Function at 0x40ef10
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x4340
call fcn.004d7c90
mov eax, dword [0x56c3c0]
xor eax, esp
mov dword [esp + 0x4338], eax
push ebp
mov ebp, dword [esp + 0x4348]
push esi
push edi
push ebp
mov esi, ebx
mov edi, ecx
call fcn.0040ed40
add esp, 4
test eax, eax
jne 0x40ef60
mov eax, 0xc0000101
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4338]
xor ecx, esp
call fcn.004d6555
add esp, 0x4340
ret
push 0x303
xor esi, esi
lea eax, [esp + 0x1d]
push esi
push eax
mov byte [esp + 0x24], 0
call fcn.004d5720
add esp, 0xc
push esi
push 0x10000000
push 3
xor eax, eax
push esi
push esi
push SysReAllocStringLen
push edi
mov byte [esp + 0x4340], 0
mov dword [esp + 0x4341], eax
mov dword [esp + 0x4345], eax
mov dword [esp + 0x4349], eax
mov dword [esp + 0x434d], eax
mov dword [esp + 0x4351], eax
mov dword [esp + 0x4355], eax
mov dword [esp + 0x4359], eax
mov word [esp + 0x435d], ax
mov byte [esp + 0x435f], al
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f16b
push esi
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x40f032
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f032
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xc0000305
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4338]
xor ecx, esp
call fcn.004d6555
add esp, 0x4340
ret
push esi
lea edx, [esp + 0x10]
push edx
push 0x2000
lea eax, [esp + 0x32c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40f1a2
cmp dword [esp + 0xc], 0x2000
jb 0x40f1a2
lea eax, [esp + 0x320]
call fcn.00415320
test eax, eax
je 0x40f1a2
cmp dword [esp + 0x4354], 0
je 0x40f0f3
lea edi, [esp + 0x4324]
mov ecx, ebp
call fcn.00414fe0
mov eax, 0x20
lea ecx, [esp + 0x57c]
mov edx, edi
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x40f0bb
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x40f0a5
jmp 0x40f0f3
movzx esi, byte [ecx]
movzx eax, byte [edx]
sub eax, esi
jne 0x40f0e7
movzx eax, byte [edx + 1]
movzx esi, byte [ecx + 1]
sub eax, esi
jne 0x40f0e7
movzx eax, byte [edx + 2]
movzx esi, byte [ecx + 2]
sub eax, esi
jne 0x40f0e7
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jne 0x40ef43
mov di, word [esp + 0x56f]
mov dl, byte [esp + 0x571]
mov al, byte [esp + 0x572]
movzx ecx, di
push ecx
mov byte [esp + 0x1c], dl
lea edx, [esp + 0x20]
push ebx
push edx
mov byte [esp + 0x25], al
call fcn.004d57a0
add esp, 0xc
lea edx, [esp + 0x18]
mov word [esp + 0x1a], di
call fcn.004167e0
lea edi, [esp + 0x4324]
lea esi, [esp + 0x18]
call fcn.00415060
mov eax, 0x10
xor ecx, ecx
jmp 0x40f150
mov edx, dword [esp + ecx + 0x4324]
cmp edx, dword [esp + ecx + 0x34c]
jne 0x40f185
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x40f150
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4338]
xor ecx, esp
call fcn.004d6555
add esp, 0x4340
ret
mov eax, 0xc0000102
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x4338]
xor ecx, esp
call fcn.004d6555
add esp, 0x4340
ret
mov ecx, dword [esp + 0x4344]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 0xc0000201
call fcn.004d6555
add esp, 0x4340
ret