Function at 0x4038c8
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push 0x40
push 0x4058b0
call fcn.004057f8
mov eax, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x4c], eax
xor edi, edi
mov dword [0x40ee5c], edi
mov dword [0x40ac00], edi
mov dword [0x40ac04], 1
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov esi, dword [0x406014]
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
mov ecx, eax
xor eax, eax
cmp ebx, ecx
sete al
mov dword [0x40ee50], eax
je 0x4039e1
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov dword [0x406bd0], eax
cmp eax, 0xffffffff
jne 0x403948
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x403c7d
cmp dword [0x406bd0], edi
jne 0x403959
cmp dword [ebp - 0x3c], edi
je 0x403c7d
cmp dword [ebp - 0x3c], edi
jne 0x4039d7
test dword [0x406bd0], 0x80000000
jne 0x4039d7
push edi
push edi
push edi
push 2
push edi
push ebx
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x40399b
push dword [0x40abe4]
push 0xd
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0xc
jmp 0x403c7d
xor eax, eax
push eax
push eax
push eax
push 4
push edi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [0x40ed40], eax
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor edi, edi
cmp dword [0x40ed40], edi
je 0x4039d7
mov esi, dword [0x40ed40]
mov dword [0x406014], esi
mov dword [0x40ac08], 1
jmp 0x4039e1
mov dword [0x40ee5c], 1
cmp dword [0x40ee50], 0
jne 0x4039f3
cmp dword [0x40ee5c], 0
je 0x403a16
mov esi, 0x406bdc
mov dword [0x406014], esi
push edi
push 0x406bd0
push 0x2000
push esi
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
mov dword [0x40ac08], eax
test dword [0x4067c0], 0x100
je 0x403a51
mov edi, esi
mov ebx, dword [0x406bd0]
jmp 0x403a4c
mov al, byte [edi]
cmp al, 0x20
jae 0x403a4b
movzx eax, al
push eax
push 0x401224
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x403c5a
inc edi
sub ebx, 1
jne 0x403a2c
mov ebx, dword [0x40ac00]
cmp dword [0x40ac08], 0
je 0x403a68
mov edi, dword [0x406bd0]
jmp 0x403a6b
or edi, 0xffffffff
mov ecx, dword [ebp - 0x30]
lea eax, [edi + ecx]
test eax, eax
jle 0x403c5a
cmp dword [0x40ee50], 0
jne 0x403aa5
cmp dword [0x40ee5c], 0
jne 0x403aa5
sub edi, ecx
add edi, esi
and dword [0x406bd0], 0
mov dword [0x40ac08], 1
jmp 0x403b6c
test edi, edi
jg 0x403abd
mov word [esi], 0xa0d
add esi, 2
mov edi, esi
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x403b6c
lea ecx, [esi - 1]
add ecx, edi
call fcn.00404a55
mov dword [ebp - 0x30], eax
sub edi, eax
add edi, esi
mov ecx, dword [ebp - 0x34]
xor ecx, 1
mov ecx, dword [ecx*4 + 0x406014]
mov dword [ebp - 0x44], ecx
mov esi, ecx
push eax
push edi
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
mov ecx, dword [ebp - 0x30]
add esi, ecx
cmp ecx, 0x1000
jle 0x403b55
mov edx, 0x2000
cmp ecx, edx
jl 0x403b50
add ebx, ecx
mov dword [0x40ac00], ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x44]
push edx
mov edx, esi
mov ecx, dword [ebp - 0x38]
call fcn.00403036
push 0xa
lea eax, [ebp - 0x2c]
push eax
push dword [0x40ac04]
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [0x40abe4]
push 0x12
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0x10
jmp 0x403b6c
sub edx, ecx
push edx
jmp 0x403b62
mov eax, 0x2000
sub eax, ecx
and eax, 0xfffffc00
push eax
mov edx, esi
mov ecx, dword [ebp - 0x38]
call fcn.00403036
and dword [ebp - 4], 0
mov ebx, dword [ebp - 0x48]
push ebx
push edi
mov eax, dword [ebp - 0x34]
push dword [eax*4 + 0x406014]
mov ecx, dword [ebp - 0x40]
call dword [0x40f1e4]
call dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0xfffffffe
test eax, eax
je 0x403bfe
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403b9e
sub ecx, edx
push 0
push ecx
push ebx
mov esi, dword [0x406004]
mov ecx, esi
call dword [0x40f1e4]
call esi
push 0
push 2
push 0x40122c
mov esi, dword [0x406004]
mov ecx, esi
call dword [0x40f1e4]
call esi
cmp dword [0x40ee50], 0
jne 0x403c7d
cmp dword [0x40ee5c], 0
jne 0x403c7d
mov eax, dword [0x40ed40]
test eax, eax
je 0x403c7d
push eax
jmp 0x403c77
mov eax, dword [ebp - 0x34]
sub edi, dword [eax*4 + 0x406014]
mov ebx, dword [0x40ac00]
add ebx, edi
mov dword [0x40ac00], ebx
xor eax, 1
mov dword [ebp - 0x34], eax
jmp 0x403a57
cmp dword [0x40ee50], 0
jne 0x403c7d
cmp dword [0x40ee5c], 0
jne 0x403c7d
mov esi, dword [0x40ed40]
test esi, esi
je 0x403c7d
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4