Function at 0x4412b0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x40
mov esi, dword [esp + 0x50]
lea eax, [esp + 0x12]
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 0xc], esi
call sub.msvcrt.dll_fread
cmp eax, 0x2e
jne 0x4415d0
movzx eax, byte [esp + 0x13]
movzx edx, byte [esp + 0x14]
shl eax, 8
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0x12]
or eax, edx
movzx edx, byte [esp + 0x15]
shl edx, 0x18
or eax, edx
cmp eax, 0x2014b50
jne 0x4415b0
movzx edx, byte [esp + 0x17]
movzx eax, byte [esp + 0x16]
movzx ecx, byte [esp + 0x2e]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x19]
mov word [ebx + 4], ax
movzx eax, byte [esp + 0x18]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x1b]
mov word [ebx + 6], ax
movzx eax, byte [esp + 0x1a]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x1d]
mov word [ebx + 8], ax
movzx eax, byte [esp + 0x1c]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x1f]
mov word [ebx + 0xa], ax
movzx eax, byte [esp + 0x1e]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x21]
mov word [ebx + 0xc], ax
movzx eax, byte [esp + 0x20]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x24]
mov word [ebx + 0xe], ax
movzx eax, byte [esp + 0x23]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x22]
or eax, edx
movzx edx, byte [esp + 0x25]
shl edx, 0x18
or eax, edx
movzx edx, byte [esp + 0x28]
mov dword [ebx + 0x10], eax
movzx eax, byte [esp + 0x27]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x26]
or eax, edx
movzx edx, byte [esp + 0x29]
shl edx, 0x18
or eax, edx
movzx edx, byte [esp + 0x2c]
mov dword [ebx + 0x14], eax
movzx eax, byte [esp + 0x2b]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x2a]
or eax, edx
movzx edx, byte [esp + 0x2d]
shl edx, 0x18
or eax, edx
mov dword [ebx + 0x18], eax
movzx eax, byte [esp + 0x2f]
shl eax, 8
or ecx, eax
mov word [ebx + 0x1c], cx
movzx eax, byte [esp + 0x31]
movzx edx, byte [esp + 0x30]
movzx edi, byte [esp + 0x33]
shl eax, 8
or edx, eax
movzx eax, byte [esp + 0x32]
shl edi, 8
mov word [ebx + 0x1e], dx
or eax, edi
movzx edi, byte [esp + 0x35]
mov word [ebx + 0x20], ax
movzx eax, byte [esp + 0x34]
shl edi, 8
or eax, edi
movzx edi, byte [esp + 0x37]
mov word [ebx + 0x22], ax
movzx eax, byte [esp + 0x36]
shl edi, 8
or eax, edi
movzx edi, byte [esp + 0x3a]
mov word [ebx + 0x24], ax
movzx eax, byte [esp + 0x39]
shl edi, 0x10
shl eax, 8
or eax, edi
movzx edi, byte [esp + 0x38]
or eax, edi
movzx edi, byte [esp + 0x3b]
shl edi, 0x18
or eax, edi
movzx edi, byte [esp + 0x3e]
mov dword [ebx + 0x28], eax
movzx eax, byte [esp + 0x3d]
shl edi, 0x10
shl eax, 8
or eax, edi
movzx edi, byte [esp + 0x3c]
or eax, edi
movzx edi, byte [esp + 0x3f]
shl edi, 0x18
or eax, edi
test cx, cx
mov dword [ebx + 0x2c], eax
jne 0x441516
test dx, dx
jne 0x441567
movzx eax, word [ebx + 0x20]
xor edi, edi
test ax, ax
jne 0x4414c6
add esp, 0x40
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
add eax, 1
mov dword [esp], eax
call fcn.0053e9a0
test eax, eax
mov dword [ebx + 0x38], eax
je 0x4415e0
movzx edx, word [ebx + 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
movzx edx, word [ebx + 0x20]
cmp eax, edx
jne 0x4415d0
mov edx, dword [ebx + 0x38]
mov byte [edx + eax], 0
add esp, 0x40
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
movzx ecx, cx
add ecx, 1
mov dword [esp], ecx
call fcn.0053e9a0
test eax, eax
mov dword [ebx + 0x30], eax
je 0x4415e0
movzx edx, word [ebx + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
movzx edx, word [ebx + 0x1c]
cmp eax, edx
jne 0x4415d0
mov edx, dword [ebx + 0x30]
mov byte [edx + eax], 0
movzx edx, word [ebx + 0x1e]
test dx, dx
je 0x4414b0
movzx edx, dx
add edx, 1
mov dword [esp], edx
call fcn.0053e9a0
test eax, eax
mov dword [ebx + 0x34], eax
je 0x4415e0
movzx edx, word [ebx + 0x1e]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
movzx edx, word [ebx + 0x1e]
cmp eax, edx
jne 0x4415d0
mov edx, dword [ebx + 0x34]
mov byte [edx + eax], 0
jmp 0x4414b0
mov dword [esp + 8], str.Whoops:_didnt_find_expected_signature_n
mov dword [esp + 4], 0x5604a8
mov dword [esp], 3
call fcn.00482510
lea esi, [esi]
add esp, 0x40
mov edi, 0x80000000
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
mov edi, 0xfffffff4
jmp 0x4414bb