Function at 0x439340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [0x4a09d8]
push ebx
push esi
push edi
push 1
push 0
or edi, 0xffffffff
push edi
push 0
mov esi, eax
mov dword [esp + 0x20], ecx
call fcn.004668b0
mov ecx, dword [0x4a13a4]
push 1
push 0
push edi
push 0x4916f4
call fcn.004668b0
mov eax, dword [0x49d3c8]
mov eax, dword [eax + 0xd0]
and eax, 0x7fffffff
mov byte [esp + 0xf], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], eax
mov eax, esi
mov cl, byte [eax]
cmp cl, 0x20
je 0x4393b0
cmp cl, 9
jne 0x4393b3
inc eax
jmp 0x4393a4
cmp byte [eax], 0x2a
jne 0x4394c7
movzx edi, byte [eax + 1]
lea esi, [eax + 1]
test edi, 0xffffff80
jne 0x4393dd
push 2
push edi
call fcn.0047814e
add esp, 8
test eax, eax
je 0x4393dd
and edi, 0xffffffdf
mov eax, edi
movsx eax, al
add eax, 0xffffffbd
cmp eax, 0x11
ja case.0x4393f5.68
movzx ecx, byte [eax + 0x439808]
jmp dword [ecx*4 + 0x4397f4]
mov byte [esp + 0x18], 1
jmp case.0x4393f5.68
lea edi, [esi + 1]
mov eax, edi
call fcn.0040c270
movzx edx, al
neg edx
sbb edx, edx
and edx, 6
add edx, 0xa
push edx
push 0
push edi
call fcn.00478a63
add esp, 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
test edx, edx
ja 0x4397e3
jb 0x439446
cmp eax, 0x40000000
ja 0x4397e3
mov edi, 0x4918e4
mov eax, esi
call fcn.00408bf0
mov esi, eax
test esi, esi
je 0x4397e3
dec esi
jmp case.0x4393f5.68
lea eax, [esi + 1]
push eax
call fcn.00478196
mov dl, byte [esi]
add esp, 4
mov dword [esp + 0x1c], eax
test dl, dl
je 0x4397e3
lea esp, [esp]
mov ecx, 0x4918e4
mov al, 0x20
cmp dl, al
je 0x43945c
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x439487
mov dl, byte [esi + 1]
inc esi
test dl, dl
jne 0x439480
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [esp + 0xf], 1
cmp byte [esi], 0
je 0x4393a2
inc esi
cmp byte [esi], 0
je 0x4393a2
inc esi
jmp 0x4393a2
push 0
push 0x8000000
push 3
push 0
push 3
push Ordinal_2
push esi
call dword [sym.imp.KERNUL32.dll_Creat_FiheA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x439504
call dword [sym.imp.KERNUL32.dll_GetastError]
mov ecx, dword [0x49d3c8]
mov dword [ecx + 0x30], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0x18], 0
je 0x439532
mov ecx, dword [esp + 0x10]
mov al, byte [ecx + 0x17]
test al, al
jne 0x43951c
mov edx, dword [ecx + 0xc]
mov al, byte [edx + 0x17]
cmp al, 2
jne 0x439532
mov eax, dword [ebp + 8]
push eax
call fcn.0043a200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
call fcn.00464f70
mov edi, eax
mov esi, edx
mov ecx, edi
and ecx, esi
cmp ecx, 0xffffffff
je 0x4397cd
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
and edx, ecx
cmp edx, 0xffffffff
jne 0x439571
test esi, esi
ja 0x4397cd
jb 0x439571
cmp edi, 0x40000000
ja 0x4397cd
cmp ecx, esi
ja 0x43957f
jb 0x43957b
cmp eax, edi
jae 0x43957f
mov edi, eax
mov esi, ecx
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
mov eax, edi
or eax, esi
jne 0x4395a9
mov ecx, dword [0x49d3c8]
mov dword [ecx + 0x30], eax
jmp 0x4397dc
cmp byte [esp + 0x18], 0
je 0x4395d7
mov ecx, dword [esp + 0x10]
push 0
push 1
push edi
push 0
call fcn.004668b0
cmp eax, 1
je 0x4395e5
push ebx
call dword [sym.imp.KERNUL32.dll_CloseHandle_]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [edi + 2]
push edx
call fcn.00476de3
add esp, 4
jmp 0x4395f0
mov ecx, dword [esp + 0x10]
push 1
call fcn.00401230
push 0
mov esi, eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNUL32.dll_ReadFile]
mov edi, eax
call dword [sym.imp.KERNUL32.dll_GetastError]
mov ecx, dword [0x49d3c8]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNUL32.dll_CloseHandle_]
test edi, edi
je 0x43977d
mov edx, dword [esp + 0x14]
mov bl, byte [esp + 0x18]
mov byte [edx + esi], 0
mov eax, dword [esp + 0x14]
mov byte [eax + esi + 1], 0
test bl, bl
jne 0x439704
mov eax, dword [esp + 0x14]
cmp eax, 3
jb 0x439670
cmp byte [esi], 0xef
jne 0x439670
cmp byte [esi + 1], 0xbb
jne 0x439670
cmp byte [esi + 2], 0xbf
jne 0x439670
mov edi, dword [esp + 0x10]
push 0xfde9
lea ecx, [eax - 3]
lea edx, [esi + 3]
push edi
call fcn.004672f0
jmp 0x43969d
cmp eax, 2
jb 0x4396b7
cmp byte [esi], 0xff
jne 0x4396b7
cmp byte [esi + 1], 0xfe
jne 0x4396b7
mov dl, 1
mov ecx, esi
test dl, dl
je 0x43968e
lea ecx, [esi + 2]
add eax, 0xfffffffe
mov edi, dword [esp + 0x10]
shr eax, 1
push eax
push ecx
mov eax, edi
call fcn.004673c0
test esi, esi
je 0x4396aa
push esi
call fcn.004785bf
add esp, 4
push 1
mov ecx, edi
call fcn.00401230
mov esi, eax
jmp 0x439708
mov edi, dword [esp + 0x1c]
xor dl, dl
cmp edi, 0x4b0
je 0x439682
test edi, edi
je 0x4396ea
call dword [sym.imp.KERNUL32.dll_GeACP]
cmp edi, eax
je 0x4396e6
mov ecx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push edi
mov edx, esi
call fcn.004672f0
jmp 0x43969d
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push eax
push esi
mov eax, edi
call fcn.00466e90
push 1
mov ecx, edi
call fcn.00401230
mov esi, eax
jmp 0x439708
mov edi, dword [esp + 0x10]
cmp byte [esp + 0xf], 0
je 0x43972d
push 0
push 0xffffffffffffffff
push 1
push 0x495110
push 0x494aac
push esi
xor eax, eax
or ecx, 0xffffffff
call fcn.00464760
add esp, 0x18
test bl, bl
je 0x439753
mov esi, dword [esp + 0x14]
mov eax, edi
call fcn.00412080
mov ecx, dword [esp + 0x18]
mov dword [eax], esi
push ecx
mov eax, edi
call fcn.00412180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x439756
mov eax, edi
sub esi, ecx
call fcn.00412080
mov ecx, dword [esp + 0x18]
mov dword [eax], esi
push ecx
mov eax, edi
call fcn.00412180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0x18], 0
jne 0x43978d
push esi
call fcn.004785bf
add esp, 4
mov ecx, dword [esp + 0x10]
push 1
push 0
push 0xffffffffffffffff
push 0
call fcn.004668b0
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
push 0x4916f4
call fcn.004668b0
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
push ecx
mov eax, edi
call fcn.00412180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNUL32.dll_GetastError]
mov edx, dword [0x49d3c8]
mov dword [edx + 0x30], eax
push ebx
call dword [sym.imp.KERNUL32.dll_CloseHandle_]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4