Function at 0x561222
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a5b8e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x124a8
call fcn.0056e5a0
mov eax, dword [0x783760]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x124b4], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x124a8], ebx
push esi
call fcn.005655b9
pop ecx
mov edi, eax
add eax, 0xfffffffc
adc edx, 0xffffffff
cmp edx, ebx
ja 0x56157e
jb 0x56128b
cmp eax, 0xfffffff9
ja 0x56157e
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push esi
call fcn.005654e9
add esp, 0x1c
mov ebx, eax
mov dword [ebp - 0x124ac], ebx
cmp ebx, 0xffffffff
je 0x561576
lea eax, [edi + 1]
push eax
call fcn.0056e306
pop ecx
mov esi, eax
mov dword [ebp - 0x124b8], esi
test esi, esi
je 0x561567
and dword [ebp - 0x124b0], 0
push 0
lea eax, [ebp - 0x124b0]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x561555
cmp dword [ebp - 0x124b0], edi
jne 0x561555
mov byte [edi + esi], 0
lea ecx, [ebp - 0x124a4]
call fcn.00419778
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
push esi
lea ecx, [ebp - 0x124a4]
call fcn.00429c93
xor eax, eax
mov dword [ebp - 4], eax
push eax
push eax
push 0x700958
lea ecx, [ebp - 0x124a4]
call fcn.005058f1
test eax, eax
je 0x56151d
push 0
push 0
push 0x700968
mov ecx, eax
call fcn.005058f1
mov edi, eax
test edi, edi
je 0x56151d
cmp dword [edi + 4], 0
je 0x56135f
mov eax, dword [edi + 0xc]
jmp 0x561361
xor eax, eax
test eax, eax
je 0x56151d
lea ecx, [ebp - 0x70]
call fcn.004173bc
mov byte [ebp - 4], 4
mov eax, 0x795d20
cmp dword [edi + 4], 0
cmovne eax, dword [edi + 4]
lea ecx, [ebp - 0x6c]
push ecx
push eax
call fcn.00562889
pop ecx
pop ecx
test eax, eax
je 0x561509
cmp dword [ebp - 0x5c], 0x510
jne 0x561509
lea ecx, [ebp - 0x2f8]
call fcn.005608e1
xor edi, edi
push 2
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00407b80
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x5613ce
mov eax, dword [eax]
push 0x10
push 0
push eax
call fcn.0065312b
add esp, 0xc
mov byte [ebp + edi - 0x2f8], al
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00401d60
inc edi
cmp edi, 0x288
jb 0x5613b0
lea ecx, [ebp - 0x2460]
call fcn.0056a29c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x124ac]
call fcn.00569c02
mov byte [ebp - 4], 7
mov dword [ebp - 0x34], 0xcaeb00ff
mov dword [ebp - 0x30], 0x11a01202
mov dword [ebp - 0x2c], 0x9f917743
mov dword [ebp - 0x28], 0x18aa9119
mov dword [ebp - 0x24], 0xded9262
mov dword [ebp - 0x20], 0x9a5591
mov dword [ebp - 0x1c], 0x88e06302
mov dword [ebp - 0x18], 0xeea10000
push 0x20
lea eax, [ebp - 0x34]
push eax
push 2
push 3
lea ecx, [ebp - 0x2460]
call fcn.0056a480
test eax, eax
je 0x5614e3
push 0
push 0
lea eax, [ebp - 0x2f8]
push eax
mov edi, 0x288
push edi
push eax
lea ecx, [ebp - 0x2460]
call fcn.0056a7fb
test eax, eax
je 0x5614e3
lea eax, [ebp - 0x54]
push eax
push 0x268
lea eax, [ebp - 0x2d8]
push eax
push 2
lea ecx, [ebp - 0x124ac]
call fcn.00569ec1
test eax, eax
je 0x5614e3
push 0x20
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0064454b
add esp, 0xc
test eax, eax
jne 0x5614e3
push edi
lea eax, [ebp - 0x2f8]
push eax
mov eax, dword [ebp - 0x124b4]
push dword [eax + 0x24]
call fcn.00643300
add esp, 0xc
xor edi, edi
inc edi
jmp 0x5614e9
mov edi, dword [ebp - 0x124a8]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x124ac]
call fcn.00569c0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2460]
call fcn.0056a2ca
jmp 0x56150f
mov edi, dword [ebp - 0x124a8]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.0041786a
jmp 0x561523
mov edi, dword [ebp - 0x124a8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12474]
call fcn.0041cc8c
jmp 0x56155b
mov edi, dword [ebp - 0x124a8]
push 1
push esi
call fcn.0056df27
pop ecx
pop ecx
jmp 0x56156d
mov edi, dword [ebp - 0x124a8]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x561580
mov edi, dword [ebp - 0x124a8]
jmp 0x561580
mov edi, ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0056e1bf
mov esp, ebp
pop ebp
ret 4