Function at 0x413a20
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x10c8
call fcn.0041b4d8
sub esp, eax
mov eax, dword [esp + eax]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov ebx, eax
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x42670f
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call ebp
lea edx, [eax + eax + 2]
sub esp, 0x18
mov esi, eax
mov eax, edx
mov dword [esp + 0x2c], edx
call fcn.004118b0
mov dword [esp + 0x14], esi
mov edi, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x42670f
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call ebp
xor eax, eax
sub esp, 0x18
mov edx, dword [esp + 0x2c]
mov word [edi + edx - 2], ax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call ebp
sub esp, 0x18
lea ecx, [eax + eax + 2]
mov dword [esp + 0x30], eax
mov eax, ecx
mov dword [esp + 0x2c], ecx
call fcn.004118b0
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], 0x30
mov esi, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 8], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call ebp
xor edx, edx
sub esp, 0x18
mov ecx, dword [esp + 0x2c]
mov word [esi + ecx - 2], dx
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebp, eax
test eax, eax
je 0x414230
mov dword [esp + 8], 2
mov esi, dword [0x44c3d0]
mov ecx, dword [0x44c3d4]
mov eax, dword [0x44c3dc]
mov dword [esp], ebp
mov dword [esp + 4], 0
mov edx, dword [0x44c3d8]
mov byte [esp + 0xc0], 0
mov edi, dword [esp + 0xc0]
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xcc], edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edx
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], ebp
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ebp
call sub.msvcrt.dll_fseek
mov dword [esp], ebp
mov edi, eax
call sub.msvcrt.dll_ftell
test edi, edi
mov esi, eax
setne al
test esi, esi
je 0x413beb
test al, al
jne 0x414100
test esi, esi
jns 0x413cc0
test al, al
je 0x413cc0
mov eax, 0x10
xor edi, edi
mov dword [esp + 0xc0], str.ftell_failed
mov dword [esp + 0xc4], 0xc
mov dword [esp + 0xc8], 1
mov dword [esp + 0xcc], 0
call fcn.00412150
mov edx, dword [esp + 0xc0]
mov esi, eax
lea ecx, [eax + 0xc]
mov dword [eax], edx
mov edx, dword [esp + 0xc4]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xc8]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xcc]
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [esp + edx + 0x64], edi
mov dword [esp + edx + 0x68], 0
add edx, 8
cmp edx, 0x18
jb 0x413c61
mov dword [esp], ebp
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 3
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], ecx
call sub.msvcrt.dll_fclose
mov byte [esp + 0x64], 1
mov eax, dword [esp + 0x64]
mov dword [ebx], eax
mov eax, dword [esp + 0x68]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x74]
jmp 0x413e09
mov dword [esp], ebp
call sub.msvcrt.dll_rewind
mov eax, dword [0x44c3dc]
mov dword [esp + 0x78], esi
mov byte [esp + 0xc0], 0
mov edi, dword [0x44c3d0]
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xc0]
mov ecx, dword [0x44c3d4]
mov edx, dword [0x44c3d8]
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], eax
mov eax, dword [0x44c3dc]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xcc], edx
mov dword [esp + 0xd4], esi
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], eax
test esi, esi
je 0x413e55
mov eax, 0
cmovns eax, esi
mov dword [esp + 0x2c], eax
call fcn.0040dd00
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 0x30], eax
call sub.msvcrt.dll_fread
test eax, eax
jne 0x414180
test esi, esi
jle 0x414180
lea edi, [esp + 0xc0]
mov ecx, 0xb
mov dword [esp + 0x94], str.fread_failed
rep stosd dword es:[edi], eax
mov eax, 0x10
mov dword [esp + 0x98], 0xc
mov dword [esp + 0x9c], 1
mov dword [esp + 0xa0], 0
call fcn.00412150
mov esi, eax
mov eax, dword [esp + 0x94]
mov dword [esi], eax
mov eax, dword [esp + 0x98]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x9c]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xa0]
mov dword [esi + 0xc], eax
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov byte [esp + 0xc0], 1
mov edx, dword [esp + 0xc0]
lea eax, [esi + 0xc]
mov dword [ebx + 4], esi
mov dword [ebx], edx
mov dword [ebx + 8], 3
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0xd4]
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 0xd8]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0xdc]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0xe0]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0xe4]
mov dword [ebx + 0x24], eax
mov eax, dword [esp + 0xe8]
mov dword [ebx + 0x28], eax
add esp, 0x10cc
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
mov ecx, 0x400
lea edi, [esp + 0xc0]
rep stosd dword es:[edi], eax
mov eax, 0x1000
mov edi, 1
call fcn.0040dd00
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x2c], 0x1000
lea eax, [esp + 0xc0]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
jle 0x413f40
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0xc0]
mov dword [esp + 0x80], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x88], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x8c], ecx
mov ecx, eax
lea eax, [esp + 0x7c]
call fcn.004126d0
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x90]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x38], eax
jmp 0x413e90
mov dword [esp], ebp
call sub.msvcrt.dll_feof
test eax, eax
jne 0x414048
mov dword [esp], ebp
mov dword [esp + 0x3c], eax
call sub.msvcrt.dll_ferror
mov edx, dword [esp + 0x3c]
test eax, eax
je 0x413e90
mov eax, 0x10
mov dword [esp + 0x2c], edx
lea esi, [esp + 0x94]
mov dword [esp + 0x94], str.file_read_error
mov edi, esi
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x9c], 1
mov dword [esp + 0xa0], 0
call fcn.00412150
mov ecx, 0xb
mov edx, eax
mov eax, dword [esp + 0x94]
mov dword [edx], eax
mov eax, dword [esp + 0x98]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x9c]
mov dword [edx + 8], eax
mov eax, dword [esp + 0xa0]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x2c]
rep stosd dword es:[edi], eax
mov dword [esp], ebp
mov dword [esp + 0x98], edx
mov dword [esp + 0xa0], edx
add edx, 0xc
mov dword [esp + 0x9c], 3
mov dword [esp + 0xa4], edx
call sub.msvcrt.dll_fclose
mov byte [esp + 0x94], 1
mov eax, dword [esp + 0x94]
mov dword [ebx], eax
mov eax, dword [esp + 0x98]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x9c]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0xa0]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0xa4]
jmp 0x413e09
mov edx, 1
mov eax, 1
call fcn.0040db90
mov eax, dword [0x44c3d0]
mov dword [esp], ebp
mov dword [esp + 0xc4], eax
mov eax, dword [0x44c3d4]
mov dword [esp + 0xc8], eax
mov eax, dword [0x44c3d8]
mov dword [esp + 0xcc], eax
mov eax, dword [0x44c3dc]
mov dword [esp + 0xd0], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x18], esi
mov byte [esp + 0xc0], 0
mov edx, dword [esp + 0xc0]
mov dword [ebx + 0x14], ecx
mov esi, dword [esp + 0x2c]
and eax, 0xfffffffe
mov dword [ebx], edx
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0x30]
mov dword [ebx + 0x24], eax
mov eax, ebx
mov dword [ebx + 4], edx
mov edx, dword [esp + 0xc8]
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 8], edx
mov edx, dword [esp + 0xcc]
mov dword [ebx + 0x20], esi
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0xd0]
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x10], edx
add esp, 0x10cc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x10
xor edi, edi
mov dword [esp + 0xc0], str.fseek_failed
mov dword [esp + 0xc4], 0xc
mov dword [esp + 0xc8], 1
mov dword [esp + 0xcc], 0
call fcn.00412150
mov edx, dword [esp + 0xc0]
mov esi, eax
lea ecx, [eax + 0xc]
mov dword [eax], edx
mov edx, dword [esp + 0xc4]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xc8]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xcc]
mov dword [eax + 0xc], edx
xor edx, edx
mov dword [esp + edx + 0x64], edi
mov dword [esp + edx + 0x68], 0
add edx, 8
cmp edx, 0x18
jb 0x414166
jmp 0x413c75
cmp eax, esi
mov edi, esi
mov dword [esp], ebp
cmovle edi, eax
mov eax, dword [0x44c3d0]
mov dword [esp + 0xc4], eax
mov eax, dword [0x44c3d4]
mov dword [esp + 0xc8], eax
mov eax, dword [0x44c3d8]
mov dword [esp + 0xcc], eax
mov eax, dword [0x44c3dc]
mov dword [esp + 0xd0], eax
call sub.msvcrt.dll_fclose
mov byte [esp + 0xc0], 0
mov eax, dword [esp + 0xc0]
mov dword [ebx + 0x18], 0
mov dword [ebx], eax
mov eax, dword [esp + 0xc4]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 4], eax
mov eax, dword [esp + 0xc8]
mov dword [ebx + 0x24], 0
mov dword [ebx + 8], eax
mov eax, dword [esp + 0xcc]
mov dword [ebx + 0x28], 1
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0xd0]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x20], eax
add esp, 0x10cc
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0xdc]
mov ecx, 9
lea edx, [esp + 0xc0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0xc0], str.failed_to_open_file__
mov dword [esp + 0xc4], 0x15
mov dword [esp + 0xc8], 1
mov dword [esp + 0xcc], 0xfe10
mov dword [esp + 0xd0], str.C:Program_FilesWindows_DefenderrTrackerUI.sys
mov dword [esp + 0xd4], 0x30
mov dword [esp + 0xd8], 1
mov dword [esp + 0xe0], 0x42675b
mov dword [esp + 0xe4], 1
mov dword [esp + 0xe8], 1
call fcn.00411640
mov edx, dword [esp + 0x84]
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x2c], edx
call dword [sym.imp.msvcrt.dll__errno]
test esi, esi
mov edx, dword [esp + 0x2c]
mov ebp, dword [eax]
je 0x414370
mov eax, 0x10
mov dword [esp + 0x9c], edx
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], esi
mov dword [esp + 0xa0], ebp
call fcn.00412150
xor ecx, ecx
mov edx, eax
mov eax, dword [esp + 0x94]
mov dword [edx], eax
mov eax, dword [esp + 0x98]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x9c]
mov dword [edx + 8], eax
mov eax, dword [esp + 0xa0]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp + eax + 0x4c], ecx
mov dword [esp + eax + 0x50], 0
add eax, 8
cmp eax, 0x18
jb 0x414339
mov byte [esp + 0x4c], 1
mov ecx, dword [esp + 0x4c]
lea eax, [edx + 0xc]
mov dword [ebx + 4], edx
mov dword [ebx], ecx
mov dword [ebx + 8], 3
mov dword [ebx + 0xc], edx
jmp 0x413e09
mov dword [esp], ebp
call sub.msvcrt.dll_strerror
mov edi, eax
test eax, eax
je 0x41438f
mov dword [esp], eax
call sub.msvcrt.dll_strlen
xor edx, edx
mov esi, eax
jmp 0x4142e6
mov edx, 1
mov edi, 0x4264d7
jmp 0x4142e6