Function at 0x440210
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [0x4d3d98]
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov dword [esp + 0x1c], ecx
mov ecx, ebx
push 0
mov dword [esp + 0x34], ebx
call fcn.00475930
mov edi, dword [ebp + 8]
or eax, 0xffffffff
mov dword [esp + 0x14], eax
or edx, 0xffffffff
mov eax, dword [0x4ce8c8]
mov byte [esp + 0xe], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x20], edx
mov ebx, dword [eax + 0xfc]
and ebx, 0x7fffffff
mov dword [esp + 0x2c], ebx
nop dword [eax]
mov esi, edi
movzx eax, word [esi]
cmp eax, 0x20
je 0x44027f
cmp eax, 9
jne 0x440284
add esi, 2
jmp 0x440272
cmp eax, 0x2a
jne 0x44036e
movzx ebx, word [esi + 2]
lea edi, [esi + 2]
test ebx, 0xffffff80
je 0x4402a0
xor ecx, ecx
jmp 0x4402ad
push 2
push ebx
call fcn.00491ac4
add esp, 8
mov ecx, eax
mov eax, ebx
and eax, 0xffffffdf
test ecx, ecx
cmove eax, ebx
add eax, 0xffffffbd
cmp eax, 0x11
ja case.0x4402c6.68
movzx eax, byte [eax + 0x4407c8]
jmp dword [eax*4 + 0x4407b4]
mov byte [esp + 0x18], 1
jmp case.0x4402c6.68
add esi, 4
mov ecx, esi
call fcn.0040ded0
test al, al
mov edx, 0xa
mov eax, 0x10
cmovne edx, eax
push edx
push 0
push esi
call fcn.00492e4a
add esp, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov edx, 0x4bfc0c
mov ecx, edi
call fcn.0040ab90
mov edi, eax
test edi, edi
je 0x44034e
sub edi, 2
jmp case.0x4402c6.68
lea eax, [esi + 4]
push eax
call fcn.00492a15
add esp, 4
mov dword [esp + 0x2c], eax
jmp 0x440301
mov byte [esp + 0xe], 1
cmp word [edi], 0
je 0x440270
add edi, 2
cmp word [edi], 0
je 0x440270
add edi, 2
jmp 0x440270
mov eax, dword [0x4ce8c8]
mov ecx, dword [esp + 0x10]
push 1
mov dword [eax + 0x30], 0x57
call fcn.0042cfe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x28], ebx
cmp ebx, 0xffffffff
jne 0x4403b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4ce8c8]
push 1
mov dword [ecx + 0x30], eax
mov ecx, dword [esp + 0x14]
call fcn.0042cfe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x34]
xorps xmm0, xmm0
push eax
push ebx
movq qword [esp + 0x38], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x30], esi
cmp esi, 0xffffffff
jne 0x4403e5
call edi
test eax, eax
jne 0x4403f2
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov eax, esi
and eax, ecx
cmp eax, 0xffffffff
jne 0x44044f
call edi
mov ecx, dword [0x4ce8c8]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4ce8c8]
cmp byte [eax + 0x108], 0
jne 0x440431
mov ecx, dword [0x4d166c]
push 1
push 0
push 0xffffffffffffffff
push 0x4bf994
call fcn.00475930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
push 0x4ac22c
push 0
push 0x4bf994
call fcn.0042cf00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + 0x20]
cmp ecx, edx
jb 0x440465
mov eax, dword [esp + 0x14]
ja 0x440461
cmp esi, eax
jbe 0x440465
mov esi, eax
mov ecx, edx
test ecx, ecx
jne 0x440795
cmp esi, 0xfffffffd
ja 0x440795
mov eax, esi
or eax, ecx
jne 0x4404a3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4ce8c8]
mov ecx, dword [esp + 0x10]
push 0
mov dword [eax + 0x30], 0
call fcn.0042cfe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0x18], 0
mov ebx, dword [esp + 0x24]
je 0x440573
mov al, byte [ebx + 0x17]
test al, al
jne 0x4404bf
mov eax, dword [ebx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
je 0x440573
push 0
mov ecx, esi
mov byte [esp + 0x13], 1
shr ecx, 1
mov eax, esi
and eax, 1
push 1
add ecx, eax
push ecx
push 0
mov ecx, ebx
call fcn.00475930
cmp eax, 1
jne 0x4405a2
push 0
push eax
mov ecx, ebx
call fcn.00401c20
mov edi, eax
test edi, edi
je 0x4405a2
push 0
lea eax, [esp + 0x20]
push eax
push esi
mov esi, dword [esp + 0x34]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4ce8c8]
push esi
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x440742
cmp byte [esp + 0x18], 0
jne 0x4406ca
mov ecx, dword [esp + 0x1c]
cmp ecx, 3
jb 0x4405b8
cmp byte [edi], 0xef
jne 0x4405b8
cmp byte [edi + 1], 0xbb
jne 0x4405b8
cmp byte [edi + 2], 0xbf
jne 0x4405b8
lea eax, [ecx - 3]
push 0xfde9
push eax
lea eax, [edi + 3]
push eax
jmp 0x44062f
lea eax, [esi + 2]
mov byte [esp + 0xf], 0
push eax
call fcn.0048f3be
mov edi, eax
add esp, 4
test edi, edi
jne 0x440502
mov ecx, dword [esp + 0x10]
push 0x4ac22c
push eax
push str.Out_of_memory.
call fcn.0042d1e0
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 2
jb 0x44061f
cmp byte [edi], 0xff
jne 0x44061f
cmp byte [edi + 1], 0xfe
jne 0x44061f
mov dl, 1
test dl, dl
lea eax, [ecx - 2]
push 0
cmove eax, ecx
mov ecx, ebx
shr eax, 1
test dl, dl
push 1
push eax
lea eax, [edi + 2]
cmove eax, edi
push eax
call fcn.00475930
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x14], eax
push edi
call fcn.004914e4
add esp, 4
mov ecx, ebx
push 0
push 1
call fcn.00401c20
cmp byte [esp + 0xe], 0
mov edi, eax
je 0x440764
cmp byte [ebx + 0x17], 0
jne 0x440640
mov esi, dword [ebx + 0xc]
jmp 0x440642
mov eax, dword [esp + 0x2c]
xor dl, dl
cmp eax, 0x4b0
je 0x4405ca
push eax
push ecx
push edi
mov ecx, ebx
call fcn.00476520
test eax, eax
jne 0x4405f3
mov dword [esp + 0x14], eax
jmp 0x4405f3
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x44065a
test byte [esi + 0x15], 8
je 0x440655
mov ecx, esi
call fcn.00401b40
lea eax, [esi + 0xc]
jmp 0x44065f
mov eax, 0x4d5644
mov eax, dword [eax]
mov edx, 0x4c6034
shr eax, 1
mov ecx, edi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 1
push 0x4c6ab4
call fcn.004734a0
add esp, 0x18
cmp byte [ebx + 0x17], 0
jne 0x440693
mov esi, dword [ebx + 0xc]
jmp 0x440695
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x4406b8
test byte [esi + 0x15], 8
je 0x4406a8
mov ecx, esi
call fcn.00401b40
mov eax, dword [esp + 0x2c]
add esi, 0xc
add eax, eax
mov dword [esi], eax
jmp 0x440764
mov eax, dword [esp + 0x2c]
mov esi, 0x4d5644
add eax, eax
mov dword [esi], eax
jmp 0x440764
mov al, byte [ebx + 0x17]
test al, al
jne 0x4406d7
mov eax, dword [ebx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
jne 0x440718
mov edx, dword [esp + 0x1c]
mov ecx, edi
call fcn.00475760
push edi
mov esi, eax
call fcn.004914e4
add esp, 4
cmp esi, 1
jne 0x4405ad
mov ecx, dword [0x4d166c]
push esi
push 0
push 0xffffffffffffffff
push 0x4ac300
call fcn.00475930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test al, 1
je 0x44072d
mov byte [eax + edi], 0
inc eax
mov dword [esp + 0x2c], eax
xor ecx, ecx
mov word [eax + edi], cx
mov ecx, ebx
call fcn.00413b00
mov ecx, dword [esp + 0x2c]
mov dword [eax], ecx
jmp 0x440764
xor eax, eax
mov ecx, ebx
mov word [edi], ax
call fcn.00413b00
cmp byte [esp + 0xf], 0
mov dword [eax], 0
jne 0x440764
push edi
call fcn.004914e4
add esp, 4
push dword [esp + 0x18]
mov ecx, ebx
call fcn.00413c00
test eax, eax
je 0x4405ad
cmp dword [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
sete al
movzx eax, al
push eax
call fcn.0042cfe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x10]
push 0x4ac22c
push 0
push str.Out_of_memory.
call fcn.0042d1e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4