Function at 0x405f9e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
jne 0x406021
push 0xa0d
push 0x7325203a
push 0x24454c49
push 0x465f474e
push 0x494e4550
push 0x4f5f524f
push 0x52524524
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [ebx + 0x30]
add esp, 0x1c
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 0x20], eax
jmp 0x4062c4
mov dword [ebp - 0x14c], eax
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x144], eax
push dword [ebp - 0x144]
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x148]
push 0
push eax
push dword [ebp - 0x144]
push dword [ebp - 0x140]
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x12c]
push 0xc
push 0
push eax
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x140]
xor ecx, ecx
cmp ecx, dword [ebp - 0x144]
jae 0x4060dc
cmp byte [eax + ecx], 0x7b
jne 0x4060bd
inc dword [ebp - 0x13c]
jmp 0x4060c9
cmp byte [eax + ecx], 0x7d
jne 0x4060c9
inc dword [ebp - 0x138]
inc ecx
mov edx, dword [ebp - 0x13c]
test edx, edx
je 0x4060a7
cmp edx, dword [ebp - 0x138]
jne 0x4060a7
cmp ecx, dword [ebp - 0x144]
jb 0x406111
push 0xa0d65
push 0x6c696620
push 0x676e6974
push 0x63617274
push 0x78652072
push 0x6f727245
mov dword [ebp - 0xc], esp
push esp
call dword [ebx + 0x30]
add esp, 0x18
jmp 0x4062c4
mov dword [ebp - 0x134], ecx
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp - 0x144]
jae 0x40617b
mov edx, dword [eax + ecx]
bswap edx
mov dword [ebp - 0x120], edx
mov edx, dword [eax + ecx + 4]
bswap edx
mov dword [ebp - 0x11c], edx
lea edx, [eax + ecx + 8]
mov dword [ebp - 0x118], edx
lea eax, [ebp - 0x120]
lea ecx, [ebp - 0x12c]
push 0xc
push eax
push ecx
call fcn.00404f57
mov ecx, dword [ebp - 0x134]
add ecx, 8
add ecx, dword [ebp - 0x11c]
add ecx, 2
mov dword [ebp - 0x134], ecx
jmp 0x406117
push dword [esi + 0x14]
push 0
push dword [esi + 0x20]
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
cmp dword [ebp - 0x124], 0
je 0x406279
pushal
mov edi, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x12c]
cmp edi, eax
jae 0x406278
mov dword [ebp - 0x130], 0
and dword [edi], 0x5fffffff
mov eax, dword [edi]
cmp eax, dword [esi + 0x14]
jb 0x4061d7
mov dword [ebp - 0x130], 1
jmp 0x4061e9
add eax, dword [edi + 4]
cmp eax, dword [esi + 0x14]
jbe 0x4061e9
mov dword [ebp - 0x130], 1
cmp dword [ebp - 0x130], 0
je 0x40625b
push 0xa0d
push 0x2958382e
push 0x253a5838
push 0x2e252861
push 0x74616420
push 0x2958382e
push 0x25286873
push 0x616c6620
push 0x3a646e75
push 0x6f66206e
push 0x6f697369
push 0x6c6c6f43
mov dword [ebp - 8], esp
lea eax, [ebp - 0x114]
push dword [edi + 4]
push dword [edi]
push dword [esi + 0x14]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x14
add esp, 0x30
lea eax, [ebp - 0x114]
push eax
call dword [ebx + 0x30]
jmp 0x406270
mov eax, dword [esi + 0x20]
add eax, dword [edi]
push dword [edi + 4]
push dword [edi + 8]
push eax
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
add edi, 0xc
jmp 0x4061a0
popal
push 0xa0d
push 0x22732522
push 0x20244445
push 0x5443454c
push 0x45535f45
push 0x4c494624
mov dword [ebp - 4], esp
lea eax, [ebp - 0x114]
push dword [ebp + 8]
push dword [ebp - 4]
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
call dword [ebx + 0x30]
add esp, 0x18
push esi
push ebx
call fcn.00401610
leave
ret 4