Function at 0x406d11
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
call fcn.00406cc0
cmp dword [ebp + 8], ebx
jne 0x406d2f
lea eax, [0x4568a4]
mov dword [ebp + 8], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [0x45df44], eax
cmp eax, 0xffffffff
jne 0x406d72
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [0x45df44], eax
cmp dword [0x45df44], 0xffffffff
je 0x406f8e
push 0
push dword [0x45df44]
call sub.KERNEL32.dll_GetFileSize
mov edi, eax
and dword [0x45df58], 0
cmp edi, 3
jl 0x406dee
push 0
lea eax, [ebp - 8]
push eax
push 3
lea eax, [ebp - 0xb]
push eax
push dword [0x45df44]
call sub.KERNEL32.dll_ReadFile
cmp dword [ebp - 8], 3
jne 0x406ddd
push 3
push 0x4568a0
lea eax, [ebp - 0xb]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
or eax, eax
jne 0x406ddd
mov dword [0x45df58], 0xfde9
sub edi, 3
jmp 0x406dee
push 0
push 0
push 0
push dword [0x45df44]
call sub.KERNEL32.dll_SetFilePointer
or edi, edi
jle 0x406e29
mov eax, edi
add eax, 2
push eax
push 0
push dword [0x45d298]
call sub.KERNEL32.dll_HeapAlloc
mov dword [0x45df50], eax
or eax, eax
je 0x406e29
push 0
lea eax, [ebp - 8]
push eax
push edi
push dword [0x45df50]
push dword [0x45df44]
call sub.KERNEL32.dll_ReadFile
mov edi, dword [ebp - 8]
cmp dword [0x45df50], 0
je 0x406fcb
mov eax, dword [0x45df50]
mov word [eax + edi], 0
mov eax, edi
add eax, dword [0x45df50]
mov dword [0x45df54], eax
mov edi, dword [0x45df50]
jmp 0x406f80
inc edi
mov al, byte [edi]
cmp al, 0x20
je 0x406e59
cmp al, 9
je 0x406e59
cmp byte [edi], 0x3b
jne 0x406ea0
inc edi
cmp byte [edi], 0x20
jne 0x406e70
inc edi
push edi
push 2
push ebx
push 0x45df5c
call fcn.00406cd0
add esp, 0x10
mov ebx, eax
jmp 0x406e86
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x406e97
cmp eax, 0xa
je 0x406e97
cmp eax, 0xd
jne 0x406e85
mov byte [edi], 0
inc edi
jmp 0x406f76
cmp byte [edi], 0x5b
jne 0x406efa
inc edi
push edi
push 1
push ebx
push 0x45df5c
call fcn.00406cd0
add esp, 0x10
mov ebx, eax
jmp 0x406ebc
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x406ed2
cmp eax, 0x5d
je 0x406ed2
cmp eax, 0xa
je 0x406ed2
cmp eax, 0xd
jne 0x406ebb
cmp byte [edi], 0x5d
jne 0x406ef4
mov byte [edi], 0
inc edi
jmp 0x406ede
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x406eef
cmp eax, 0xa
je 0x406eef
cmp eax, 0xd
jne 0x406edd
jmp 0x406f76
mov byte [edi], 0
inc edi
jmp 0x406f76
mov al, byte [edi]
cmp al, 0xa
je 0x406f76
cmp al, 0xd
je 0x406f76
mov dword [ebp - 4], edi
jmp 0x406f0a
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x406f20
cmp eax, 0x3d
je 0x406f20
cmp eax, 0xd
je 0x406f20
cmp eax, 0xa
jne 0x406f09
mov esi, edi
dec esi
jmp 0x406f26
dec esi
cmp esi, dword [ebp - 4]
jbe 0x406f35
mov al, byte [esi]
cmp al, 0x20
je 0x406f25
cmp al, 9
je 0x406f25
inc esi
mov byte [esi], 0
inc edi
jmp 0x406f3d
inc edi
mov al, byte [edi]
cmp al, 0x20
je 0x406f3c
cmp al, 9
je 0x406f3c
push edi
push dword [ebp - 4]
push ebx
push 0x45df5c
call fcn.00406cd0
add esp, 0x10
mov ebx, eax
jmp 0x406f5e
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x406f6f
cmp eax, 0xa
je 0x406f6f
cmp eax, 0xd
jne 0x406f5d
mov byte [edi], 0
inc edi
jmp 0x406f76
inc edi
mov al, byte [edi]
cmp al, 0xa
je 0x406f75
cmp al, 0xd
je 0x406f75
cmp edi, dword [0x45df54]
jb 0x406e5a
jmp 0x406fcb
and dword [0x45df44], 0
and dword [0x45df58], 0
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
mov edx, eax
inc edx
push edx
push 0
push dword [0x45d298]
call sub.KERNEL32.dll_HeapAlloc
mov dword [0x45df48], eax
or eax, eax
je 0x406fcb
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov eax, dword [0x45df44]
pop edi
pop esi
pop ebx
leave
ret 4