Function at 0x431547
Capabilities:
Execute anti-debugging instructions
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10644
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0x10608], 0
mov dword [ebp - 0x10628], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10620], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0x1063c], eax
mov eax, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x1062c], eax
mov dword [ebp - 0x10630], edx
mov dword [ebp - 0x1060c], ecx
mov eax, 0x10000
mov ebx, dword [ebp - 0x10608]
cmp dword [edx + ebx*4], 0
je 0x4315c3
inc dword [ebp - 0x10608]
cmp dword [ebp - 0x10608], eax
jb 0x4315a9
cmp ecx, dword [esi + 0x24]
jb 0x4315f4
mov ecx, dword [ebp - 0x10620]
push eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10628]
mov esi, 0x4ac38c
push 0x75
push esi
mov dword [ecx], esi
call fcn.00450230
add esp, 0xc
mov dword [edi], 1
jmp 0x431aa0
mov ecx, dword [esi + ecx*8 + 0x34]
mov ebx, ecx
mov edx, ecx
sar edx, 0x18
sar ebx, 0x1f
mov dword [ebp - 0x10618], ebx
mov ebx, edx
mov edx, dword [ebp - 0x10618]
mov dword [ebp - 0x105fc], ecx
and dword [ebp - 0x105fc], 0xffff
mov edx, ecx
sar ecx, 0x1f
mov ecx, dword [ebp - 0x1060c]
mov ecx, dword [esi + ecx*8 + 0x30]
sar edx, 8
and ebx, 0xff
and edx, 0xff00
or ebx, edx
mov dword [ebp - 0x10600], ecx
or ecx, dword [ebp - 0x105fc]
mov dword [ebp - 0x10624], ebx
je 0x4315c8
jmp 0x4317b2
mov eax, dword [ebp - 0x10630]
xor edi, edi
push edi
push dword [ebp - 0x105fc]
lea eax, [eax + ebx*4]
push dword [ebp - 0x10600]
mov dword [ebp - 0x10618], eax
push dword [eax]
call fcn.0044df99
cmp eax, dword [ebp - 0x10600]
jne 0x4317f3
cmp edx, dword [ebp - 0x105fc]
jne 0x4317f3
rdtsc
mov dword [ebp - 0x10614], eax
push edi
lea eax, [ebp - 0x10604]
push eax
push 0xc
lea eax, [ebp - 0x10010]
push eax
mov eax, dword [ebp - 0x10618]
push dword [eax]
mov dword [ebp - 0x10610], edx
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
je 0x43181f
cmp dword [ebp + 0x24], edi
jne 0x4316e4
cmp dword [ebp - 0x10010], 0x30444e53
jne 0x4317a6
cmp dword [ebp - 0x10010], 0x30444e53
je 0x431700
cmp dword [ebp - 0x10010], 0x30484e53
jne 0x4317a6
cmp dword [ebp - 0x1000c], 0x10028
ja 0x431840
push edi
lea eax, [ebp - 0x10604]
push eax
push dword [ebp - 0x1000c]
mov eax, dword [ebp - 0x10618]
push 0x4bce28
push dword [eax]
call dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
test eax, eax
je 0x43186e
mov ecx, dword [esi + 8]
mov eax, dword [0x4bce2c]
mov edx, dword [esi + 0xc]
and dword [ebp - 0x10640], 0
mov edi, dword [0x4bce28]
mov ebx, ecx
or ebx, edx
mov dword [ebp - 0x10634], eax
mov eax, dword [ebp - 0x1060c]
je 0x431783
cmp dword [ebp - 0x10634], edx
jl 0x431783
jg 0x431771
cmp edi, ecx
jb 0x431783
sub edi, ecx
sbb dword [ebp - 0x10634], edx
sub eax, dword [esi + 0x20]
sbb dword [ebp - 0x10640], 0
mov ecx, dword [ebp - 0x10640]
shld ecx, eax, 0x10
shl eax, 0x10
cmp edi, eax
jne 0x4317a0
cmp dword [ebp - 0x10634], ecx
je 0x43188e
mov ebx, dword [ebp - 0x10624]
add ebx, 0x100
mov dword [ebp - 0x10624], ebx
cmp ebx, dword [ebp - 0x10608]
jbe 0x43165d
push dword [ebp - 0x105fc]
push dword [ebp - 0x10600]
push ebx
push str.illegal_header._Filenum___u_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x229
push str.NTVDISK
call fcn.0044dc85
add esp, 0x1c
mov eax, 0xc000000d
jmp 0x431aa2
push dword [ebp - 0x105fc]
push dword [ebp - 0x10600]
push str.set_filepointer__I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x22f
push str.NTVDISK
call fcn.0044dc85
add esp, 0x18
jmp 0x4317e9
push ebx
push str.readfile_header._Filenum___u_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x23c
push str.NTVDISK
call fcn.0044dc85
add esp, 0x14
jmp 0x4317e9
push dword [ebp - 0x1000c]
push str.illegal_header_size__x_a_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x24b
push str.NTVDISK
call fcn.0044dc85
add esp, 0x14
mov eax, 0xc000016a
jmp 0x431aa2
push str.readfile_record_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x252
push str.NTVDISK
call fcn.0044dc85
add esp, 0x10
jmp 0x431864
mov eax, dword [0x4bce34]
add eax, 0x14
cmp dword [ebp - 0x10604], eax
je 0x4318b7
push dword [ebp - 0x1000c]
push str.illegal_header_size__x_a_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x267
jmp 0x431857
push 1
push 8
lea eax, [ebp - 0x10010]
push eax
call fcn.0040b3a7
push eax
push dword [ebp - 0x1000c]
mov edi, 0x4bce28
push edi
call fcn.0040b3a7
mov esi, 0x4bce3c
cmp eax, dword [ebp - 0x10008]
je 0x431976
mov ecx, dword [ebp - 0x1062c]
lea eax, [ebp - 0x105f8]
push eax
push dword [0x4d2500]
call fcn.0044229e
lea eax, [ebp - 0x1061a]
push eax
lea eax, [ebp - 0x10619]
push eax
lea eax, [ebp - 0x10630]
push eax
push dword [ebp - 0x10008]
lea eax, [ebp - 0x10010]
push dword [0x4bce34]
push esi
push 0x14
push edi
push 8
push eax
call fcn.0040cfc5
mov ecx, dword [ebp - 0x1062c]
dec eax
lea eax, [ebp - 0x105f8]
push eax
push dword [0x4d2500]
je 0x431963
add dword [ebp - 0x105f0], 1
adc dword [ebp - 0x105ec], 0
call fcn.00442217
jmp 0x431864
add dword [ebp - 0x105f8], 1
adc dword [ebp - 0x105f4], 0
call fcn.00442217
lea eax, [ebp - 0x10614]
push eax
call fcn.0041dfd7
add dword [0x4d2504], eax
cmp dword [0x4a3020], 0
je 0x4319d1
test byte [0x4bce38], 0x10
je 0x4319d1
rdtsc
push dword [0x4bce28]
mov ecx, 0x4a301c
push dword [0x4bce34]
mov dword [ebp - 0x10610], edx
push esi
mov dword [ebp - 0x10614], eax
call fcn.0040d3e2
lea eax, [ebp - 0x10614]
push eax
call fcn.0041dfd7
add dword [0x4cce84], eax
and dword [ebp - 0x1060c], 0
test byte [0x4bce38], 4
je 0x4319f2
push 0x4bce34
push esi
call fcn.0043e636
mov dword [ebp - 0x1060c], eax
rdtsc
mov edi, dword [ebp - 0x10628]
mov ebx, dword [ebp - 0x10620]
mov dword [edi], esi
mov dword [ebp - 0x10600], eax
mov eax, dword [0x4bce34]
mov dword [ebx], eax
test byte [0x4bce38], 2
mov dword [ebp - 0x105fc], edx
je 0x431a36
push dword [edi]
lea eax, [ebp - 0x10004]
push eax
call fcn.0041a030
mov dword [ebx], eax
lea eax, [ebp - 0x10004]
mov dword [edi], eax
test byte [0x4bce38], 1
je 0x431a52
push dword [ebx]
mov esi, 0x4ac38c
push dword [edi]
push esi
call fcn.0044283b
mov dword [ebx], eax
mov dword [edi], esi
mov ebx, dword [ebx]
cmp ebx, dword [0x4bce30]
jne 0x431864
test byte [0x4bce38], 4
je 0x431a7f
push 1
push ebx
push dword [edi]
call fcn.0040b3a7
cmp eax, dword [ebp - 0x1060c]
jne 0x431864
lea eax, [ebp - 0x10600]
push eax
call fcn.0041dfd7
add dword [0x4d24fc], eax
mov ax, word [0x4bce3a]
mov ecx, dword [ebp - 0x1063c]
mov word [ecx], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0x24