Function at 0x401720
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov dword [esp + 0x34], eax
cmp eax, 0xffffffff
je 0x4019f0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
sub esp, 8
lea eax, [eax + 1]
cmp esi, 0xffffffff
jne 0x40179b
mov eax, 1
xor esi, esi
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0x4c], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov edi, eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x4018a0
mov eax, dword [esp + 0x30]
mov byte [eax], 0
mov esi, dword [esp + 0x28]
mov dword [esi], 0
mov dword [esp + 4], 4
mov dword [esp], 4
call sub.msvcrt.dll_calloc
mov edi, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
movzx ebp, byte [edi]
mov eax, ebp
test al, al
je 0x4019fc
xor ebx, 1
mov ecx, 4
mov esi, dword [esi]
mov eax, ebx
mov ebx, ebp
mov ebp, ecx
and eax, 1
mov byte [esp + 0x3b], al
jmp 0x40185f
mov byte [eax], 0
movzx eax, byte [edi]
cmp al, 0xd
ja 0x4018b0
mov ebx, 0x2401
bt ebx, eax
jae 0x401884
movzx ebx, byte [edx + 1]
lea edi, [edx + 1]
test bl, bl
je 0x4018cc
mov dword [esp + 4], 0xa
mov dword [esp], edi
call sub.msvcrt.dll_strchr
mov edx, eax
test eax, eax
jne 0x401840
cmp bl, 0xd
ja 0x4018c0
mov eax, 0x2401
bt eax, ebx
jb 0x4018cc
cmp ebp, esi
jle 0x4019c0
mov eax, dword [esp + 0x2c]
mov dword [eax + esi*4], edi
mov eax, dword [esp + 0x28]
inc esi
mov dword [eax], esi
test edx, edx
jne 0x401854
jmp 0x4018cc
mov byte [edi + esi], 0
jmp 0x4017e8
cmp byte [esp + 0x3b], 0
jne 0x401884
cmp al, 0x23
je 0x401854
jmp 0x401884
cmp byte [esp + 0x3b], 0
jne 0x401884
cmp bl, 0x23
jne 0x401884
mov dword [esp], esi
mov dword [esp + 4], 4
xor ebx, ebx
call sub.msvcrt.dll_calloc
mov esi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
test eax, eax
jle 0x40198b
nop
mov eax, dword [esp + 0x2c]
mov edi, dword [eax + ebx*4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [esp + 8], edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
mov ebp, eax
lea eax, [eax + eax]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esi + ebx*4], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub esp, 0x18
mov dword [esp + 4], 0x40b202
mov eax, dword [esi + ebx*4]
inc ebx
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
sub esp, 8
mov eax, dword [esp + 0x28]
cmp dword [eax], ebx
jg 0x4018f0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
sub esp, 4
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebp, ebp
mov dword [esp + 0x3c], edx
lea eax, [ebp*4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x3c]
mov esi, dword [eax]
jmp 0x40188c
add esp, 0x5c
xor esi, esi
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x28]
mov esi, dword [eax]
jmp 0x4018cc