Function at 0x416f20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x1770
push 0x40
call esi
mov edi, eax
push 0x1770
push 0x40
mov dword [esp + 0x30], edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push edi
mov dword [esp + 0x30], ebx
call esi
push ebx
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
xor esi, esi
cmp ecx, 1
mov dword [0x430b38], esi
mov dword [0x430b10], esi
mov ebp, dword [eax + 8]
mov edi, dword [eax + 4]
jne 0x416f8a
lea eax, [edi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
jmp 0x416fa3
cmp ecx, 4
jne 0x416f99
lea eax, [edi + 1]
cdq
sub eax, edx
sar eax, 1
jmp 0x416fa3
cmp ecx, 8
mov eax, edi
je 0x416fa3
lea eax, [edi + edi*2]
lea ebx, [eax + 3]
and ebx, 0xfffc
cmp ecx, 1
mov dword [esp + 0x24], ebx
jne 0x417010
cmp ebp, esi
jle 0x4171e1
lea esi, [ebp - 1]
lea eax, [edi + 7]
imul esi, ebx
cdq
mov ecx, ebx
and edx, 7
neg ecx
add eax, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ebp
sar eax, 3
mov dword [esp + 0x10], eax
add esi, ecx
jmp 0x416feb
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x38]
push esi
push eax
call fcn.00416e60
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
add esp, 0xc
add esi, ecx
dec eax
mov dword [esp + 0x18], eax
jne 0x416fe7
jmp 0x4171e1
cmp ecx, 4
jne 0x417154
cmp dword [0x4308dc], 2
jne 0x4170fd
cmp ebp, esi
jle 0x41707f
lea esi, [ebp - 1]
lea eax, [edi + 7]
imul esi, ebx
cdq
mov ecx, ebx
and edx, 7
neg ecx
add eax, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ebp
sar eax, 3
mov dword [esp + 0x10], eax
add esi, ecx
jmp 0x417058
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
push eax
push esi
push ecx
call fcn.00416e60
push edi
push esi
call fcn.004165d0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
add esp, 0x14
add esi, ecx
dec eax
mov dword [esp + 0x18], eax
jne 0x417054
mov dword [esp + 0x18], 1
test ebp, ebp
jle 0x4170ea
lea esi, [ebp - 1]
lea eax, [edi + 7]
imul esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
neg ebx
mov dword [esp + 0x10], eax
add esi, ecx
jmp 0x4170b5
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x38]
push edx
push eax
call fcn.00416e60
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push ecx
push edi
push edx
push esi
call fcn.00416650
mov eax, dword [esp + 0x3c]
add esp, 0x1c
add esi, ebx
dec eax
mov dword [esp + 0x20], eax
jne 0x4170b1
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 4
mov dword [esp + 0x18], eax
jl 0x417087
jmp 0x4171e1
cmp ebp, esi
jle 0x4171e1
lea esi, [ebp - 1]
lea eax, [edi + 1]
imul esi, ebx
cdq
mov ecx, ebx
sub eax, edx
neg ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x3c]
sar eax, 1
mov dword [esp + 0x20], eax
add esi, ecx
mov dword [esp + 0x24], ebp
jmp 0x41712f
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x38]
push esi
push eax
call fcn.00416e60
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
add esp, 0xc
add esi, ecx
dec eax
mov dword [esp + 0x24], eax
jne 0x41712b
jmp 0x4171e1
cmp ecx, 8
jne 0x41719b
cmp ebp, esi
jle 0x4171e1
lea esi, [ebp - 1]
mov eax, ebx
imul esi, ebx
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
add esi, eax
mov dword [esp + 0x24], ebp
mov ecx, dword [esp + 0x34]
push edi
push esi
push ecx
call fcn.00416e60
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
add esp, 0xc
add esi, ecx
dec eax
mov dword [esp + 0x24], eax
jne 0x417179
jmp 0x4171e1
cmp ebp, esi
jle 0x4171e1
lea esi, [ebp - 1]
mov eax, ebx
imul esi, ebx
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
add esi, eax
mov dword [esp + 0x24], ebp
mov edx, dword [esp + 0x34]
lea eax, [edi + edi*2]
push eax
push esi
push edx
call fcn.00416e60
push edi
push esi
call fcn.00416710
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
add esp, 0x14
add esi, ecx
dec eax
mov dword [esp + 0x24], eax
jne 0x4171b7
mov eax, dword [0x428834]
test eax, eax
jne 0x417201
test ebp, ebp
jle 0x417201
mov esi, dword [esp + 0x3c]
push edi
push esi
call fcn.004166f0
add esp, 8
add esi, ebx
dec ebp
jne 0x4171f2
cmp word [0x430b14], 0
je 0x417300
mov eax, dword [0x430b2c]
mov esi, dword [esp + 0x34]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ax, word [0x430b14]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
test ax, ax
jle 0x41726a
mov ecx, dword [esp + 0x38]
lea ebp, [ecx + 0x2a]
lea edx, [esp + 0x3c]
push 0
push edx
lea eax, [esp + 0x1c]
push 2
push eax
push esi
call edi
mov ecx, dword [esp + 0x14]
add ebp, 4
sar ecx, 8
mov byte [ebp - 4], cl
mov ax, word [0x430b14]
movsx edx, ax
inc ebx
cmp ebx, edx
jl 0x41723e
xor ebx, ebx
test ax, ax
jle 0x4172a4
mov eax, dword [esp + 0x38]
lea ebp, [eax + 0x29]
lea ecx, [esp + 0x3c]
push 0
push ecx
lea edx, [esp + 0x1c]
push 2
push edx
push esi
call edi
mov eax, dword [esp + 0x14]
add ebp, 4
sar eax, 8
mov byte [ebp - 4], al
mov ax, word [0x430b14]
movsx ecx, ax
inc ebx
cmp ebx, ecx
jl 0x417278
xor ebx, ebx
test ax, ax
jle 0x4172de
mov edx, dword [esp + 0x38]
lea ebp, [edx + 0x28]
lea eax, [esp + 0x3c]
push 0
push eax
lea ecx, [esp + 0x1c]
push 2
push ecx
push esi
call edi
mov edx, dword [esp + 0x14]
add ebp, 4
sar edx, 8
mov byte [ebp - 4], dl
mov ax, word [0x430b14]
movsx ecx, ax
inc ebx
cmp ebx, ecx
jl 0x4172b2
xor ecx, ecx
test ax, ax
jle 0x417312
mov edx, dword [esp + 0x38]
lea eax, [edx + 0x2b]
mov byte [eax], 0
inc ecx
movsx edx, word [0x430b14]
add eax, 4
cmp ecx, edx
jl 0x4172ec
jmp 0x417312
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
push eax
push ecx
call fcn.00416d50
add esp, 8
mov edi, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call edi
mov ebx, dword [esp + 0x2c]
push ebx
call esi
push ebx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret