Function at 0x407bca
Capabilities:
Get file size
Get system information on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x45b480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea ecx, [ebp - 0x58]
call fcn.0040460f
test eax, eax
je 0x407bf4
or eax, 0xffffffff
jmp 0x407ea1
xor ebx, ebx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], ebx
call fcn.00404657
test eax, eax
jne 0x407e8f
push ebx
push 0x3c
lea eax, [ebp - 0x48]
push eax
push 0x5a
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jne 0x407e8f
cmp dword [ebp - 0x38], 1
jne 0x407c8d
call fcn.00411179
mov esi, eax
test esi, esi
je 0x407eb0
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x407c7e
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], ebx
push eax
push esi
push dword [ebp - 0x84]
call dword [sym.imp.OLEAUT32.dll_VarBstrCmp]
test eax, eax
js 0x407c78
push dword [ebp - 0x84]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [ebp - 0x88]
jmp 0x407c84
push eax
jmp 0x407eb5
mov edi, dword [ebp - 0x84]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x407cad
cmp dword [ebp - 0x38], 2
jne 0x407e8f
push str.EFIMicrosoftBootBootStat.dat
lea ecx, [ebp - 0x84]
call fcn.00411c77
mov edi, dword [ebp - 0x84]
push ebx
push 0x2000000
push 3
push ebx
push 5
pop eax
push eax
push SysReAllocStringLen
push edi
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or ebx, 0xffffffff
mov dword [ebp - 0xa4], esi
cmp esi, ebx
je 0x407e82
lea eax, [ebp - 0x90]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x407e82
cmp dword [ebp - 0x8c], 0
jg 0x407e82
jl 0x407d14
cmp dword [ebp - 0x90], 0x1000000
ja 0x407e82
push dword [ebp - 0x90]
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x88], eax
pop ecx
test eax, eax
je 0x407e82
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x44e77c
push eax
mov dword [ebp - 0x14], eax
call fcn.00411b06
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x407d60
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x90]
push dword [ebp - 0x88]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407e7a
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xa0], eax
jne 0x407e7a
mov eax, dword [ebp - 0x88]
xor esi, esi
mov ecx, esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x94], esi
mov edx, dword [eax]
dec edx
sub edx, 1
je 0x407dfe
sub edx, 1
je 0x407dde
sub edx, 1
jne 0x407e66
mov edx, dword [ebp - 0x90]
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, eax
call fcn.00407b73
jmp 0x407e1d
mov edx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x9c]
push ecx
push dword [eax + 0xc]
mov ecx, eax
call fcn.00407b1b
push 5
pop edx
mov dword [ebp - 0x84], edx
jmp 0x407e1d
mov edx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0x9c]
push ecx
push dword [eax + 0xc]
mov ecx, eax
call fcn.00407b1b
mov dword [ebp - 0x84], 2
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x9c]
sub eax, ecx
sar eax, 2
jmp 0x407e39
mov edx, dword [ecx + eax*4]
cmp dword [edx + 0x24], 0x11
je 0x407e40
dec eax
cmp eax, ebx
jne 0x407e30
jmp 0x407e66
mov eax, dword [edx + esi*4 + 0x28]
lea ecx, [ebp - 0x58]
cmp eax, dword [ecx + esi*4]
mov ecx, dword [ebp - 0x9c]
jne 0x407e66
inc esi
cmp esi, 4
jne 0x407e40
mov eax, dword [ebp - 0x84]
xor ebx, ebx
cmp dword [edx + 0x38], eax
sete bl
test ecx, ecx
je 0x407e7a
mov edx, dword [ebp - 0x94]
sub edx, ecx
and edx, 0xfffffffc
call fcn.00401abc
lea ecx, [ebp - 0x80]
call fcn.00411ad6
lea ecx, [ebp - 0xa4]
call fcn.00411dea
jmp 0x407e98
mov edi, dword [ebp - 0x84]
or ebx, 0xffffffff
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004488a4
leave
ret
push 0x8007000e
call fcn.00402310
int3