Function at 0x428922
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42d00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x28], eax
test esi, esi
push edi
setne al
movzx eax, al
push eax
push 0x411c34
push ebx
push ebx
push ebx
mov ecx, 0x411c50
mov dword [ebp - 0x24], esi
call fcn.0042ba80
xor eax, eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
call dword [eax + 0x90]
cmp eax, 3
sete al
movzx eax, al
push eax
push 0x40429c
push ebx
push ebx
push ebx
mov ecx, 0x411d18
call fcn.0042ba80
mov eax, dword [esi]
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x30]
push ecx
push esi
call dword [eax + 0xb0]
mov eax, dword [esi]
lea ecx, [ebp - 0x34]
push ecx
push ebx
push ebx
push ebx
push esi
call dword [eax + 0xc0]
mov edi, eax
test edi, edi
jns 0x428a1b
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428a07
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428a07
cmp byte [eax + 0xb9], 2
jb 0x428a07
push edi
push 0x412614
push 0x10
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push ebx
push edi
push esi
push eax
call dword [ecx + 0xc]
jmp 0x428ba9
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ecx + 0xc], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x2c], ebx
call dword [eax + 0xf8]
test eax, eax
je 0x428aa4
mov eax, dword [esi]
push esi
call dword [eax + 0xfc]
mov esi, eax
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18]
push eax
push 4
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov ecx, eax
test ecx, ecx
je 0x428a9d
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428aa4
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428aa4
cmp byte [eax + 0xb9], 3
jb 0x428aa4
push ecx
push dword [ebp - 0x24]
push 0x4010a0
push reloc.ADVAPI32.dll_EventRegister
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041c5ec
jmp 0x428aa4
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
lea edx, [ebp - 0x20]
push edx
push dword [ebp - 0x24]
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
push dword [ebp - 0x28]
push ebx
push esi
push edi
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp - 0x1c]
mov esi, eax
cmp dword [ebp - 0x20], ebx
je 0x428ae5
mov eax, dword [edi + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x2c], ebx
je 0x428b36
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
mov ecx, eax
test ecx, ecx
je 0x428b36
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428b36
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428b36
cmp byte [eax + 0xb9], 3
jb 0x428b36
push ecx
push 0x4010a0
push reloc.ADVAPI32.dll_EventWrite
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
test esi, esi
jne 0x428b4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp ecx, 0x3e5
jne 0x428b4f
xor ebx, ebx
inc ebx
jmp 0x428ba9
mov esi, ecx
test ecx, ecx
jle 0x428b61
and esi, 0xffff
or esi, 0x80070000
mov eax, dword [0x42d05c]
cmp eax, 0x42d05c
je 0x428b9b
test dword [eax + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x428b9b
cmp byte [eax + 0xb9], 2
jb 0x428b9b
push ecx
push 0x412614
push 0x11
push dword [eax + 0xb4]
push dword [eax + 0xb0]
call fcn.0041722a
mov ecx, dword [edi + 8]
mov edx, dword [ecx]
push ebx
push esi
push dword [ebp - 0x24]
push ecx
call dword [edx + 0xc]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0042bdaf
leave
ret 0xc