Function at 0x200027d5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 8], edi
je 0x20002965
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push esi
push 0xfffffffffffffffc
push edi
call ebx
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
lea eax, [ebp - 0xc]
push 4
push eax
push edi
call esi
cmp dword [ebp - 0xc], 0xbc42dafc
je 0x20002849
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x20002965
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
xor edi, edi
push 2
push edi
push 0xfffffffffffffff8
push dword [ebp + 8]
call ebx
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 4]
push 4
push eax
push dword [ebp + 8]
call esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x200028a0
push 2
push edi
neg ecx
push ecx
push dword [ebp + 8]
call ebx
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, edi
pop ecx
mov dword [ebp - 0x10], eax
jne 0x200028a5
push dword [ebp + 8]
jmp 0x2000283e
lea ecx, [ebp - 8]
push edi
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff8
push ecx
push eax
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 4]
mov ebx, 0x8c
add eax, 0xfffffff8
xor edx, edx
mov ecx, ebx
div ecx
test eax, eax
jle 0x200028ff
mov eax, dword [ebp - 0x10]
mov esi, 0x20005030
mov dword [ebp - 0x14], eax
push esi
call sub.MSVCRT.dll_strlen
push eax
push esi
push ebx
push dword [ebp - 0x14]
call fcn.20002bed
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
add dword [ebp - 0x14], ebx
add esp, 0x14
inc edi
cmp edi, eax
jl 0x200028d7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x18], esi
cmp dword [eax], 0xffffffff
jne 0x20002936
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
div ebx
jmp 0x200029f8
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
push 9
lea eax, [ebp - 0x2c]
push esi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xfffffff8
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, eax
add esp, 0x10
cmp ecx, esi
mov dword [ebp - 0x20], ecx
jne 0x2000296c
xor eax, eax
jmp 0x200029f8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], esi
add eax, 0xfffffff8
xor edx, edx
mov esi, ebx
div esi
test eax, eax
jle 0x200029d9
mov esi, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov dword [ebp - 0x1c], esi
lea eax, [esi + 0x84]
push 8
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 0x14
test eax, eax
jne 0x200029bd
mov edi, dword [ebp + 8]
inc dword [ebp - 0x18]
add dword [ebp + 8], ebx
push 0x23
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
xor edx, edx
add eax, 0xfffffff8
mov ecx, ebx
div ecx
mov esi, dword [ebp - 0x1c]
inc dword [ebp - 0x14]
add esi, ebx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x14], eax
jl 0x20002988
mov ecx, ecx
mov eax, eax
nop
mov edi, edi
nop
mov edi, edi
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp + 0xc]
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret