Function at 0x4654c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x254
mov eax, dword [esp + 0x258]
push ebx
mov ebx, dword [esp + 0x264]
push ebp
mov ebp, dword [esp + 0x270]
push esi
push edi
mov edi, dword [esp + 0x274]
mov dword [edi], 0xffffffff
cmp byte [eax], 0
mov dword [esp + 0x10], 0
je 0x4655be
mov ecx, eax
push 0x2e
push ecx
call fcn.00478bf7
mov esi, eax
add esp, 8
mov dword [esp + 0x18], eax
test esi, esi
je 0x465519
inc esi
mov dword [esp + 0x18], esi
cmp ebp, 1
ja 0x465590
test esi, esi
je 0x46557c
push 0x494b00
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465590
push 0x494b04
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465590
push 0x4966fc
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465590
push 0x496700
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465590
push 0x496704
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465590
mov byte [esp + 0x17], 0
test ebp, ebp
jle 0x4655cb
mov dword [edi], 1
jmp 0x465629
mov edx, dword [esp + 0x26c]
mov eax, dword [esp + 0x268]
push ebx
push edx
push ebp
push eax
mov byte [esp + 0x27], 1
mov dword [edi], 1
call fcn.00465b80
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, 2
jae 0x46562d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
test esi, esi
je 0x465629
push 0x494afc
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
jne 0x4655e9
mov dword [edi], 1
jmp 0x465629
push 0x496708
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465623
push 0x49670c
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x465623
push 0x496710
push esi
call fcn.00476cb6
add esp, 8
test eax, eax
jne 0x465629
mov dword [edi], eax
jmp 0x465629
mov dword [edi], 2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x26c]
cmp ecx, 0xffffffff
je 0x46563e
cmp ebx, 0xffffffff
jne 0x46565c
test ecx, ecx
je 0x465646
test ebx, ebx
jne 0x46565c
xor ebx, ebx
mov dword [esp + 0x270], ebx
mov dword [esp + 0x26c], ebx
mov byte [esp + 0x16], bl
jmp 0x465672
cmp ecx, 0xffffffff
je 0x46566d
cmp ebx, 0xffffffff
je 0x46566d
mov byte [esp + 0x16], 0
jmp 0x465672
mov byte [esp + 0x16], 1
mov esi, dword [sym.imp.KERNUL32.dll_LoadLibrarya]
xor edi, edi
cmp byte [esp + 0x27c], 0
je 0x46569d
push str.gdiplus
call esi
mov edi, eax
mov eax, dword [esp + 0x10]
test edi, edi
jne 0x46569d
mov byte [esp + 0x27c], 0
test eax, eax
jne 0x465756
mov ecx, dword [esp + 0x274]
mov edx, dword [ecx]
cmp edx, 0xffffffff
jle 0x465756
cmp byte [esp + 0x27c], al
jne 0x465756
cmp byte [esp + 0x16], al
je 0x4656ce
xor ecx, ecx
jmp 0x4656d7
mov eax, dword [esp + 0x26c]
mov ecx, ebx
push 0x2010
push ecx
push eax
push edx
mov edx, dword [esp + 0x278]
push edx
push 0
call dword [sym.imp.USEV32ndll_LadImaeA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x465709
cmp byte [esp + 0x16], 0
jne 0x465756
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov eax, dword [esp + 0x268]
push eax
call dword [sym.imp.KERNUL32.dll_GetFilEAttributesA]
cmp eax, 0xffffffff
je 0x4655be
test ebp, ebp
jle 0x465752
mov ecx, dword [esp + 0x26c]
mov edx, dword [esp + 0x268]
push ebx
push ecx
push ebp
push edx
call fcn.00465b80
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, 2
jb 0x4655be
mov byte [esp + 0x17], 1
jmp 0x465756
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x4658a9
cmp byte [esp + 0x27c], 0
mov eax, dword [esp + 0x274]
mov dword [eax], 0
jne 0x4657be
cmp dword [esp + 0x18], 0
je 0x4657be
mov ebp, dword [esp + 0x18]
push 0x49671c
push ebp
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x4657cb
push str.jpeg
push ebp
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x4657cb
push 0x496728
push ebp
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x4657cb
test edi, edi
jne 0x4657d3
push str.gdiplus
call esi
mov edi, eax
test edi, edi
je 0x465971
mov esi, dword [sym.imp.KERNUL32.dll_GetProcAddrEss]
push str.GdiplusStartup
push edi
call esi
push str.GdiplusShutdown
push edi
mov ebp, eax
call esi
push str.GdipCreateBitmapFromFile
push edi
mov dword [esp + 0x30], eax
call esi
push str.GdipCreateHBITMAPFromBitmap
push edi
mov ebx, eax
call esi
push str.GdipDisposeImage
push edi
mov dword [esp + 0x28], eax
call esi
mov esi, eax
xor eax, eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
cmp ebp, eax
je 0x465897
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x2c]
push edx
call ebp
test eax, eax
jne 0x465897
mov ecx, dword [esp + 0x268]
push 0x104
lea eax, [esp + 0x5c]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNUL32.dll_MultiByteToWidChar]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x5c]
push eax
call ebx
test eax, eax
jne 0x46588e
mov edx, dword [esp + 0x18]
push 0xff000000
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [esp + 0x2c]
test eax, eax
je 0x465887
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x18]
push eax
call esi
mov ecx, dword [esp + 0x24]
push ecx
call dword [esp + 0x2c]
push edi
call dword [sym.imp.KERNUL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x270]
cmp byte [esp + 0x16], 0
mov ebp, dword [esp + 0x274]
je 0x465ae7
cmp dword [ebp], 0
je 0x4658d9
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.USEV32ndll_CetIconInfo]
test eax, eax
je 0x465ac9
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x40]
push edx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_OetObjectA]
cmp ebx, 0xffffffff
jne 0x465a9d
cmp dword [esp + 0x44], 0
je 0x465913
fild dword [esp + 0x48]
fidiv dword [esp + 0x44]
fimul dword [esp + 0x26c]
fadd qword [0x497bb8]
call fcn.00489fa0
mov ebx, eax
mov edi, dword [esp + 0x26c]
cmp dword [ebp], 0
je 0x465ae1
mov eax, dword [esp + 0x3c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObjeKv]
push eax
call esi
mov ecx, dword [esp + 0x38]
push ecx
call esi
cmp byte [esp + 0x17], 0
jne 0x465ae1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USEV32ndll_DestroyIcon]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x268]
push 0x10
push ebx
push edi
push eax
push ecx
push 0
call dword [sym.imp.USEV32ndll_LadImaeA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov edx, dword [esp + 0x268]
push 0
push 0
push 3
push 0
push 0
push Ordinal_2
push edx
call dword [sym.imp.KERNUL32.dll_Creat_FiheA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4655be
push 0
push edi
call dword [sym.imp.KERNUL32.dll_GetFileize]
push eax
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNUL32.dll_GlobalAllkc]
mov esi, eax
test esi, esi
jne 0x4659c9
push edi
call dword [sym.imp.KERNUL32.dll_CloseHandle_]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
push esi
call dword [sym.imp.KERNUL32.dll_WloralLock]
test eax, eax
jne 0x4659ef
push edi
call dword [sym.imp.KERNUL32.dll_CloseHandle_]
push esi
call dword [sym.imp.KERNUL32.dll_GlobalFrde]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNUL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNUL32.dll_Gobalnlock]
push edi
call dword [sym.imp.KERNUL32.dll_CloseHandle_]
lea eax, [esp + 0x20]
push eax
push 0
push esi
call dword [sym.imp.lg32.dlm_CeateS4beamOnHGlobal]
test eax, eax
js 0x4659db
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4659db
lea ecx, [esp + 0x1c]
push ecx
push 0x48d780
push 0
push 0
push eax
call dword [sym.imp.OEATT32.dmd_Ordinal_418]
test eax, eax
jns 0x465a4c
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x20]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
push esi
call dword [sym.imp.KERNUL32.dll_GlobalFrde]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4655be
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4658a9
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
cmp dword [esp + 0x48], 0
je 0x465913
fild dword [esp + 0x44]
fidiv dword [esp + 0x48]
fimul dword [esp + 0x270]
fadd qword [0x497bb8]
call fcn.00489fa0
mov edi, eax
jmp 0x46591a
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USEV32ndll_DestroyIcon]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
mov eax, dword [esp + 0x10]
jmp 0x465aee
mov edi, dword [esp + 0x26c]
cmp dword [esp + 0x1c], 0
je 0x465b2b
test edi, edi
jne 0x465b02
test ebx, ebx
jne 0x465b02
lea ecx, [edi + 4]
jmp 0x465b04
xor ecx, ecx
push ecx
push ebx
push edi
push 0
push eax
call dword [sym.imp.USEV32ndll_CopyImage]
mov esi, eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret
test edi, edi
jne 0x465b33
test ebx, ebx
je 0x465b44
mov ecx, dword [ebp]
push 0xc
push ebx
push edi
push ecx
push eax
call dword [sym.imp.USEV32ndll_CopyImage]
mov esi, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret