Function at 0x411150
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x34
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
call fcn.00416600
mov edi, dword [ebp + 8]
mov dword [eax], 0x41b595
mov dword [eax + 4], edi
xor eax, eax
cmp esi, 0xffffffff
setne al
mov dword [esp + 8], esi
mov dword [esp + 4], str.got__p_n
mov dword [esp], eax
call fcn.004077c0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov edi, eax
call fcn.00416600
mov edx, dword [ebp + 8]
mov dword [eax], 0x41b595
mov dword [eax + 4], edx
mov eax, ebx
shr eax, 0x10
mov dword [ebp - 0x20], eax
je 0x4113e8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x411227
mov eax, ebx
call fcn.00406dc0
mov dword [esp + 0x10], edi
mov ecx, dword [ebp - 0x14]
mov dword [esp + 8], eax
xor eax, eax
cmp edi, ecx
mov dword [esp + 0xc], ecx
sete al
mov dword [esp + 4], str.expected_file__s_size__ld__got__ld_n
mov dword [esp], eax
call fcn.004077c0
test edi, edi
jne 0x411268
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [esp + 0x10], 0
mov edx, eax
lea eax, [ebp - 0x10]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], edx
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_ReadFile]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
sub esp, 0x14
call fcn.00406da0
mov eax, dword [ebp - 0x10]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x34]
cmp eax, edi
mov dword [esp + 0x10], ecx
mov edx, dword [ebp - 0x24]
sete cl
mov dword [esp + 8], eax
xor eax, eax
test edx, edx
mov dword [esp + 0xc], edx
setne al
mov dword [esp + 4], str.Read__ld__got__d__error__ld._n
and eax, ecx
mov dword [esp], eax
call fcn.004077c0
mov eax, dword [ebp + 8]
call fcn.00406da0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x411460
shr eax, 0x10
mov edi, dword [ebp - 0x10]
je 0x411400
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov dword [ebp - 0x24], str._invalid_
sub esp, 8
test eax, eax
jne 0x411328
mov eax, dword [ebp - 0x1c]
mov edx, edi
call fcn.00406bc0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
shr eax, 0x10
je 0x411440
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov edi, dword [ebp - 0x18]
mov dword [esp], edi
mov edi, str._invalid_
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
sub esp, 8
test eax, eax
jne 0x411360
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00406bc0
mov edi, eax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x411420
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x411391
mov eax, ebx
call fcn.00406dc0
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov dword [esp + 8], eax
mov ebx, dword [ebp - 0x1c]
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
mov edx, dword [ebp - 0x24]
mov dword [esp + 0xc], edi
test eax, eax
mov dword [esp + 0x10], edx
sete al
mov edx, dword [ebp - 0x20]
movzx eax, al
mov dword [esp + 4], str.expected_file__s_contents__s__got__s_n
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.004077c0
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_free]
jmp 0x411251
movzx eax, bx
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00406a40
jmp 0x411227
movzx eax, word [ebp - 0x1c]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00406a40
mov dword [ebp - 0x24], eax
jmp 0x411328
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call fcn.00406a40
mov edx, eax
jmp 0x411391
movzx eax, word [ebp - 0x18]
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00406a40
mov edi, eax
jmp 0x411360
mov dword [ebp - 0x24], str._null_
jmp 0x411328