Function at 0x424007
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
or esi, 0xffffffff
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x46a4f8]
push esi
push ebx
mov dword [ebp - 8], ecx
call fcn.0040184e
mov ecx, dword [0x467b78]
push 1
push ebx
push esi
push 0x45bf4c
call fcn.0040184e
mov edi, dword [ebp + 8]
mov byte [ebp - 1], bl
mov byte [ebp - 0xc], bl
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
jmp 0x4240c1
inc esi
movsx eax, byte [esi]
push eax
call fcn.00442990
cmp eax, 0x43
pop ecx
je 0x4240af
cmp eax, 0x4d
je 0x424070
cmp eax, 0x54
jne 0x4240b3
mov byte [ebp - 1], 1
jmp 0x4240b3
lea eax, [esi + 1]
push eax
call fcn.0040105d
cmp edx, ebx
pop ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
ja 0x424252
jb 0x424095
cmp eax, 0x40000000
ja 0x424252
push 0x45bc18
push esi
call fcn.00439b0d
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x424252
dec esi
jmp 0x4240b3
mov byte [ebp - 0xc], 1
cmp byte [esi], bl
mov edi, esi
je 0x4240c1
lea edi, [esi + 1]
cmp byte [edi], bl
je 0x4240c1
inc edi
push edi
call fcn.00401ea8
mov esi, eax
cmp byte [esi], 0x2a
pop ecx
je 0x424050
push ebx
push 0x8000000
push 3
push ebx
push 3
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edx, eax
cmp edx, 0xffffffff
mov dword [ebp + 8], edx
je 0x424252
cmp byte [ebp - 0xc], bl
je 0x42411c
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x17]
cmp cl, bl
jne 0x424109
mov eax, dword [eax + 0xc]
mov cl, byte [eax + 0x17]
cmp cl, 2
jne 0x42411c
mov ecx, dword [ebp - 0x14]
push edx
call fcn.0044334a
jmp 0x424255
push edx
call fcn.00438adc
pop ecx
mov esi, edx
mov ecx, eax
and ecx, esi
cmp ecx, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x42424a
mov ecx, dword [ebp - 0x20]
mov edx, ecx
and edx, dword [ebp - 0x1c]
cmp edx, 0xffffffff
jne 0x424157
cmp esi, ebx
ja 0x42424a
jb 0x424157
cmp eax, 0x40000000
ja 0x42424a
cmp dword [ebp - 0x1c], esi
ja 0x424168
jb 0x424162
cmp ecx, eax
jae 0x424168
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x467b78]
xor edi, edi
inc edi
push edi
push ebx
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
mov eax, dword [ebp - 0x18]
or eax, esi
je 0x42419a
mov ecx, dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0x18]
push ebx
call fcn.0040184e
cmp eax, edi
je 0x4241aa
xor edi, edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x424255
mov ecx, dword [ebp - 8]
push edi
call fcn.00401e61
push ebx
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x42421d
cmp byte [ebp - 1], bl
mov eax, dword [ebp - 0x10]
mov byte [eax + esi], bl
je 0x4241fd
push ebx
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push 0x45f500
push 0x45e660
push esi
call fcn.0041d1a8
add esp, 0x20
cmp byte [ebp - 0xc], bl
je 0x424208
mov esi, dword [ebp - 0x10]
dec esi
jmp 0x424211
push esi
call fcn.00457cb0
pop ecx
mov esi, eax
mov ecx, dword [ebp - 8]
call fcn.00401d9f
mov dword [eax], esi
jmp 0x42423d
mov ecx, dword [ebp - 8]
mov byte [esi], bl
call fcn.00401d9f
push edi
push ebx
push 0xffffffffffffffff
mov dword [eax], ebx
mov ecx, dword [0x467b78]
push 0x45bf4c
call fcn.0040184e
push dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
call fcn.0040c556
jmp 0x424255
xor edi, edi
inc edi
jmp 0x42419a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4