Function at 0x428010
Capabilities:
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
mov dword [esp + 0x40], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428056
push 0x50a3e8
call fcn.0042d550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.004a1d88
add esp, 4
mov dword [esp + 0x20], 0
mov edi, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x10], edi
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x4280a8
push 0x50a400
call fcn.0042d550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 8], 0
mov eax, dword [edi + 0x3c]
je 0x4280db
lea edx, [edi + 0x88]
mov ecx, 0x20b
add edx, eax
cmp word [eax + edi + 0x18], cx
je 0x428102
push 0x50a40c
call fcn.0042d550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x78]
mov ecx, 0x10b
add edx, eax
cmp word [eax + edi + 0x18], cx
je 0x428102
push 0x50a420
call fcn.0042d550
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edx]
mov ecx, edi
call fcn.00427f90
mov edx, dword [edi + eax + 0x1c]
mov ecx, edi
lea esi, [edi + eax]
mov dword [esp + 0x14], esi
call fcn.00427f90
mov edx, dword [esi + 0x20]
mov ecx, edi
mov ebx, eax
mov dword [esp + 0x2c], 0
call fcn.00427f90
mov edx, dword [esi + 0x24]
mov edi, eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], 0
call fcn.00427f90
mov edx, dword [esp + 0x14]
mov esi, eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], 0
mov edx, dword [edx + 0xc]
call fcn.00427f90
add eax, dword [esp + 0x10]
push eax
push str._nDll_Name:__s_n
call fcn.0042d550
mov ecx, dword [esp + 0x18]
add esp, 8
add edi, ecx
mov dword [esp + 0x28], edi
lea eax, [ebx + ecx]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esi + ecx]
xor esi, esi
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x14], esi
jbe 0x42804d
nop word [eax + eax]
mov ecx, dword [ebx + 0x18]
xor edx, edx
test ecx, ecx
je 0x4281c1
nop dword [eax]
movzx eax, word [eax + edx*2]
cmp esi, eax
je 0x42820b
mov eax, dword [esp + 0x18]
inc edx
cmp edx, ecx
jb 0x4281b0
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + esi*8]
or eax, dword [ecx + esi*8 + 4]
je 0x4281ee
push 0x50a464
call fcn.0042d550
mov eax, dword [ebx + 0x10]
add esp, 4
add eax, esi
push eax
push 0x50a474
call fcn.0042d550
add esp, 8
push 0x509144
call fcn.0042d550
inc esi
add esp, 4
cmp esi, dword [ebx + 0x14]
jae 0x42804d
mov eax, dword [esp + 0x18]
jmp 0x4281a0
mov ebx, dword [esp + 0x10]
mov ecx, ebx
mov edx, dword [edi + edx*8]
call fcn.00427f90
mov edx, dword [esp + 0x24]
lea edi, [ebx + eax]
mov ecx, edi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x428242
test bl, bl
je 0x42823e
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x428242
add ecx, 2
add edx, 2
test al, al
jne 0x428222
xor eax, eax
jmp 0x428247
sbb eax, eax
or eax, 1
test eax, eax
je 0x428276
push edi
push 0x50a444
call fcn.0042d550
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x10]
add eax, esi
push eax
push 0x50a454
call fcn.0042d550
mov edi, dword [esp + 0x38]
add esp, 0x10
jmp 0x4281ee
mov eax, dword [esp + 0x1c]
pop edi
mov eax, dword [eax + esi*8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret