Function at 0x42b934
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov ebx, dword [eax]
push esi
mov dword [ebp - 0x124], ebx
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
push 2
push esi
push esi
push ebx
call fcn.0044df99
push 1
push 0xffffffffffffffff
push 0xfffffffffffffff8
push ebx
call fcn.0044df99
xor eax, eax
push esi
mov dword [ebp - 0x13c], esi
lea edi, [ebp - 0x138]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
lea eax, [ebp - 0x134]
push eax
push 8
lea eax, [ebp - 0x13c]
push eax
push ebx
call edi
test eax, eax
je 0x42bc15
cmp dword [ebp - 0x138], 0x45524e53
je 0x42ba82
push 1
push esi
push esi
push ebx
call fcn.0044df99
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x138], esi
jne 0x42bcc2
cmp dword [ebp - 0x13c], esi
jne 0x42bcc2
push 1
push 0xffffffffffffffff
push 0xfffffdf8
push ebx
call fcn.0044df99
and eax, edx
cmp eax, 0xffffffff
je 0x42bc58
push esi
lea eax, [ebp - 0x134]
push eax
push 8
lea eax, [ebp - 0x13c]
push eax
push ebx
call edi
test eax, eax
je 0x42bc91
cmp dword [ebp - 0x138], 0x45524e53
jne 0x42b9e6
push 1
push esi
push esi
push ebx
call fcn.0044df99
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x144], eax
sub ecx, eax
mov eax, dword [ebp - 0x12c]
sbb eax, edx
push eax
push ecx
push edx
push dword [ebp - 0x144]
push dword [ebp - 0x12c]
push dword [ebp - 0x130]
push str._offset_recovered__start__I64x__now__I64x___I64x_n
call fcn.00450f5c
add esp, 0x1c
mov eax, dword [ebp - 0x13c]
xor ecx, ecx
add eax, 0x14
neg eax
push 1
adc ecx, esi
neg ecx
push ecx
push eax
push ebx
call fcn.0044df99
push esi
lea eax, [ebp - 0x134]
push eax
push 0xc
lea eax, [ebp - 0x114]
push eax
push ebx
call edi
push 1
test eax, eax
je 0x42bcf7
push 0xffffffffffffffff
push 0xfffffffffffffff4
push ebx
call fcn.0044df99
cmp dword [ebp - 0x114], 0x304f4e53
je 0x42bd4e
cmp dword [ebp - 0x114], 0x5458454e
je 0x42bb38
cmp dword [ebp - 0x114], 0x5f444e45
je 0x42b983
push 1
push esi
push esi
push ebx
call fcn.0044df99
push edx
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push dword [ebp - 0x114]
push str.Invalid_record_type__0x_x__in_file__s_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14cf
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x20
jmp 0x42bc51
inc dword [ebp - 0x11c]
push dword [ebp - 0x11c]
add dword [ebp - 0x128], 4
push dword [ebp - 0x118]
call fcn.0041fd96
lea ecx, [ebp - 0x108]
sub ecx, eax
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0x42bb5e
jmp 0x42bbe6
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push 0x2e
push eax
call fcn.00452730
mov edi, eax
push edi
push 0x46ced0
call fcn.0042f614
add esp, 0x10
push eax
push edi
push esi
mov edi, 0x469ec0
push edi
push 0x46ceb4
call fcn.0042f614
add esp, 0x10
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push edi
push 0x46cea4
call fcn.0042f614
add esp, 0xc
push eax
lea eax, [ebp - 0x108]
push eax
push esi
push dword [0x4d617c]
call fcn.00449908
test eax, eax
je 0x42bd29
push esi
push esi
push 3
push esi
push 1
push Ordinal_2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x42bb6a
jmp 0x42b964
push 1
push esi
push esi
push ebx
call fcn.0044df99
push edx
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.Read_error_in_file__s_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1469
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x1c
xor eax, eax
jmp 0x42bf53
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.No_end_record_found_in__s_during_backward_search._n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1479
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x14
push esi
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
jmp 0x42bc51
push 1
push esi
push esi
push ebx
call fcn.0044df99
push edx
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.Read_error_in_file__s_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1481
jmp 0x42bc44
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.No_end_record_found_in__s_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x148d
push str.NTCPVOL2FILE
call fcn.0044dc85
add esp, 0x14
jmp 0x42bc51
push esi
push esi
push ebx
call fcn.0044df99
push edx
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.Read_error_in_file__s_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1497
jmp 0x42bc44
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.The_required_continuation_file__n_____s_ncould_not_be_found__unable_to_continue_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14c2
jmp 0x42bce5
push esi
lea eax, [ebp - 0x134]
push eax
push 0xc
lea eax, [ebp - 0x114]
push eax
push ebx
call edi
push 1
test eax, eax
jne 0x42bd9a
push esi
push esi
push ebx
call fcn.0044df99
push edx
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.Read_error_in_file__s_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14db
jmp 0x42bc44
push dword [ebp - 0x110]
call fcn.00450903
mov ebx, eax
pop ecx
pop ecx
cmp ebx, esi
jne 0x42bdc9
push dword [ebp - 0x110]
push str.Cant_allocate__d_bytes_for_offset_information__2__n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14e4
jmp 0x42bce5
push esi
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x110]
push ebx
push dword [ebp - 0x124]
call edi
push 1
test eax, eax
jne 0x42be1d
push esi
push esi
push dword [ebp - 0x124]
call fcn.0044df99
push edx
push eax
push dword [ebp - 0x11c]
push dword [ebp - 0x118]
call fcn.0041fd96
push eax
push str.Read_error_in_file__s_at_offset_0x_I64x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14ea
jmp 0x42bc44
mov ecx, dword [ebx + 8]
sub ecx, dword [ebx]
mov edx, dword [ebx + 0xc]
sbb edx, dword [ebx + 4]
mov edi, dword [ebx + 0x1c]
mov eax, 0xffff
add ecx, eax
adc edx, esi
shrd ecx, edx, 0x10
shr edx, 0x10
mov edx, dword [ebx + 0x18]
sub edx, dword [ebx + 0x10]
sbb edi, dword [ebx + 0x14]
add eax, edx
adc edi, esi
shrd eax, edi, 0x10
add eax, ecx
shr edi, 0x10
lea edi, [eax*8 + 0x38]
push edi
mov dword [ebp - 0x124], eax
call fcn.00450903
pop ecx
pop ecx
mov dword [ebp - 0x118], eax
cmp eax, esi
jne 0x42be87
push edi
push str.Not_enough_memory_to_allocate__d_bytes_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x14f7
jmp 0x42bce5
push 0xe
pop ecx
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x30]
xor edi, edi
mov dword [ebp - 0x128], ecx
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
cmp ecx, edi
jbe 0x42bf08
lea esi, [eax + 0x30]
mov dword [ebp - 0x124], ecx
lea eax, [ebp - 0x128]
push eax
call fcn.0042b7f7
mov ecx, eax
or ecx, edx
jne 0x42bed9
and dword [esi], ecx
and dword [esi + 4], ecx
jmp 0x42beec
add edi, eax
adc dword [ebp - 0x12c], edx
mov eax, dword [ebp - 0x12c]
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [esi]
add dword [ebp - 0x120], eax
mov eax, dword [esi + 4]
adc dword [ebp - 0x11c], eax
add esi, 8
dec dword [ebp - 0x124]
jne 0x42bec0
push ebx
call fcn.0045038b
mov esi, dword [ebp - 0x118]
mov eax, dword [ebp - 0x120]
pop ecx
cmp eax, dword [esi + 0x28]
jne 0x42bf2b
mov eax, dword [ebp - 0x11c]
cmp eax, dword [esi + 0x2c]
je 0x42bf51
push str.checksum_error_while_reading_offset_information_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1517
push str.NTCPVOL2FILE
call fcn.0044dc85
push esi
call fcn.0045038b
jmp 0x42bcef
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0xc