Function at 0x47fc98
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
je 0x47fd47
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x47fd47
cmp eax, 0x80000000
mov dword [ecx], edi
je 0x47fd47
cmp eax, 0x80000005
je 0x47fd47
cmp eax, 0x80000001
je 0x47fd47
cmp eax, 0x80000003
je 0x47fd47
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x47fd47
cmp dword [ebp + 0x1c], edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], edi
je 0x47fd57
cmp dword [ebp + 0x20], edi
je 0x47fd57
xor eax, eax
cmp dword [ebp + 0x20], 2
setne al
dec eax
and eax, 0xffffff0c
add eax, 0x104
movzx ebx, ax
lea eax, [ebx + ebx]
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x47fd47
push dword [ebp + 0x1c]
push ebx
push eax
call fcn.0047eb0c
test eax, eax
push dword [ebp - 4]
jge 0x47fd51
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
call dword [sym.imp.USER32.dll_CharUpperW]
cmp dword [ebp + 8], edi
jne 0x47fd68
cmp dword [ebp + 0x18], edi
jne 0x47fdb3
mov dword [ebp - 0x14], 2
push dword [ebp + 0x20]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.0047eed9
cmp eax, edi
mov dword [ebp + 0x1c], eax
je 0x47fdb3
push 0x22c
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x47fdbd
push dword [ebp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
call ebx
cmp dword [ebp - 4], edi
je 0x47fd47
push dword [ebp - 4]
jmp 0x47fd3d
cmp dword [ebp - 4], edi
mov dword [ebx + 0x20], edi
je 0x47fe12
push dword [ebp - 4]
lea eax, [ebx + 0x24]
push 0x104
push eax
call fcn.0047eb0c
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x20]
push edi
mov dword [ebx + 0x20], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0xc], edi
jge 0x47fe12
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jmp 0x47fd3d
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
add eax, 4
shr eax, 0xc
inc eax
shl eax, 0xc
lea ecx, [eax - 4]
mov dword [ebx + 0xc], ecx
mov ecx, dword [ebp - 0x14]
push eax
push 8
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 4], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, edi
je 0x47fdf1
mov dword [ebx + 0x1c], eax
add eax, 4
cmp dword [ebp - 0xc], edi
mov dword [ebx + 0x18], eax
je 0x47fe7a
push edi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp - 0xc]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47fe7a
mov dword [ebp - 0x10], 0xd
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0047ea66
test eax, eax
jne 0x47fea9
push dword [ebp - 0xc]
mov dword [ebx + 8], edi
push edi
push dword [ebx + 0x18]
call fcn.0046e670
add esp, 0xc
cmp dword [ebp + 0x18], edi
jne 0x47fea9
or dword [ebx + 4], 4
cmp dword [ebp - 0x10], edi
jne 0x47fec9
test byte [ebx + 4], 4
jne 0x47fef5
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0047fa27
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x47fef5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebx + 0x1c]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp - 0x10]
jmp 0x47fd4a