Function at 0x413534
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x413a54
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [ebp - 0x1c], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00410cf0
test eax, eax
je 0x41359e
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x413a2e
cmp dword [0x42bad0], 0
je 0x4135c9
mov eax, dword [0x43be9c]
or byte [eax + 0x30], 0x80
xor eax, eax
mov dword [0x42bb40], eax
mov eax, dword [ebp - 0xc]
call fcn.00416534
cmp dword [0x42bacc], 0
jne 0x4135e1
cmp dword [0x42bb7c], 4
jl 0x4135e1
inc dword [0x42bb7c]
mov dword [0x42bacc], 0xffffffff
mov dword [0x42bb24], 0xffffffff
push 0
lea eax, [ebp - 0x20]
push eax
push 0x10200
push 0x41b790
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_ReadFile_1
push 0x400
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x42bae0]
push eax
call sub.kernel32.dll_RtlMoveMemory
push pe_nt_image_headers32
push 0x41b790
lea eax, [ebp - 0x128]
push eax
call sub.kernel32.dll_RtlMoveMemory
mov edx, 0x41b790
mov eax, dword [ebp - 0xc]
call fcn.00410b18
cmp byte [0x41b88f], 0
je 0x413657
cmp byte [0x41b7be], 0
jne 0x4136b5
mov eax, 0x400
call fcn.004024ec
mov ebx, eax
mov eax, 0x21
call fcn.004024ec
mov esi, eax
push 0x400
push ebx
call sub.kernel32.dll_RtlZeroMemory
push 0x3ff
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.comdlg32.dll_GetFileTitleA
push 0x21
push esi
call sub.kernel32.dll_RtlZeroMemory
push 0x20
push ebx
push esi
call sub.kernel32.dll_RtlMoveMemory
push 0x20
push esi
push 0x41b7be
call sub.kernel32.dll_RtlMoveMemory
mov eax, ebx
call fcn.0040250c
mov eax, esi
call fcn.0040250c
cmp byte [0x41b88f], 2
jne 0x41380a
mov ax, word [ebp - 0x88]
test ax, ax
jbe 0x413786
cmp ax, 0x2710
jae 0x413786
cmp byte [ebp - 0x89], 0
jbe 0x413786
cmp byte [ebp - 0x89], 0xd
jae 0x413786
cmp byte [ebp - 0x8a], 0
jbe 0x413786
cmp byte [ebp - 0x8a], 0x20
jae 0x413786
movzx edx, ax
lea eax, [ebp - 0x28]
mov ecx, 4
call fcn.004070e0
push 4
lea eax, [ebp - 0x28]
push eax
push 0x41b82e
call sub.kernel32.dll_RtlMoveMemory
mov byte [0x41b832], 0x2f
xor edx, edx
mov dl, byte [ebp - 0x89]
lea eax, [ebp - 0x28]
mov ecx, 2
call fcn.004070e0
push 2
lea eax, [ebp - 0x28]
push eax
push 0x41b833
call sub.kernel32.dll_RtlMoveMemory
mov byte [0x41b835], 0x2f
xor edx, edx
mov dl, byte [ebp - 0x8a]
lea eax, [ebp - 0x28]
mov ecx, 2
call fcn.004070e0
push 2
lea eax, [ebp - 0x28]
push eax
push 0x41b836
call sub.kernel32.dll_RtlMoveMemory
jmp 0x41378d
mov byte [0x41b82e], 0
movzx ebx, word [ebp - 0x7f]
cmp ebx, 0x3e7
jle 0x41379e
mov ebx, 0x3e7
test ebx, ebx
je 0x4137c1
lea eax, [ebp - 0x28]
mov ecx, 3
mov edx, ebx
call fcn.004070e0
push 3
lea eax, [ebp - 0x28]
push eax
push 0x41b839
call sub.kernel32.dll_RtlMoveMemory
mov ebx, dword [ebp - 0x7c]
and ebx, 0xffffff
cmp ebx, 0x1869f
jle 0x4137d7
mov ebx, 0x1869f
test ebx, ebx
je 0x4137fa
lea eax, [ebp - 0x28]
mov ecx, 5
mov edx, ebx
call fcn.004070e0
push 5
lea eax, [ebp - 0x28]
push eax
push 0x41b83c
call sub.kernel32.dll_RtlMoveMemory
push 0x22
lea eax, [ebp - 0x78]
push eax
push 0x41b841
call sub.kernel32.dll_RtlMoveMemory
mov eax, 0x41b7be
mov ebx, 0xa3
mov dl, byte [eax]
test dl, dl
jbe 0x41381f
cmp dl, 0x20
jb 0x413824
cmp dl, 0x7f
jne 0x413827
mov byte [eax], 0x20
inc eax
dec ebx
jne 0x413814
lea eax, [ebp - 0x12c]
mov edx, 0x41b839
mov ecx, 3
call fcn.00403a3c
mov eax, dword [ebp - 0x12c]
xor edx, edx
call fcn.0040745c
mov dword [0x41b887], eax
lea eax, [ebp - 0x130]
mov edx, 0x41b83c
mov ecx, 5
call fcn.00403a3c
mov eax, dword [ebp - 0x130]
xor edx, edx
call fcn.0040745c
mov dword [0x41b88b], eax
mov ecx, 0x400
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00410be8
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov edi, dword [ebp - 0x18]
test edi, edi
jle 0x4138ce
mov ebx, 1
mov eax, dword [ebp - 4]
cmp byte [eax + ebx - 1], 0
je 0x4138ce
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407320
test eax, eax
je 0x4138b7
mov esi, ebx
mov cl, 0x2e
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407294
test eax, eax
je 0x4138ca
mov dword [ebp - 0x14], ebx
inc ebx
dec edi
jne 0x41389d
push 0x400
mov eax, dword [0x42bae4]
push eax
call sub.kernel32.dll_RtlZeroMemory
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x42bae4]
push eax
call sub.kernel32.dll_RtlMoveMemory
push 0x400
mov eax, dword [0x42bae8]
push eax
call sub.kernel32.dll_RtlZeroMemory
mov ebx, dword [ebp - 0x18]
sub ebx, esi
test ebx, ebx
jle 0x413919
push ebx
mov eax, dword [ebp - 4]
add eax, esi
push eax
mov eax, dword [0x42bae8]
push eax
call sub.kernel32.dll_RtlMoveMemory
push ebp
mov edx, 0x413a6c
mov eax, dword [ebp - 0x14]
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413a78
mov eax, dword [ebp - 0x14]
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413a84
mov eax, dword [ebp - 0x14]
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413a94
mov eax, dword [ebp - 0x14]
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413aa4
mov eax, esi
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413ab8
mov eax, esi
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413acc
mov eax, esi
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
push ebp
mov edx, 0x413ae4
mov eax, esi
call fcn.00413494
pop ecx
test eax, eax
jne 0x4139b5
xor eax, eax
jmp 0x4139b7
mov al, 1
neg al
sbb ebx, ebx
test ebx, ebx
je 0x4139d8
mov eax, dword [ebp - 8]
call fcn.00403c3c
mov edx, eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0xc]
call fcn.00411da4
test eax, eax
jne 0x4139e5
push 0
call dword [0x41b77c]
mov dword [0x43bea0], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00414760
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415dec
cmp dword [0x42bad0], 0
je 0x413a0f
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004142b4
jmp 0x413a22
cmp dword [ebp - 0x10], 0
je 0x413a22
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00413c20
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413a5b
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.004038f4
lea eax, [ebp - 8]
call fcn.004038d0
ret