Function at 0x403de0
Capabilities:
Get file size
Hash data with md5
Read file on windows
Read file via mapping

Disassembly:
sub esp, 0x90
mov eax, dword [0x474534]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x3c], eax
call fcn.00421010
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x3c], edi
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x40], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x2c], esi
je 0x40402c
lea ecx, [esp + 0x20]
push ecx
push esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x20]
push 1
push edi
push edi
push edx
mov dword [esp + 0x24], eax
call fcn.00410cb0
mov ecx, dword [esp + 0x14]
add eax, ecx
adc edx, edi
mov dword [esp + 0x18], eax
xor eax, eax
cmp dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
ja 0x403f48
cmp edi, 1
ja 0x403f48
jb 0x403eb7
cmp ecx, eax
ja 0x403f48
push 0x475780
push 0x8000
xor ebp, ebp
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], eax
call fcn.0040477e
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40401f
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
lea eax, [esp + 0x18]
push eax
push 0x8000
push ebx
push esi
call edi
test eax, eax
je 0x403f2b
mov eax, dword [esp + 0x14]
test eax, eax
je 0x403f2b
add ebp, eax
adc dword [esp + 0x34], 0
push ebx
lea ecx, [esp + 0x44]
call fcn.0041c340
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x8000
push ebx
push esi
mov dword [esp + 0x28], 0
call edi
test eax, eax
jne 0x403ef6
cmp ebp, dword [esp + 0x18]
jne 0x403ffd
mov edx, dword [esp + 0x34]
cmp edx, dword [esp + 0x1c]
je 0x403fe4
jmp 0x403ffd
push eax
push eax
push eax
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
test edi, edi
mov dword [esp + 0x24], edi
je 0x40401f
cmp dword [esp + 0x1c], ebx
jl 0x403fe2
mov esi, dword [esp + 0x18]
jg 0x403f7d
test esi, esi
jbe 0x403fe2
jmp 0x403f7d
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
xor edx, edx
mov ecx, ebp
sub ecx, edx
mov eax, ebx
sar eax, 0x1f
mov edx, ebp
add edx, 0x80000
mov eax, ebx
adc eax, 0
cmp eax, dword [esp + 0x1c]
jg 0x403fa8
jl 0x403fa1
cmp edx, esi
ja 0x403fa8
mov esi, 0x80000
jmp 0x403faa
sub esi, ebp
push esi
push ecx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x40400c
push edi
mov eax, esi
lea ecx, [esp + 0x44]
call fcn.0041c340
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add ebp, esi
adc ebx, 0
cmp ebx, dword [esp + 0x1c]
jl 0x403f75
jg 0x403fe2
cmp ebp, dword [esp + 0x18]
jb 0x403f75
xor ebx, ebx
mov edi, dword [esp + 0x3c]
lea esi, [esp + 0x40]
call fcn.0041c3e0
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x28], 1
test ebx, ebx
je 0x404010
push ebx
call fcn.00404783
add esp, 4
jmp 0x404010
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40401f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
jmp 0x40402e
mov eax, edi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040470b
add esp, 0x90
ret