Function at 0x429d0b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp - 0x118]
push 9
push eax
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 0x118], 0x41
jne 0x42a1b4
cmp byte [ebp - 0x117], 0x48
jne 0x42a1b4
cmp byte [ebp - 0x116], 0x53
je 0x429d65
cmp byte [ebp - 0x116], 0x30
jne 0x42a1b4
cmp byte [ebp - 0x116], 0x30
jne 0x429d75
mov dword [ebp - 8], 1
mov ebx, dword [ebp + 8]
push dword [ebx + 0x3c]
push dword [0x464c60]
call fcn.004342a3
mov eax, dword [ebp - 0x115]
test ah, 0x10
mov word [ebx + 0x36], ax
je 0x429d9d
mov word [ebx + 0x30], 0x1000
jmp 0x429da1
mov word [ebx + 0x30], di
and eax, 0xfff
mov word [ebx + 0x36], ax
add eax, 5
mov word [ebx + 0x38], ax
movzx eax, ax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push dword [0x464c60]
call fcn.004341c8
mov dword [ebx + 0x3c], eax
mov ax, word [ebx + 0x30]
cmp ax, 0x1000
jne 0x429dd9
cmp word [ebx + 0x32], di
jne 0x429de4
mov cx, word [ebp - 0x113]
mov word [ebx + 0x32], cx
mov cx, word [ebp - 0x111]
cmp ax, di
mov word [ebx + 0x34], cx
jne 0x429e7f
cmp dword [ebp - 8], edi
mov word [ebx + 0x14], 2
mov dword [ebx + 0x18], edi
mov word [ebx + 0x20], di
mov word [ebx + 0x22], di
mov dword [ebx + 0x1c], edi
je 0x429e2d
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x118]
push 4
push eax
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp - 0x118]
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x118]
push 8
push eax
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp - 0x118]
mov cx, word [ebp - 0x114]
mov dword [ebx + 0x24], eax
mov word [ebx + 0x20], cx
mov cx, word [ebp - 0x112]
shr eax, 6
inc eax
mov word [ebx + 0x22], cx
push eax
push 0x7ffe
call fcn.004341c8
lea ecx, [ebp - 4]
push edi
push ecx
mov dword [ebx + 0x28], eax
push dword [ebx + 0x24]
push eax
push dword [ebp + 0xc]
call esi
cmp word [ebx + 0x36], di
mov dword [ebp - 0xc], edi
jle 0x42a1a0
jmp 0x429e90
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x118]
push 0xc
push eax
push dword [ebp + 0xc]
call esi
cmp byte [ebp - 0x118], 0x52
jne 0x42a1b4
cmp byte [ebp - 0x117], 0x48
jne 0x42a1b4
movsx edi, word [ebp - 0xc]
mov eax, dword [ebp - 0x116]
mov ecx, dword [ebp - 0x114]
lea edi, [edi + edi*2]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x3c]
push 0xffffffffffffffff
shl edi, 2
mov dword [ebp - 8], edi
mov dword [edi + eax], ecx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 0x110]
mov dword [edi + eax + 4], ecx
call fcn.00433852
mov ecx, dword [ebx + 0x3c]
cmp word [ebp + 8], 0
mov dword [edi + ecx + 8], eax
jle 0x42a18f
movsx eax, word [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x118]
push 1
push eax
push dword [ebp + 0xc]
call esi
movsx eax, byte [ebp - 0x118]
dec eax
je 0x42a0f8
dec eax
je 0x42a049
dec eax
jne 0x42a186
push 0x4c
push dword [0x464c60]
call fcn.004341c8
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x118]
push 0x20
push eax
mov word [edi], 3
push dword [ebp + 0xc]
call esi
mov ax, word [ebp - 0x118]
push 0
mov word [edi + 8], ax
mov ax, word [ebp - 0x116]
mov word [edi + 0xa], ax
mov ax, word [ebp - 0x114]
mov word [edi + 0xc], ax
mov ax, word [ebp - 0x112]
mov word [edi + 0xe], ax
mov eax, dword [ebp - 0x110]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10c]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x108]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x104]
mov dword [edi + 0x14], eax
movsx eax, word [ebp - 0x100]
mov dword [edi + 0x3c], eax
movsx eax, word [ebp - 0xfe]
mov dword [edi + 0x40], eax
movsx eax, word [ebp - 0xfc]
mov dword [edi + 0x44], eax
lea eax, [ebp - 4]
push eax
movsx eax, word [ebp - 0xfa]
push eax
lea eax, [edi + 0x1c]
push eax
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x118]
push 2
push eax
push dword [ebp + 0xc]
call esi
movsx eax, word [ebp - 0x118]
mov dword [ebp + 8], eax
push 0x40
cdq
pop ecx
idiv ecx
inc eax
push eax
push 0x7ffe
call fcn.004341c8
lea ecx, [ebp - 4]
push 0
push ecx
mov dword [edi + 0x48], eax
push dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call esi
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
push edi
push dword [ecx + eax + 8]
call fcn.00433777
push edi
push ebx
call fcn.0042a811
pop ecx
pop ecx
jmp 0x42a186
push 0x1c
push dword [0x464c60]
call fcn.004341c8
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x118]
push 0x10
push eax
mov word [edi], 2
push dword [ebp + 0xc]
call esi
mov ax, word [ebp - 0x118]
mov word [edi + 0xc], ax
mov ax, word [ebp - 0x116]
mov word [edi + 0xe], ax
mov eax, dword [ebp - 0x114]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x110]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x10c]
mov dword [edi + 0x10], eax
shr eax, 6
inc eax
push eax
push 0x7ffe
call fcn.004341c8
lea ecx, [ebp - 4]
push 0
push ecx
mov dword [edi + 0x14], eax
push dword [edi + 0x10]
push eax
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x118]
push 2
push eax
push dword [ebp + 0xc]
call esi
movsx eax, word [ebp - 0x118]
mov dword [ebp + 8], eax
push 0x40
cdq
pop ecx
idiv ecx
inc eax
push eax
push 0x7ffe
call fcn.004341c8
mov dword [edi + 0x18], eax
jmp 0x42a167
push 0x18
push dword [0x464c60]
call fcn.004341c8
mov edi, eax
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x118]
push 0xe
push eax
mov word [edi], 1
push dword [ebp + 0xc]
call esi
mov ax, word [ebp - 0x118]
push 0x40
mov word [edi + 0xc], ax
mov ax, word [ebp - 0x116]
mov word [edi + 0xe], ax
mov eax, dword [ebp - 0x114]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x110]
mov dword [edi + 8], eax
pop ecx
movsx eax, word [ebp - 0x10c]
mov dword [ebp + 8], eax
cdq
idiv ecx
inc eax
push eax
push 0x7ffe
call fcn.004341c8
mov dword [edi + 0x14], eax
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call esi
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
push edi
push dword [ecx + eax + 8]
call fcn.00433777
dec dword [ebp - 0x10]
jne 0x429f0c
inc dword [ebp - 0xc]
mov ax, word [ebp - 0xc]
cmp ax, word [ebx + 0x36]
jl 0x429e8e
cmp word [ebx + 0x30], 0x1000
jne 0x42a1af
push ebx
call fcn.00429778
pop ecx
push 1
pop eax
jmp 0x42a1b6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret