0x13f]
push 0
push edx
mov byte [ebp - 0x140], 0
call fcn.00472990
add esp, 0xc
lea eax, [ebp - 0x140]
call fcn.00402800
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x8b8]
push ecx
call fcn.00469520
lea edx, [ebp - 0x480]
push edx
call fcn.00470390
mov eax, dword [ebp - 0x8bc]
add esp, 0xc
call fcn.00404880
push 0x230
lea eax, [ebp - 0x398]
push 0
push eax
call fcn.00472990
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov byte [ebp - 4], 2
lea esp, [esp]
mov ecx, dword [ebp - 0x8d0]
push ecx
push 1
lea edx, [ebp - 0x398]
push 0x230
push edx
call fcn.0047a301
add esp, 0x10
test eax, eax
je 0x403d84
push 0x230
lea eax, [ebp - 0x398]
mov ecx, 0x8c
lea esi, [ebp - 0x398]
lea edi, [ebp - 0x6b0]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x8b8]
push edx
call fcn.00469660
mov eax, dword [ebp - 0x398]
add esp, 0x10
cmp eax, 0x53595348
je 0x403c7c
cmp eax, 0x4d414749
je 0x403c7c
cmp eax, 0x5453464c
je 0x403c7c
cmp eax, 0x54535053
je 0x403c7c
cmp eax, 0x54535750
je 0x403c7c
cmp eax, 0x5054464c
je 0x403c7c
cmp eax, 0x50544452
je 0x403c7c
cmp eax, 0x50544547
je 0x403c7c
cmp eax, 0x50545053
je 0x403c7c
cmp eax, 0x41555550
je 0x403c7c
cmp eax, 0x4953504b
je 0x403c7c
cmp eax, 0x41434345
je 0x403c7c
cmp eax, 0x50544553
je 0x403c7c
cmp eax, 0x50534143
je 0x403c7c
cmp eax, 0x50534153
je 0x403c7c
cmp eax, 0x50544558
je 0x403c7c
cmp eax, 0x45585445
je 0x403c7c
cmp eax, 0x5054464f
je 0x403c7c
cmp eax, 0x464f4558
je 0x403c7c
cmp eax, 0x50534558
je 0x403c7c
cmp eax, 0x56495255
je 0x403c7c
cmp eax, 0x4348454b
jne 0x403c67
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x480]
push ecx
call fcn.00470e00
add esp, 8
mov eax, 0x20
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x194]
nop
cmp eax, 4
jb 0x403d84
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x403c1a
sub eax, 4
add ecx, 4
add edx, 4
jmp 0x403c00
movzx esi, byte [ecx]
movzx eax, byte [edx]
sub eax, esi
jne 0x403c46
movzx eax, byte [edx + 1]
movzx esi, byte [ecx + 1]
sub eax, esi
jne 0x403c46
movzx eax, byte [edx + 2]
movzx esi, byte [ecx + 2]
sub eax, esi
jne 0x403c46
movzx eax, byte [edx + 3]
movzx edx, byte [ecx + 3]
sub eax, edx
sar eax, 0x1f
or eax, 1
je 0x403d84
lea esi, [ebp - 0x168]
mov edi, 0x66
call fcn.00402750
jmp 0x403d93
lea esi, [ebp - 0x168]
mov edi, 0x67
call fcn.00402750
jmp 0x403d93
push 0x230
lea eax, [ebp - 0x6b0]
push eax
lea ecx, [ebp - 0x480]
push ecx
call fcn.00470d50
lea eax, [ebp - 0x394]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403ca0
sub eax, edx
inc eax
push eax
call fcn.0047159e
mov edx, eax
add esp, 4
mov dword [ebp - 0x164], edx
lea ecx, [ebp - 0x394]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x403cc1
cmp dword [ebp - 0x8cc], 0
mov edx, dword [ebp - 0x398]
mov ecx, 8
lea esi, [ebp - 0x194]
lea edi, [ebp - 0x160]
lea eax, [ebp - 0x168]
mov dword [ebp - 0x168], edx
rep movsd dword es:[edi], dword [esi]
push eax
jne 0x403d2b
mov ebx, dword [ebp - 0x8bc]
mov esi, dword [ebx + 0x14]
mov ecx, dword [esi + 4]
push ecx
push esi
call fcn.00405760
mov ecx, ebx
mov edi, eax
call fcn.004057a0
mov dword [esi + 4], edi
mov edx, dword [edi + 4]
xor ebx, ebx
mov dword [edx], edi
mov dword [ebp - 0x164], ebx
jmp 0x403a90
mov edx, dword [ebp - 0x8bc]
lea ecx, [ebp - 0x8e0]
push ecx
push edx
call fcn.00404770
xor ebx, ebx
mov dword [ebp - 0x164], ebx
jmp 0x403a90
xor edi, edi
test ebx, ebx
je 0x403d93
push ebx
call fcn.0047311d
add esp, 4
mov eax, dword [ebp - 0x8d0]
push eax
call fcn.00474bde
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x8c8], 0
je 0x403dd6
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403dd6
mov ecx, dword [ebp - 0x8c4]
push ecx
call eax
mov eax, edi
jmp 0x403e0f
mov dword [ebp - 4], eax
cmp dword [ebp - 0x8c8], 0
je 0x403e0a
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403e0a
mov edx, dword [ebp - 0x8c4]
push edx
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret