Function at 0x402cc0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x421948]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 4]
push ebx
xor ebx, ebx
cmp eax, 5
mov dword [esp + 0xc], ecx
mov dword [ecx], ebx
jb 0x402eee
jne 0x402d0e
mov eax, dword [ecx + 8]
sub eax, ebx
je 0x402eee
dec eax
je 0x402ed8
dec eax
jne 0x402d0e
cmp dword [ecx + 0xc], 0xece
jb 0x402eee
cmp dword [ecx + 0x10], ebx
jbe 0x402eee
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
add ecx, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
je 0x402fa3
cmp esi, 0xffffffff
je 0x402fa3
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0x8000
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebx
jb 0x402f87
cmp edi, 0x200000
ja 0x402f87
lea eax, [edi + 0x400]
push ebp
push eax
call fcn.004115e7
lea ecx, [edi + 2]
mov edx, ecx
mov ebp, eax
add esp, 4
shr ecx, 2
xor eax, eax
push ebx
mov edi, ebp
rep stosd dword es:[edi], eax
push ebx
mov ecx, edx
push ebx
and ecx, 3
push esi
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x402f61
mov edi, dword [esp + 0x10]
push ebx
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x402f61
cmp dword [esp + 0x14], edi
jne 0x402f61
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0x63
mov byte [esp + 0x26], al
mov byte [esp + 0x34], al
mov al, 0xcc
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], al
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], al
mov al, 0x90
mov dl, 0x5c
mov cl, 0x65
sub edi, 0x400
mov byte [esp + 0x40], al
mov byte [esp + 0x41], al
mov byte [esp + 0x42], al
mov byte [esp + 0x43], al
mov byte [esp + 0x1c], dl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x44
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x76
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x25], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x52
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x61
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], 0x73
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x41
mov byte [esp + 0x33], bl
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x64
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov dword [esp + 0x10], edi
mov eax, ebx
je 0x402eb9
lea esp, [esp]
mov cl, byte [eax + ebp]
cmp cl, 0x5c
lea esi, [eax + ebp]
jne 0x402eb4
cmp byte [eax + ebp + 1], bl
jne 0x402eb4
mov ecx, 0xa
lea edi, [esp + 0x1c]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x402eff
mov edi, dword [esp + 0x10]
inc eax
cmp eax, edi
jb 0x402e90
push ebp
call fcn.004115ec
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 0xfffffffb
pop ebx
mov ecx, dword [esp + 0x34]
call fcn.00404630
add esp, 0x38
ret
cmp dword [ecx + 0xc], 0xa28
jb 0x402eee
cmp dword [ecx + 0x10], 0x884
jae 0x402d0e
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x34]
call fcn.00404630
add esp, 0x38
ret
cmp eax, ebx
je 0x402eb9
cmp eax, dword [esp + 0x10]
jae 0x402eb9
mov cl, byte [eax + ebp + 0x7f]
add eax, 0x80
cmp cl, bl
jne 0x402f42
cmp byte [eax + ebp + 4], 0xb8
jne 0x402f42
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov esi, dword [eax + ebp]
push ebp
call fcn.004115ec
add esp, 4
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
call fcn.00404630
add esp, 0x38
ret
push ebp
call fcn.004115ec
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 0xfffffffa
pop ebx
mov ecx, dword [esp + 0x34]
call fcn.00404630
add esp, 0x38
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.004115ec
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
mov ecx, dword [esp + 0x34]
call fcn.00404630
add esp, 0x38
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov ecx, dword [esp + 0x34]
call fcn.00404630
add esp, 0x38
ret
mov ecx, dword [esp + 0x3c]
pop esi
mov eax, 0xfffffffe
pop ebx
call fcn.00404630
add esp, 0x38
ret