Function at 0x423c01
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
or esi, 0xffffffff
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x466148]
push esi
push ebx
mov dword [ebp - 8], ecx
call fcn.00401525
mov ecx, dword [0x463c78]
push 1
push ebx
push esi
push 0x457f24
call fcn.00401525
mov edi, dword [ebp + 8]
mov byte [ebp - 1], bl
mov byte [ebp - 0xc], bl
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
jmp 0x423cbb
inc esi
movsx eax, byte [esi]
push eax
call fcn.00441cd7
cmp eax, 0x43
pop ecx
je 0x423ca9
cmp eax, 0x4d
je 0x423c6a
cmp eax, 0x54
jne 0x423cad
mov byte [ebp - 1], 1
jmp 0x423cad
lea eax, [esi + 1]
push eax
call fcn.00401058
cmp edx, ebx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
ja 0x423e49
jb 0x423c8f
cmp eax, 0x40000000
ja 0x423e49
push 0x457bf0
push esi
call fcn.00438ef0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x423e49
dec esi
jmp 0x423cad
mov byte [ebp - 0xc], 1
cmp byte [esi], bl
mov edi, esi
je 0x423cbb
lea edi, [esi + 1]
cmp byte [edi], bl
je 0x423cbb
inc edi
push edi
call fcn.00401a9c
mov esi, eax
cmp byte [esi], 0x2a
pop ecx
je 0x423c4a
push ebx
push 0x8000000
push 3
push ebx
push 3
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [ebp + 8], edx
je 0x423e49
cmp byte [ebp - 0xc], bl
je 0x423d17
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0xf]
cmp cl, 2
jne 0x423d04
mov eax, dword [eax + 4]
mov cl, byte [eax + 0xf]
cmp cl, 4
jne 0x423d17
mov ecx, dword [ebp - 0x14]
push edx
call fcn.004426ac
jmp 0x423e4c
push edx
call fcn.00437f0c
mov edi, eax
and eax, edx
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 0x14], edx
je 0x423e41
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
and ecx, eax
cmp ecx, 0xffffffff
jne 0x423d51
cmp edx, ebx
ja 0x423e41
jb 0x423d51
cmp edi, 0x40000000
ja 0x423e41
cmp eax, edx
ja 0x423d62
jb 0x423d5c
cmp dword [ebp - 0x20], edi
jae 0x423d62
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x463c78]
xor esi, esi
inc esi
push esi
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
mov eax, edi
or eax, dword [ebp - 0x14]
jne 0x423d84
mov ebx, esi
jmp 0x423d94
mov ecx, dword [ebp - 8]
push ebx
push esi
push edi
push ebx
call fcn.00401525
cmp eax, esi
je 0x423da4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
jmp 0x423e4c
mov ecx, dword [ebp - 8]
call fcn.00401c84
push ebx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp edi, ebx
je 0x423e13
cmp byte [ebp - 1], bl
mov eax, dword [ebp - 0x10]
mov byte [eax + esi], bl
je 0x423df3
push ebx
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push 0x45b4f0
push 0x45ad24
push esi
call fcn.0041c523
add esp, 0x20
cmp byte [ebp - 0xc], bl
je 0x423dfe
mov esi, dword [ebp - 0x10]
dec esi
jmp 0x423e07
push esi
call fcn.00453b00
pop ecx
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.00401c69
mov dword [eax], esi
jmp 0x423e34
mov ecx, dword [ebp - 8]
mov byte [esi], bl
call fcn.00401c69
push 1
push ebx
push 0xffffffffffffffff
mov dword [eax], ebx
mov ecx, dword [0x463c78]
push 0x457f24
call fcn.00401525
push dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.0041d4c8
jmp 0x423e4c
xor ebx, ebx
inc ebx
jmp 0x423d94
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4