Function at 0x411edc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov ecx, 0x104
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x411eea
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 4]
cmp byte [edi], 0x22
jne 0x411f28
jmp 0x411f19
mov edi, dword [ebp - 4]
mov esi, edi
add esi, 1
mov dword [ebp - 4], esi
mov esi, dword [ebp - 4]
mov bl, byte [esi]
mov byte [edi], bl
mov edi, dword [ebp - 4]
cmp byte [edi + 1], 0x22
jne 0x411f07
mov edi, dword [ebp - 4]
mov byte [edi], 0
push 0x2e
push dword [ebp + 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0
je 0x4121c0
push str..lnk
push dword [ebp - 4]
call sub.CRTDLL.DLL__stricmp
add esp, 8
cmp eax, 0
jne 0x4121c0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x408], eax
cmp eax, 0xffffffff
je 0x4121c0
push 0
push dword [ebp - 0x408]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0x40c], eax
cmp eax, 0xffffffff
je 0x4121b5
cmp dword [ebp - 0x40c], 0
je 0x4121b5
push 0
lea edi, [ebp - 0x410]
push edi
push 0x4c
lea edi, [ebp - 0x404]
push edi
push dword [ebp - 0x408]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
je 0x4121b5
cmp dword [ebp - 0x410], 0x4c
jne 0x4121b5
cmp byte [ebp - 0x404], 0x4c
jne 0x4121b5
cmp byte [ebp - 0x403], 0
jne 0x4121b5
cmp byte [ebp - 0x402], 0
jne 0x4121b5
cmp byte [ebp - 0x401], 0
jne 0x4121b5
cmp byte [ebp - 0x400], 1
jne 0x4121b5
cmp byte [ebp - 0x3ff], 0x14
jne 0x4121b5
cmp byte [ebp - 0x3fe], 2
jne 0x4121b5
cmp byte [ebp - 0x3fd], 0
jne 0x4121b5
cmp byte [ebp - 0x3fc], 0
jne 0x4121b5
cmp byte [ebp - 0x3fb], 0
jne 0x4121b5
cmp byte [ebp - 0x3fa], 0
jne 0x4121b5
cmp byte [ebp - 0x3f9], 0
jne 0x4121b5
movzx ebx, byte [ebp - 0x3f8]
cmp ebx, 0xc0
jne 0x4121b5
cmp byte [ebp - 0x3f7], 0
jne 0x4121b5
cmp byte [ebp - 0x3f6], 0
jne 0x4121b5
cmp byte [ebp - 0x3f5], 0
jne 0x4121b5
cmp byte [ebp - 0x3f4], 0
jne 0x4121b5
cmp byte [ebp - 0x3f3], 0
jne 0x4121b5
cmp byte [ebp - 0x3f2], 0
jne 0x4121b5
cmp byte [ebp - 0x3f1], 0x46
jne 0x4121b5
test byte [ebp - 0x3f0], 1
je 0x412140
push 0
lea edi, [ebp - 0x410]
push edi
push 2
lea edi, [ebp - 0x404]
push edi
push dword [ebp - 0x408]
call sub.KERNEL32.dll_ReadFile
push 0
lea edi, [ebp - 0x410]
push edi
movzx edi, byte [ebp - 0x403]
shl edi, 8
movzx ebx, byte [ebp - 0x404]
add edi, ebx
push edi
lea edi, [ebp - 0x404]
push edi
push dword [ebp - 0x408]
call sub.KERNEL32.dll_ReadFile
push 0
lea edi, [ebp - 0x410]
push edi
push 0x14
lea edi, [ebp - 0x404]
push edi
push dword [ebp - 0x408]
call sub.KERNEL32.dll_ReadFile
push 0
lea edi, [ebp - 0x410]
push edi
movzx edi, byte [ebp - 0x3f3]
shl edi, 8
movzx ebx, byte [ebp - 0x3f4]
add edi, ebx
sub edi, 0x14
push edi
lea edi, [ebp - 0x404]
push edi
push dword [ebp - 0x408]
call sub.KERNEL32.dll_ReadFile
push 0
lea edi, [ebp - 0x410]
push edi
push 0xff
push dword [ebp + 8]
push dword [ebp - 0x408]
call sub.KERNEL32.dll_ReadFile
mov edi, dword [ebp + 8]
mov byte [edi + 0xff], 0
push dword [ebp - 0x408]
call sub.KERNEL32.dll_CloseHandle
pop edi
pop esi
pop ebx
leave
ret