Function at 0x40aebc
Capabilities:
Read file on windows

Disassembly:
push 0x19c
mov eax, 0x42af1c
call fcn.00428767
mov ebx, ecx
xor eax, eax
lea edi, [ebp - 0x128]
stosd dword es:[edi], eax
xor ecx, ecx
push 7
pop esi
mov dword [ebx + 0x14], ecx
stosd dword es:[edi], eax
mov dword [ebx + 0x18], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], esi
mov word [ebp - 0x128], ax
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x128]
mov ecx, dword [ebx + 0xc]
push eax
call fcn.00410e24
test al, al
jne 0x40af22
xor bl, bl
jmp 0x40b2f1
xor eax, eax
lea edi, [ebp - 0x140]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], esi
mov word [ebp - 0x140], ax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebx + 0xc]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00410d8e
test al, al
jne 0x40af87
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x140]
cmp dword [ebp - 0x12c], esi
jbe 0x40af82
mov eax, dword [ebp - 0x140]
xor ecx, ecx
mov word [eax], cx
xor ecx, ecx
lea eax, [ebp - 0x128]
mov dword [ebp - 0x198], ecx
cmp dword [ebp - 0x114], esi
jbe 0x40afa3
mov eax, dword [ebp - 0x128]
push ecx
push 0x8000000
push 3
push ecx
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40afee
push 0
lea eax, [ebp - 0x198]
push eax
push 0x100
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40afe7
and dword [ebp - 0x198], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea edi, [ebp - 0x150]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x110]
xor edx, edx
push 7
mov byte [ebp - 0x191], dl
stosd dword es:[edi], eax
mov dword [ebp - 0x19c], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x198]
neg eax
pop edi
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x128]
cmp dword [ebp - 0x114], edi
jbe 0x40b031
mov ecx, dword [ebp - 0x128]
push edx
lea edx, [ebp - 0x19c]
push edx
xor edx, edx
push edx
push edx
push dword [ebp - 0x198]
push eax
push ecx
push edx
call dword [sym.imp.urlmon.dll_FindMimeFromData]
test eax, eax
jne 0x40b08b
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x19c]
push ecx
call fcn.0040b308
push dword [ebp - 0x19c]
mov byte [ebp - 0x191], al
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
cmp byte [ebp - 0x191], cl
jne 0x40b259
jmp 0x40b08d
xor ecx, ecx
cmp dword [ebp - 0x130], 0
je 0x40b22f
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0x1a4], ecx
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], 2
xor eax, eax
lea edi, [ebp - 0x180]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
mov byte [ebp - 4], 3
lea edi, [ebp - 0x168]
stosd dword es:[edi], eax
push 7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
pop edi
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], edi
mov word [ebp - 0x168], ax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1a8]
push eax
push ecx
push ecx
call fcn.00411931
add esp, 0xc
test al, al
je 0x40b1f9
mov esi, dword [ebp - 0x1a8]
jmp 0x40b1e4
push str.MIMEDatabaseContent_Type
lea ecx, [ebp - 0x180]
call fcn.004026db
mov edx, esi
cmp dword [esi + 0x14], edi
jbe 0x40b154
mov edx, dword [esi]
lea ecx, [ebp - 0x180]
call fcn.004108ff
lea edx, [ebp - 0x180]
cmp dword [ebp - 0x16c], edi
jbe 0x40b173
mov edx, dword [ebp - 0x180]
lea eax, [ebp - 0x168]
push eax
push ecx
push str.Extension
call fcn.004118c0
add esp, 0xc
test al, al
je 0x40b1e1
cmp dword [ebp - 0x158], 0
je 0x40b1e1
lea edx, [ebp - 0x140]
cmp dword [ebp - 0x12c], edi
jbe 0x40b1a9
mov edx, dword [ebp - 0x140]
lea ecx, [ebp - 0x168]
cmp dword [ebp - 0x154], edi
jbe 0x40b1bd
mov ecx, dword [ebp - 0x168]
call fcn.00402675
test eax, eax
jne 0x40b1e1
mov eax, esi
cmp dword [esi + 0x14], edi
jbe 0x40b1cf
mov eax, dword [esi]
lea ecx, [ebp - 0x150]
push ecx
push eax
push ecx
call fcn.0040b308
test al, al
jne 0x40b1f2
add esi, 0x18
cmp esi, dword [ebp - 0x1a4]
jne 0x40b13b
jmp 0x40b1f9
mov byte [ebp - 0x191], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x168]
call fcn.00402dc7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x180]
call fcn.00402dc7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a8]
call fcn.0040bdfc
cmp byte [ebp - 0x191], 0
jne 0x40b259
lea eax, [ebp - 0x128]
cmp dword [ebp - 0x114], edi
jbe 0x40b243
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x150]
push ecx
push eax
call dword [sym.imp.ole32.dll_GetClassFile]
test eax, eax
jne 0x40b2e0
xor eax, eax
lea edi, [ebp - 0x190]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.ole32.dll_OleGetAutoConvert]
test eax, eax
jne 0x40b28d
lea esi, [ebp - 0x190]
lea edi, [ebp - 0x150]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x150]
mov ecx, ebx
push eax
call fcn.0040adf6
test al, al
je 0x40b2e0
test dword [ebx + 0x14], 0x400
jne 0x40b2e0
push ecx
lea eax, [ebx + 0x11]
push eax
lea esi, [ebx + 0x3c]
push esi
push 0x42cb98
push ecx
lea edx, [ebp - 0x150]
call fcn.00403049
add esp, 0x14
test al, al
je 0x40b2e0
cmp dword [esi], 0
je 0x40b2e0
lea edi, [ebx + 0x2c]
xor ebx, ebx
lea esi, [ebp - 0x150]
inc ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x40b2e2
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.00402dc7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.00402dc7
mov al, bl
call fcn.00428725
ret