Function at 0x460d90
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov dword [esp + 0x24], ecx
mov ecx, dword [0x4fc2a8]
push 0
mov dword [esp + 0x24], ecx
call fcn.004b4bf0
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
or eax, 0xffffffff
mov esi, dword [ebp + 8]
or edx, 0xffffffff
mov dword [esp + 0x2c], eax
mov eax, dword [0x4f8174]
mov byte [esp + 0x12], 0
mov byte [esp + 0x11], 0
mov dword [esp + 0x30], edx
mov eax, dword [eax + 0xfc]
and eax, 0x7fffffff
mov dword [esp + 0x28], eax
nop dword [eax]
mov eax, esi
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x460dff
cmp ecx, 9
jne 0x460e04
add eax, 2
jmp 0x460df2
cmp ecx, 0x2a
jne 0x460f78
movzx edi, word [eax + 2]
lea esi, [eax + 2]
test edi, 0xffffff80
jne 0x460e2b
push 2
push edi
call ebx
add esp, 8
test eax, eax
je 0x460e2b
and edi, 0xffffffdf
add edi, 0xffffffbd
cmp edi, 0x11
ja case.0x460e3e.68
movzx eax, byte [edi + 0x4615c8]
jmp dword [eax*4 + 0x4615b4]
mov byte [esp + 0x11], 1
jmp case.0x460e3e.68
lea ecx, [esi + 2]
call fcn.0044f7c0
movzx ecx, word [esi]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
test cx, cx
je 0x460ea1
mov edi, ecx
nop dword [eax]
mov ecx, 0x4e5614
mov edx, 0x20
nop word [eax + eax]
cmp di, dx
je 0x460ed9
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x460e80
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x460e70
mov eax, dword [0x4f8174]
mov dword [eax + 0x30], 0x57
test byte [eax + 0x100], 1
jne 0x460f5a
mov ecx, dword [0x4faa64]
push 1
push 0
push 0xffffffffffffffff
push 0x4e513c
call fcn.004b4bf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add esi, 0xfffffffe
jmp case.0x460e3e.68
lea eax, [esi + 2]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
movzx ecx, word [esi]
add esp, 4
mov dword [esp + 0x28], eax
test cx, cx
je 0x460ea1
mov edi, ecx
nop dword [eax]
mov eax, 0x4e5614
mov edx, 0x20
nop word [eax + eax]
cmp di, dx
je 0x460ed9
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x460f10
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x460f00
jmp 0x460ea1
mov byte [esp + 0x12], 1
cmp word [esi], 0
je 0x460df0
add esi, 2
cmp word [esi], 0
je 0x460df0
add esi, 2
jmp 0x460df0
mov ecx, dword [esp + 0x18]
push 0x4cec30
push 0
push 0x4e513c
call fcn.0044d640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0x8000000
push 3
push 0
push 3
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x460fb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4f8174]
test byte [ecx + 0x100], 1
mov dword [ecx + 0x30], eax
jmp 0x460eb4
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 0
push eax
push ebx
mov dword [esp + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x40], esi
cmp esi, 0xffffffff
jne 0x460fea
call edi
test eax, eax
jne 0x460ff7
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov eax, esi
and eax, ecx
cmp eax, 0xffffffff
jne 0x461013
call edi
mov ecx, dword [0x4f8174]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f8174]
jmp 0x460ead
mov edx, dword [esp + 0x30]
cmp ecx, edx
jb 0x461029
mov eax, dword [esp + 0x2c]
ja 0x461025
cmp esi, eax
jbe 0x461029
mov esi, eax
mov ecx, edx
test ecx, ecx
jne 0x461594
cmp esi, 0xfffffffd
ja 0x461594
mov eax, esi
or eax, ecx
jne 0x461072
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4f8174]
mov dword [eax + 0x30], 0
mov ecx, dword [0x4faa64]
push 1
push 0
push 0xffffffffffffffff
push 0x4cecf8
call fcn.004b4bf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esp + 0x11], 0
je 0x461153
mov edi, dword [esp + 0x14]
mov al, byte [edi + 0x17]
test al, al
jne 0x46108e
mov eax, dword [edi + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
je 0x461153
push 0
mov ecx, esi
mov byte [esp + 0x17], 1
shr ecx, 1
mov eax, esi
and eax, 1
push 1
add ecx, eax
push ecx
push 0
mov ecx, edi
call fcn.004b4bf0
cmp eax, 1
jne 0x461183
push 0
push eax
mov ecx, edi
call fcn.00401690
mov edi, eax
test edi, edi
je 0x461183
push 0
lea eax, [esp + 0x38]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4f8174]
push ebx
mov dword [ecx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4614f0
cmp byte [esp + 0x11], 0
jne 0x46146b
mov ecx, dword [esp + 0x34]
cmp ecx, 3
jb 0x461195
cmp byte [edi], 0xef
jne 0x461195
cmp byte [edi + 1], 0xbb
jne 0x461195
cmp byte [edi + 2], 0xbf
jne 0x461195
mov ebx, dword [esp + 0x14]
lea eax, [ecx - 3]
push 0xfde9
push eax
lea eax, [edi + 3]
mov ecx, ebx
push eax
call fcn.004b5800
test eax, eax
jne 0x4611fc
mov dword [esp + 0x2c], eax
jmp 0x4611fc
lea eax, [esi + 2]
mov byte [esp + 0x13], 0
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4610d1
mov ecx, dword [esp + 0x18]
push 0x4cec30
push eax
push 0x4e2be8
call fcn.0044dae0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 2
jb 0x4611ac
cmp byte [edi], 0xff
jne 0x4611ac
cmp byte [edi + 1], 0xfe
jne 0x4611ac
mov bl, 1
lea edx, [edi + 2]
jmp 0x4611d3
mov eax, dword [esp + 0x28]
xor bl, bl
cmp eax, 0x4b0
je 0x4611d1
mov ebx, dword [esp + 0x14]
push eax
push ecx
push edi
mov ecx, ebx
call fcn.004b5800
test eax, eax
jne 0x4611f8
mov dword [esp + 0x2c], eax
jmp 0x4611f8
mov edx, edi
lea eax, [ecx - 2]
test bl, bl
mov ebx, dword [esp + 0x14]
push 0
cmove eax, ecx
mov ecx, ebx
push 1
shr eax, 1
push eax
push edx
call fcn.004b4bf0
neg eax
sbb eax, eax
and eax, esi
mov dword [esp + 0x2c], eax
test edi, edi
je 0x461206
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0
push 1
mov ecx, ebx
call fcn.00401690
cmp byte [esp + 0x12], 0
mov ecx, eax
mov dword [esp + 0x24], ecx
je 0x461539
cmp byte [ebx + 0x17], 0
jne 0x46122d
mov esi, dword [ebx + 0xc]
jmp 0x46122f
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x46124b
test byte [esi + 0x15], 8
je 0x461246
mov ecx, esi
call fcn.004014f0
mov ecx, dword [esp + 0x24]
lea edi, [esi + 0xc]
jmp 0x461250
mov edi, 0x4feb88
mov edi, dword [edi]
xor ebx, ebx
or eax, 0xffffffff
shr edi, 1
xor esi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ebx
cmp word [ecx], bx
je 0x461429
cmp edi, 0x1388
jb 0x4613d5
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
push 0x4ed4b4
push ecx
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 8
mov dword [esp + 0x3c], eax
test eax, eax
je 0x46133e
mov edx, dword [esp + 0x20]
sub eax, edx
dec dword [esp + 0x1c]
inc dword [esp + 0x28]
sar eax, 1
mov dword [esp + 0x40], eax
lea ecx, [eax + esi]
mov dword [esp + 0x38], ecx
inc ecx
cmp ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
jb 0x461304
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
sar eax, 1
push eax
mov eax, dword [esp + 0x3c]
inc eax
push eax
push edi
push ecx
or ecx, 0xffffffff
call fcn.004b11d0
mov dword [esp + 0x40], eax
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 0x18
test eax, eax
je 0x46137c
mov edx, dword [esp + 0x20]
mov ebx, eax
mov eax, dword [esp + 0x40]
test eax, eax
je 0x46131c
add eax, eax
push eax
push edx
lea eax, [ebx + esi*2]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [esp + 0x44]
add esp, 0xc
mov ecx, dword [esp + 0x3c]
mov eax, 0xa
mov word [ebx + esi*2], ax
add ecx, 4
inc esi
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x1c], 0
jne 0x461280
jmp 0x461342
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x28], 0
je 0x461429
mov eax, ecx
sub eax, dword [esp + 0x24]
sar eax, 1
sub edi, eax
je 0x4613ad
lea eax, [edi + esi]
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x30]
jb 0x461398
lea eax, [eax*2 + 2]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
test eax, eax
jne 0x461392
test ebx, ebx
je 0x46138b
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call eax
add esp, 4
xor esi, esi
jmp 0x46142b
mov ecx, dword [esp + 0x20]
mov ebx, eax
lea eax, [edi + edi]
push eax
push ecx
lea eax, [ebx + esi*2]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [esp + 0x4c]
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2], ax
lea eax, [esi*2 + 2]
push eax
push ebx
push dword [esp + 0x2c]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0xc
push ebx
call eax
add esp, 4
jmp 0x46142b
mov ebx, ecx
nop word [eax + eax]
push 0x4ed4b4
push ebx
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x461429
mov ecx, esi
lea ebx, [esi + 2]
sub ecx, dword [esp + 0x24]
mov eax, edi
sar ecx, 1
sub eax, ecx
lea eax, [eax*2 - 2]
push eax
lea eax, [esi + 4]
push eax
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, 0xa
dec edi
mov word [esi], ax
sub dword [esp + 0x1c], 1
jne 0x4613e0
mov esi, edi
mov ebx, dword [esp + 0x14]
cmp byte [ebx + 0x17], 0
jne 0x46143a
mov edi, dword [ebx + 0xc]
jmp 0x46143c
mov edi, ebx
cmp byte [edi + 0x17], 1
jne 0x46145c
test byte [edi + 0x15], 8
je 0x46144f
mov ecx, edi
call fcn.004014f0
add edi, 0xc
lea eax, [esi + esi]
mov dword [edi], eax
jmp 0x461539
mov edi, 0x4feb88
lea eax, [esi + esi]
mov dword [edi], eax
jmp 0x461539
mov ecx, dword [esp + 0x14]
mov al, byte [ecx + 0x17]
test al, al
jne 0x46147c
mov eax, dword [ecx + 0xc]
mov al, byte [eax + 0x17]
cmp al, 2
jne 0x4614a5
mov edx, dword [esp + 0x34]
mov ecx, edi
call fcn.004b4a20
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp esi, 1
jne 0x461560
jmp 0x461053
mov ebx, dword [esp + 0x34]
test bl, 1
je 0x4614b3
mov byte [ebx + edi], 0
inc ebx
xor eax, eax
mov word [ebx + edi], ax
cmp byte [ecx + 0x17], al
jne 0x4614c3
mov esi, dword [ecx + 0xc]
jmp 0x4614c5
mov esi, ecx
cmp byte [esi + 0x17], 1
jne 0x4614e3
test byte [esi + 0x15], 8
je 0x4614d8
mov ecx, esi
call fcn.004014f0
add esi, 0xc
mov dword [esi], ebx
mov ebx, dword [esp + 0x14]
jmp 0x461539
mov esi, 0x4feb88
mov dword [esi], ebx
mov ebx, dword [esp + 0x14]
jmp 0x461539
mov ebx, dword [esp + 0x14]
xor eax, eax
mov word [edi], ax
cmp byte [ebx + 0x17], al
jne 0x461503
mov esi, dword [ebx + 0xc]
jmp 0x461505
mov esi, ebx
cmp byte [esi + 0x17], 1
jne 0x46151d
test byte [esi + 0x15], 8
je 0x461518
mov ecx, esi
call fcn.004014f0
add esi, 0xc
jmp 0x461522
mov esi, 0x4feb88
cmp byte [esp + 0x13], 0
mov dword [esi], 0
jne 0x461539
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp byte [ebx + 0x17], 0
jne 0x461542
mov ebx, dword [ebx + 0xc]
cmp byte [ebx + 0x17], 2
jne 0x46156b
cmp dword [0x4fd77c], 0
je 0x46156b
push ecx
mov ecx, 0x4fd770
call fcn.004068a0
test eax, eax
jne 0x46157f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebx + 0x15]
and al, 0x86
cmp byte [esp + 0x11], 0
mov byte [ebx + 0x15], al
je 0x46157f
or al, 1
mov byte [ebx + 0x15], al
cmp dword [esp + 0x2c], 0
jne 0x461053
mov eax, dword [0x4f8174]
jmp 0x460ead
mov ecx, dword [esp + 0x18]
push 0x4cec30
push 0
push 0x4e2be8
call fcn.0044dae0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4