Function at 0x411700
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x41e762
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x7d000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esi + 0x181c]
add esp, 4
cmp eax, 1
mov dword [esp + 0x1c], ebx
je 0x411778
cmp eax, 3
je 0x411778
cmp eax, 2
je 0x411752
cmp eax, 4
je 0x411752
xor eax, eax
jmp 0x411e09
push 0xe270
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x34], 1
je 0x41179e
mov ecx, eax
call fcn.00404160
jmp 0x4117a0
push 0xe250
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x34], 0
je 0x41179e
mov ecx, eax
call fcn.004025b0
jmp 0x4117a0
xor eax, eax
mov edi, eax
mov dword [esp + 0x34], 0xffffffff
test edi, edi
mov dword [esp + 0x14], edi
jne 0x4117c2
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
jmp 0x411e09
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push 0
push ecx
push edx
push ebp
call fcn.00407150
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
call dword [eax + 4]
mov ebp, dword [esi + 0x1a54]
test ebp, ebp
je 0x411812
mov ecx, ebp
call fcn.004071e0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a54], 0
push 0x2c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x40], eax
xor ebp, ebp
mov dword [esp + 0x34], 2
cmp eax, ebp
je 0x411839
push 0x34
mov ecx, eax
call fcn.004071a0
jmp 0x41183b
xor eax, eax
cmp eax, ebp
mov dword [esp + 0x34], 0xffffffff
mov dword [esi + 0x1a54], eax
jne 0x411854
xor eax, eax
jmp 0x411e09
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebp
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x20]
push 0
push ecx
push 0x914
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x411d51
mov edx, dword [edi]
push eax
push ebx
mov ecx, edi
call dword [edx + 0xc]
mov eax, dword [edi]
push ebx
push 0
mov ecx, edi
call dword [eax + 0x18]
test eax, eax
je 0x411cf6
mov edx, dword [esp + 0x18]
mov ebp, eax
add edx, eax
mov dword [esp + 0x40], ebp
test eax, eax
mov dword [esp + 0x18], edx
jle 0x411cdc
mov eax, dword [esp + 0x10]
cmp eax, 3
ja case.default.0x4118c0
jmp dword [eax*4 + 0x411e20]
mov ecx, dword [esi + 0x1a54]
call fcn.00407370
lea ecx, [eax + ebp]
cmp ecx, 0x1a
jl 0x411c6b
mov ecx, dword [esi + 0x1a54]
mov edi, 0x1a
sub edi, eax
push edi
push ebx
call fcn.00407460
mov edx, dword [esp + 0x40]
mov ecx, dword [esi + 0x1a54]
sub edx, edi
mov dword [esp + 0x40], edx
call fcn.00407370
mov ecx, dword [esi + 0x1a54]
sub eax, 4
push eax
call fcn.00407360
push eax
call fcn.00402570
mov ecx, dword [esi + 0x1a54]
add esp, 8
mov ebp, eax
push 8
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 8
mov byte [esi + 0x1a34], al
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 0x20
mov byte [esi + 0x1a35], al
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 0x20
mov dword [esi + 0x1a30], eax
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 0x20
mov dword [esi + 0x1a3c], eax
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 0x20
mov dword [esi + 0x1a40], eax
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 0x20
mov dword [esi + 0x1a38], eax
call fcn.004072d0
mov ecx, dword [esi + 0x1a54]
push 0x20
mov dword [esi + 0x1a44], eax
call fcn.004072d0
cmp ebp, eax
jne 0x411d03
mov ebp, dword [esi + 0x1a50]
test ebp, ebp
je 0x4119df
mov ecx, ebp
call fcn.004071e0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a50], 0
mov ebp, dword [esi + 0x1a4c]
test ebp, ebp
je 0x411a03
mov ecx, ebp
call fcn.004071e0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a4c], 0
mov ebp, dword [esi + 0x1a48]
test ebp, ebp
je 0x411a27
mov ecx, ebp
call fcn.004071e0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a48], 0
push 0x2c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x34], 3
je 0x411a52
mov edx, dword [esi + 0x1a40]
mov ecx, eax
inc edx
push edx
call fcn.004071a0
jmp 0x411a54
xor eax, eax
or ebp, 0xffffffff
mov dword [esi + 0x1a50], eax
test eax, eax
mov dword [esp + 0x34], ebp
je 0x411d51
push 0x2c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x34], 4
je 0x411a94
mov ecx, dword [esi + 0x1a3c]
inc ecx
push ecx
mov ecx, eax
call fcn.004071a0
jmp 0x411a96
xor eax, eax
test eax, eax
mov dword [esp + 0x34], ebp
mov dword [esi + 0x1a4c], eax
je 0x411d51
push 0x2c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
mov dword [esp + 0x34], 5
je 0x411ad3
mov edx, dword [esi + 0x1a38]
mov ecx, eax
inc edx
push edx
call fcn.004071a0
jmp 0x411ad5
xor eax, eax
test eax, eax
mov dword [esp + 0x34], ebp
mov dword [esi + 0x1a48], eax
je 0x411d51
add ebx, edi
mov dword [esp + 0x10], 1
jmp 0x411c5c
mov ecx, dword [esi + 0x1a48]
call fcn.00407370
mov edi, dword [esi + 0x1a38]
lea ecx, [eax + ebp]
cmp ecx, edi
jl 0x411c7a
mov ecx, dword [esi + 0x1a48]
sub edi, eax
push edi
push ebx
call fcn.00407460
mov ecx, dword [esp + 0x40]
add ebx, edi
sub ecx, edi
mov dword [esp + 0x10], 2
mov dword [esp + 0x40], ecx
mov ecx, dword [esi + 0x1a48]
call fcn.00407370
mov ecx, dword [esi + 0x1a48]
sub eax, 4
push eax
call fcn.00407360
push eax
call fcn.00402570
mov ecx, dword [esi + 0x1a48]
add esp, 8
mov edi, eax
call fcn.00407650
mov ecx, dword [esi + 0x1a48]
call fcn.00407370
mov ecx, dword [esi + 0x1a48]
sub eax, 4
push eax
call fcn.004075f0
mov ecx, dword [esi + 0x1a48]
push 0x20
call fcn.004072d0
mov ecx, dword [esi + 0x1a48]
mov ebp, eax
call fcn.00407670
cmp edi, ebp
jne 0x411d1b
jmp 0x411c5c
mov ecx, dword [esi + 0x1a4c]
call fcn.00407370
mov edi, dword [esi + 0x1a3c]
lea edx, [eax + ebp]
cmp edx, edi
jl 0x411c89
mov ecx, dword [esi + 0x1a4c]
sub edi, eax
push edi
push ebx
call fcn.00407460
mov ecx, dword [esp + 0x40]
add ebx, edi
sub ecx, edi
mov dword [esp + 0x10], 3
mov dword [esp + 0x40], ecx
mov ecx, dword [esi + 0x1a4c]
call fcn.00407370
mov ecx, dword [esi + 0x1a4c]
sub eax, 4
push eax
call fcn.00407360
push eax
call fcn.00402570
mov ecx, dword [esi + 0x1a4c]
add esp, 8
mov edi, eax
call fcn.00407650
mov ecx, dword [esi + 0x1a4c]
call fcn.00407370
mov ecx, dword [esi + 0x1a4c]
sub eax, 4
push eax
call fcn.004075f0
mov ecx, dword [esi + 0x1a4c]
push 0x20
call fcn.004072d0
mov ecx, dword [esi + 0x1a4c]
mov ebp, eax
call fcn.00407670
cmp edi, ebp
jne 0x411d33
jmp 0x411c5c
cmp eax, 4
je 0x411cdc
mov eax, dword [esp + 0x40]
test eax, eax
jle 0x411cdc
mov ebp, eax
jmp 0x4118b3
mov ecx, dword [esi + 0x1a54]
push ebp
push ebx
call fcn.00407460
jmp 0x411cdc
mov ecx, dword [esi + 0x1a48]
push ebp
push ebx
call fcn.00407460
jmp 0x411cdc
mov ecx, dword [esi + 0x1a4c]
push ebp
push ebx
call fcn.00407460
jmp 0x411cdc
mov ecx, dword [esi + 0x1a50]
call fcn.00407370
mov edx, dword [esi + 0x1a40]
lea ecx, [eax + ebp]
cmp ecx, edx
jge 0x411cbf
mov ecx, dword [esi + 0x1a50]
push ebp
push ebx
call fcn.00407460
jmp 0x411cdc
mov ecx, dword [esi + 0x1a40]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x1a50]
push ebx
call fcn.00407460
mov dword [esp + 0x10], 4
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push ebx
push 0
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x18]
test eax, eax
jne 0x41189b
cmp dword [esp + 0x10], 4
jne 0x41185c
jmp 0x411d51
mov eax, dword [esi + 0x1a78]
test eax, eax
je 0x411d51
mov eax, dword [esi + 0x1a7c]
push eax
push 0x423f38
jmp 0x411d49
mov eax, dword [esi + 0x1a78]
test eax, eax
je 0x411d51
mov ecx, dword [esi + 0x1a7c]
push ecx
push 0x423f18
jmp 0x411d49
mov eax, dword [esi + 0x1a78]
test eax, eax
je 0x411d51
mov edx, dword [esi + 0x1a7c]
push edx
push 0x423ef8
call fcn.0040b080
add esp, 8
mov edi, dword [esp + 0x14]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x20]
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 4
je 0x411e04
mov edi, dword [esi + 0x1a54]
xor ebx, ebx
cmp edi, ebx
je 0x411da0
mov ecx, edi
call fcn.004071e0
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a54], ebx
mov edi, dword [esi + 0x1a50]
cmp edi, ebx
je 0x411dc0
mov ecx, edi
call fcn.004071e0
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a50], ebx
mov edi, dword [esi + 0x1a4c]
cmp edi, ebx
je 0x411de0
mov ecx, edi
call fcn.004071e0
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a4c], ebx
mov edi, dword [esi + 0x1a48]
cmp edi, ebx
je 0x411e00
mov ecx, edi
call fcn.004071e0
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x1a48], ebx
xor eax, eax
jmp 0x411e09
mov eax, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc