Function at 0x420af0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x47fae0]
xor edi, edi
mov dword [ebp - 8], edi
call fcn.00432eb4
mov esi, eax
call fcn.00420fe6
cmp dword [ebp + 8], edi
jne 0x420b1c
mov dword [ebp + 8], 0x43803f
push edi
mov ebx, pe_nt_image_headers32
push ebx
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
mov dword [esi + 0xc], edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call edi
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x420b81
push 0
push ebx
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call edi
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x420b71
push 0
push ebx
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call edi
mov dword [esi], eax
cmp dword [esi], 0xffffffff
mov dword [esi + 0xc], 1
je 0x420d4f
xor edi, edi
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [esi + 0x18], edi
cmp ebx, 3
jl 0x420bdd
push edi
lea eax, [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0xc], 3
jne 0x420bd2
push 3
lea eax, [ebp - 4]
push 0x4380c0
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x420bd2
mov dword [esi + 0x18], 0xfde9
sub ebx, 3
jmp 0x420bdd
push edi
push edi
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp ebx, edi
jle 0x420c0b
lea eax, [ebx + 2]
push eax
push edi
push dword [0x47e414]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x10], eax
cmp eax, edi
je 0x420c0b
push edi
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [ebp - 0xc]
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x420d80
xor ecx, ecx
mov word [eax + ebx], cx
mov edi, dword [esi + 0x10]
lea eax, [edi + ebx]
mov dword [esi + 0x14], eax
mov bl, 0xa
cmp edi, eax
jae 0x420d80
mov al, byte [edi]
cmp al, 0x20
je 0x420c39
cmp al, 9
jne 0x420c3c
inc edi
jmp 0x420c2f
mov al, byte [edi]
cmp al, 0x3b
jne 0x420c7d
inc edi
cmp byte [edi], 0x20
jne 0x420c49
inc edi
push edi
push 2
push dword [ebp - 8]
lea eax, [esi + 0x1c]
push eax
call fcn.00420ac0
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x420c73
mov al, byte [edi]
cmp al, bl
je 0x420d36
cmp al, 0xd
je 0x420d36
inc edi
cmp byte [edi], 0
jne 0x420c60
jmp 0x420d36
cmp al, 0x5b
jne 0x420ccc
inc edi
push edi
push 1
push dword [ebp - 8]
lea eax, [esi + 0x1c]
push eax
call fcn.00420ac0
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x420ca8
mov al, byte [edi]
cmp al, 0x5d
je 0x420cb6
cmp al, bl
je 0x420cad
cmp al, 0xd
je 0x420cad
inc edi
cmp byte [edi], 0
jne 0x420c99
cmp byte [edi], 0x5d
jne 0x420d36
mov byte [edi], 0
jmp 0x420cc3
cmp al, bl
je 0x420d39
cmp al, 0xd
je 0x420d3a
inc edi
mov al, byte [edi]
test al, al
jne 0x420cbb
jmp 0x420d3a
cmp al, bl
je 0x420d3a
cmp al, 0xd
je 0x420d3a
mov edx, edi
jmp 0x420ce7
cmp al, 0x3d
je 0x420ceb
cmp al, 0xd
je 0x420ceb
cmp al, bl
je 0x420ceb
inc edi
mov al, byte [edi]
test al, al
jne 0x420cd8
lea eax, [edi - 1]
jmp 0x420cfd
mov cl, byte [eax]
cmp cl, 0x20
je 0x420cfc
cmp cl, 9
jne 0x420d01
dec eax
cmp eax, edx
ja 0x420cf0
mov byte [eax + 1], 0
inc edi
mov al, byte [edi]
cmp al, 0x20
je 0x420d05
cmp al, 9
je 0x420d05
push edi
push edx
push dword [ebp - 8]
lea eax, [esi + 0x1c]
push eax
call fcn.00420ac0
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x420d31
mov al, byte [edi]
cmp al, bl
je 0x420d36
cmp al, 0xd
je 0x420d36
inc edi
cmp byte [edi], 0
jne 0x420d26
mov byte [edi], 0
inc edi
mov al, byte [edi]
cmp al, bl
je 0x420d39
cmp al, 0xd
je 0x420d39
cmp edi, dword [esi + 0x14]
jb 0x420c2f
jmp 0x420d80
push dword [ebp + 8]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 0x18], edi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push edi
push dword [0x47e414]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 4], eax
cmp eax, edi
je 0x420d80
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [esi]
pop edi
pop esi
pop ebx
leave
ret 4