Function at 0x42100c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
cmp esi, ebx
jne 0x421052
push 0x46eb40
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xeed
push str.NTCOPY
call fcn.0044dc85
add esp, 0x10
xor eax, eax
jmp 0x4211ff
push 3
push 0x46c3a0
push esi
call fcn.00450c23
add esp, 0xc
test eax, eax
jne 0x42106c
inc eax
jmp 0x4211ff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x46c02c
push esi
call fcn.00442cad
push eax
call fcn.00420498
test eax, eax
jne 0x4210ae
push esi
push 0x46eb14
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xef6
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
jmp 0x42104b
cmp dword [ebp - 0x14], ebx
jne 0x4210c7
push esi
push str.SnapshotChain__s_is_incomplete
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xefc
jmp 0x42109f
mov eax, dword [ebp - 0x18]
cmp eax, 1
jle 0x4210dc
dec eax
push eax
push esi
call fcn.0041fd96
mov dword [ebp - 0x14], eax
jmp 0x4210df
mov dword [ebp - 0x14], esi
push edi
push ebx
push ebx
push 3
push ebx
push 1
push Ordinal_2
push dword [ebp - 0x14]
call dword [sym.imp.___total_physical_size__lu_MB_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x421124
push dword [ebp - 0x14]
push str.Cant_open__s
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xf0c
push str.NTCOPY
call fcn.0044dc85
add esp, 0x14
xor eax, eax
jmp 0x4211fe
push 2
push ebx
push ebx
push edi
call fcn.0044df99
push 1
push 0xffffffffffffffff
push 0xfffffffffffffff8
push edi
call fcn.0044df99
mov esi, dword [sym.imp.___total_physical_size__lu_MB_ReadFile]
push ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 8
lea eax, [ebp - 0x2c]
push eax
push edi
mov dword [ebp - 0x18], edx
call esi
test eax, eax
jne 0x421171
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str.ReadFile_failed_at_offset:__I64d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xf18
jmp 0x4211c1
cmp dword [ebp - 0x28], 0x45524e53
jne 0x4211e0
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
add eax, 0x14
neg eax
push 1
adc ecx, ebx
neg ecx
push ecx
push eax
push edi
call fcn.0044df99
push ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push edi
mov dword [ebp - 0x18], edx
call esi
test eax, eax
jne 0x4211d0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push str.ReadFile_failed_at_offset:__I64d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0xf25
push str.NTCOPY
call fcn.0044dc85
add esp, 0x18
jmp 0x4211e0
cmp dword [ebp - 0x28], 0x45524e53
jne 0x4211e0
mov dword [ebp - 0x20], 1
push edi
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
cmp dword [ebp - 0x20], ebx
jne 0x4211fb
push dword [ebp - 0x14]
push str._s_does_not_contain_a_valid_end_record_n_n
call fcn.00450f5c
pop ecx
pop ecx
mov eax, dword [ebp - 0x20]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 4