Function at 0x42f040
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436f00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebx + 0xa0], edi
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edi
je 0x42f07e
call fcn.0042fa10
mov eax, dword [ebp + 8]
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x42f0a6
push 0x4402c8
push 1
push 0x6d
push 0x440eb8
call fcn.0042d090
add esp, 0x10
mov eax, dword [ebx + 0xc]
push edi
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42f0cd
push 0x441034
push edi
push 0x71
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x42f0f4
push 0x441010
push edi
push 0x73
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
cmp dword [ebp + 0xc], edi
jne 0x42f0fe
mov dword [ebx + 0x20], edi
jmp 0x42f105
mov dword [ebx + 0x20], 1
lea ecx, [ebx + 0x24]
call fcn.0042c580
push 0x10000
call fcn.0042d540
add esp, 4
cmp eax, edi
mov dword [ebx + 0x7c], eax
jne 0x42f136
push 0x440344
push edi
push 0x7b
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x9c], edi
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x88], edi
lea esi, [ebx + 0xe4]
mov dword [ebx + 0x8c], edi
lea edx, [ebp - 0x14]
mov dword [ebx + 0x80], edi
push edi
mov word [esi], di
mov eax, dword [ebx + 0xc]
push edx
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42f197
push 0x440ff4
push edi
push 0x88
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
cmp word [esi], 0x5a4d
je 0x42f1b7
push 0x440fe4
push 1
push 0x89
push 0x440eb8
call fcn.0042d090
add esp, 0x10
mov edx, dword [ebx + 0x20]
xor ecx, ecx
push edx
xor eax, eax
push 0x40
push ecx
push eax
push esi
mov ecx, ebx
call fcn.00431d20
cmp eax, edi
jne 0x42f1d4
call fcn.0042d380
mov eax, dword [ebx + 0x120]
mov edx, dword [ebx + 0x14]
xor ecx, ecx
add eax, 4
cmp ecx, edx
jl 0x42f210
jg 0x42f1ed
cmp eax, dword [ebx + 0x10]
jbe 0x42f210
push 0x440fcc
push 1
push 0x94
push 0x440eb8
mov dword [ebx + 0xa0], 2
call fcn.0042d090
add esp, 0x10
mov eax, dword [ebx + 0x120]
lea ecx, [ebp - 0x18]
cdq
mov edi, eax
mov eax, dword [ebx + 0x20]
mov esi, edx
push eax
push 4
push esi
push edi
push ecx
mov ecx, ebx
call fcn.00431d20
test eax, eax
jne 0x42f237
call fcn.0042d380
mov ecx, dword [ebp - 0x18]
mov eax, ecx
and eax, 0xffff
sub eax, 0x454c
je 0x42f2bd
sub eax, 2
je 0x42f280
sub eax, 2
je 0x42f26a
push 0x440fcc
push 1
mov dword [ebx + 0xa0], 2
push 0xae
jmp 0x42f2d3
cmp ecx, 0x4550
je 0x42f2e0
push 0x440fbc
push 1
push 0xaa
jmp 0x42f2d3
mov dword [ebx + 0xa0], 3
mov edx, dword [ebx + 0x20]
add edi, 2
push edx
adc esi, 0
push 0x40
push esi
lea eax, [ebx + 0xa4]
push edi
push eax
mov ecx, ebx
call fcn.00431d20
test eax, eax
jne 0x42f2af
call fcn.0042d380
push 0x440fa4
push 1
push 0xa2
jmp 0x42f2d3
push 0x440f8c
push 1
mov dword [ebx + 0xa0], 4
push 0xa6
push 0x440eb8
call fcn.0042d090
add esp, 0x10
mov dword [ebx + 0xa0], 6
mov ecx, dword [ebx + 0x20]
add edi, 4
push ecx
adc esi, 0
push 0x14
lea eax, [ebx + 0x124]
push esi
push edi
push eax
mov ecx, ebx
call fcn.00431d20
test eax, eax
jne 0x42f30f
call fcn.0042d380
mov ax, word [ebx + 0x124]
add edi, 0x14
adc esi, 0
cmp ax, 0x14c
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
je 0x42f357
cmp ax, 0x200
je 0x42f357
cmp ax, 0x8664
je 0x42f357
push 0x440f68
push 1
push 0xbc
push 0x440eb8
mov dword [ebx + 0xa0], 5
call fcn.0042d090
add esp, 0x10
mov edx, dword [ebx + 0x20]
lea eax, [ebx + 0x138]
push edx
push 2
push esi
push edi
push eax
mov ecx, ebx
call fcn.00431d20
test eax, eax
jne 0x42f376
call fcn.0042d380
mov ax, word [ebx + 0x138]
cmp ax, 0x10b
jne 0x42f5da
xor eax, eax
mov ax, word [ebx + 0x134]
cmp eax, 0xe0
mov dword [ebp - 0x14], eax
jbe 0x42f3a2
mov eax, 0xe0
mov dword [ebp - 0x14], eax
mov edx, dword [ebx + 0x20]
lea ecx, [ebx + 0x2e4]
push edx
push eax
push esi
push edi
push ecx
mov ecx, ebx
call fcn.00431d20
test eax, eax
jne 0x42f3c0
call fcn.0042d380
lea eax, [ebx + 0x2e4]
mov dword [ebx + 0x250], eax
add eax, 0x60
mov dword [ebx + 0x258], eax
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0x5c]
mov dword [ebx + 0x13c], ecx
mov edx, dword [ebx + 0x250]
mov eax, dword [edx + 0x10]
mov dword [ebx + 0x140], eax
mov ecx, dword [ebx + 0x250]
mov edx, dword [ecx + 0x20]
mov dword [ebx + 0x144], edx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x14c], ecx
mov edx, dword [ebx + 0x250]
mov eax, dword [edx + 0x24]
mov dword [ebx + 0x148], eax
mov ecx, dword [ebx + 0x250]
mov edx, dword [ecx + 4]
mov dword [ebx + 0x150], edx
mov eax, dword [ebx + 0x250]
xor edx, edx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x158], ecx
mov dword [ebx + 0x15c], edx
mov eax, dword [ebx + 0x250]
mov cx, word [eax]
mov word [ebx + 0x160], cx
mov eax, dword [ebx + 0x250]
mov cl, byte [eax + 2]
mov byte [ebx + 0x162], cl
mov eax, dword [ebx + 0x250]
mov cl, byte [eax + 3]
mov byte [ebx + 0x163], cl
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 4]
mov dword [ebx + 0x164], ecx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 8]
mov dword [ebx + 0x168], ecx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0x16c], ecx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x170], ecx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x174], ecx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x178], ecx
mov dword [ebx + 0x17c], edx
mov eax, dword [ebx + 0x250]
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x180], ecx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x184], ecx
mov cx, word [eax + 0x28]
mov word [ebx + 0x188], cx
mov cx, word [eax + 0x2a]
mov word [ebx + 0x18a], cx
mov cx, word [eax + 0x2c]
mov word [ebx + 0x18c], cx
mov cx, word [eax + 0x2e]
mov word [ebx + 0x18e], cx
mov cx, word [eax + 0x30]
mov word [ebx + 0x190], cx
mov cx, word [eax + 0x32]
mov word [ebx + 0x192], cx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x194], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x198], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x19c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x1a0], ecx
mov cx, word [eax + 0x44]
mov word [ebx + 0x1a4], cx
mov cx, word [eax + 0x46]
mov word [ebx + 0x1a6], cx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x1a8], ecx
mov dword [ebx + 0x1ac], edx
mov ecx, dword [eax + 0x4c]
lea esi, [eax + 0x60]
mov dword [ebx + 0x1b0], ecx
mov dword [ebx + 0x1b4], edx
mov ecx, dword [eax + 0x50]
lea edi, [ebx + 0x1d0]
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x1bc], edx
mov ecx, dword [eax + 0x54]
mov dword [ebp - 0x24], edx
mov dword [ebx + 0x1c0], ecx
mov dword [ebx + 0x1c4], edx
mov ecx, dword [eax + 0x58]
mov dword [ebx + 0x1c8], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebx + 0x1cc], ecx
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
jmp 0x42f6b7
cmp ax, 0x20b
jne 0x42f69e
xor eax, eax
mov ax, word [ebx + 0x134]
cmp eax, 0xf0
mov dword [ebp - 0x14], eax
jbe 0x42f5ff
mov eax, 0xf0
mov dword [ebp - 0x14], eax
mov edx, dword [ebx + 0x20]
lea ecx, [ebx + 0x2e4]
push edx
push eax
push esi
push edi
push ecx
mov ecx, ebx
call fcn.00431d20
test eax, eax
jne 0x42f61d
call fcn.0042d380
lea eax, [ebx + 0x2e4]
lea edi, [ebx + 0x160]
mov dword [ebx + 0x254], eax
mov esi, eax
lea ecx, [eax + 0x70]
mov dword [ebp - 0x24], 0
mov dword [ebx + 0x258], ecx
mov edx, dword [eax + 0x6c]
mov dword [ebx + 0x13c], edx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x140], ecx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x144], edx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x14c], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x148], edx
mov ecx, dword [eax + 4]
mov dword [ebx + 0x150], ecx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x158], edx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x15c], ecx
mov ecx, 0x3c
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
jmp 0x42f6b7
push 0x440f4c
push 1
push 0x106
push 0x440eb8
call fcn.0042d090
add esp, 0x10
mov ecx, dword [ebx + 0x13c]
mov eax, 0x10
cmp ecx, eax
jbe 0x42f6cc
mov dword [ebx + 0x13c], eax
xor eax, eax
mov ecx, ebx
mov ax, word [ebx + 0x134]
cdq
add edi, eax
adc esi, edx
call fcn.00432780
test eax, eax
jne 0x42f6ea
call fcn.0042d380
xor eax, eax
mov ax, word [ebx + 0x126]
mov dword [ebx + 0x3d4], eax
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.0042d540
add esp, 4
mov dword [ebx + 0x3d8], eax
test eax, eax
jne 0x42f72a
push 0x440344
push eax
push 0x10f
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
mov eax, dword [ebx + 0x3d4]
mov ecx, dword [ebx + 0x20]
push ecx
mov ecx, ebx
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x3d8]
shl edx, 3
push edx
push esi
push edi
push eax
call fcn.00431d20
test eax, eax
jne 0x42f754
call fcn.0042d380
mov eax, dword [ebx + 0x3d4]
lea ecx, [eax + eax*4]
shl ecx, 3
add edi, ecx
mov ecx, ebx
adc esi, 0
call fcn.00432400
test eax, eax
jne 0x42f775
call fcn.0042d380
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov edx, ecx
push eax
add edx, edi
mov edi, eax
adc edi, esi
sub edx, 1
sbb edi, 0
push ecx
push edi
push edx
call fcn.004355d0
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
push ecx
push edx
push eax
call fcn.00435740
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
mov edx, dword [ebx + 0x3d4]
shl edx, 2
push edx
call fcn.0042d540
add esp, 4
mov dword [ebx + 0x3dc], eax
test eax, eax
jne 0x42f7db
push 0x440344
push eax
push 0x117
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
mov ecx, dword [ebx + 0x3d4]
mov edi, dword [ebx + 0x3dc]
shl ecx, 2
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
mov dword [ebp + 8], eax
cmp eax, dword [ebx + 0x3d4]
jae 0x42f8fa
mov ecx, dword [ebx + 0x3d8]
lea eax, [eax + eax*4]
push 8
lea edx, [ecx + eax*8]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea ecx, [ebp - 0x3c]
add esp, 0xc
test ecx, ecx
mov byte [ebp - 0x34], 0
jne 0x42f836
xor esi, esi
jmp 0x42f869
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.004269f0
mov esi, esp
push edi
push esi
lea eax, [ebp - 0x3c]
push 0xffffffffffffffff
push eax
push 0
push 0
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
inc edi
lea ecx, [edi + edi]
push ecx
call fcn.0042d540
mov edx, dword [ebx + 0x3dc]
mov ecx, dword [ebp + 8]
add esp, 8
mov dword [edx + ecx*4], eax
mov eax, dword [ebx + 0x3dc]
cmp dword [eax + ecx*4], 0
jne 0x42f8b0
push 0x440344
push 0
push 0x122
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
cmp edi, 0x7fffffff
ja 0x42f8ee
mov edx, dword [ebx + 0x3dc]
mov eax, dword [ebp + 8]
test edi, edi
mov eax, dword [edx + eax*4]
mov ecx, esi
je 0x42f8ee
test edi, edi
je 0x42f8e6
mov dx, word [ecx]
test dx, dx
je 0x42f8e2
mov word [eax], dx
add eax, 2
add ecx, 2
dec edi
jmp 0x42f8ca
test edi, edi
jne 0x42f8e9
sub eax, 2
mov word [eax], 0
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
jmp 0x42f7ff
mov ecx, dword [ebx + 0x3d4]
shl ecx, 2
push ecx
call fcn.0042d540
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [ebx + 0x3e0], eax
jne 0x42f930
push 0x440344
push esi
push 0x129
push 0x440eb8
call fcn.0042c7c0
add esp, 0x10
mov ecx, ebx
call fcn.004322f0
mov edx, dword [ebx + 0x3d4]
mov eax, dword [ebx + 0x3e0]
mov eax, dword [eax + edx*4 - 4]
mov edx, dword [ebx + 0x3d8]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*8]
mov ecx, dword [edx + ecx*8 + 0x14]
mov edx, dword [eax + 0x10]
mov eax, dword [ebx + 0x10]
add ecx, edx
xor edx, edx
sub eax, ecx
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 0x3e8], eax
sbb ecx, edx
mov eax, ecx
mov dword [ebx + 0x3ec], ecx
cmp eax, esi
jg 0x42f990
jl 0x42f984
cmp dword [ebx + 0x3e8], esi
jae 0x42f990
mov dword [ebx + 0x3e8], esi
mov dword [ebx + 0x3ec], esi
mov esi, 1
mov dword [ebx + 0xa0], esi
jmp 0x42f9b7
test esi, esi
mov dword [ebp - 4], 0xffffffff
jne 0x42f9c9
mov ecx, ebx
call fcn.0042fa10
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x48]
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8