Function at 0x406955
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.00406e30
cmp dword [ebp + 8], ebx
jne 0x406974
mov dword [ebp + 8], 0x41e00b
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov edi, pe_nt_image_headers32
push edi
push 3
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [0x425e98], eax
jne 0x4069b9
push ebx
push edi
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [0x425e98], eax
je 0x406b92
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
cmp edi, 3
mov dword [0x425eac], ebx
jl 0x406a22
push ebx
lea eax, [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 4]
push eax
push dword [0x425e98]
call esi
cmp dword [ebp - 0xc], 3
jne 0x406a13
push 3
lea eax, [ebp - 4]
push 0x41e034
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x406a13
mov dword [0x425eac], 0xfde9
sub edi, 3
jmp 0x406a22
push ebx
push ebx
push ebx
push dword [0x425e98]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
jle 0x406a56
lea eax, [edi + 2]
push eax
push ebx
push dword [0x4255ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [0x425ea4], eax
je 0x406bca
push ebx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [0x425e98]
call esi
mov edi, dword [ebp - 0xc]
mov eax, dword [0x425ea4]
cmp eax, ebx
je 0x406bca
mov word [eax + edi], bx
mov esi, dword [0x425ea4]
lea eax, [esi + edi]
cmp esi, eax
mov dword [0x425ea8], eax
mov edi, 0x425eb0
jae 0x406bca
mov al, byte [esi]
cmp al, 0x20
je 0x406a8c
cmp al, 9
jne 0x406a8f
inc esi
jmp 0x406a82
mov al, byte [esi]
cmp al, 0x3b
jne 0x406acc
inc esi
cmp byte [esi], 0x20
jne 0x406a9c
inc esi
push esi
push 2
push dword [ebp - 8]
push edi
call fcn.00406925
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x406ac3
mov al, byte [esi]
cmp al, 0xa
je 0x406b77
cmp al, 0xd
je 0x406b77
inc esi
cmp byte [esi], bl
jne 0x406ab0
jmp 0x406b77
cmp al, 0x5b
jne 0x406b12
inc esi
push esi
push 1
push dword [ebp - 8]
push edi
call fcn.00406925
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x406af4
mov al, byte [esi]
cmp al, 0x5d
je 0x406afd
cmp al, 0xa
je 0x406af8
cmp al, 0xd
je 0x406af8
inc esi
cmp byte [esi], bl
jne 0x406ae5
cmp byte [esi], 0x5d
jne 0x406b77
mov byte [esi], bl
jmp 0x406b09
cmp al, 0xa
je 0x406b79
cmp al, 0xd
je 0x406b7a
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x406b01
jmp 0x406b7a
cmp al, 0xa
je 0x406b7a
cmp al, 0xd
je 0x406b7a
mov edx, esi
jmp 0x406b2d
cmp al, 0x3d
je 0x406b31
cmp al, 0xd
je 0x406b31
cmp al, 0xa
je 0x406b31
inc esi
mov al, byte [esi]
cmp al, bl
jne 0x406b1e
lea eax, [esi - 1]
jmp 0x406b43
mov cl, byte [eax]
cmp cl, 0x20
je 0x406b42
cmp cl, 9
jne 0x406b47
dec eax
cmp eax, edx
ja 0x406b36
mov byte [eax + 1], bl
inc esi
mov al, byte [esi]
cmp al, 0x20
je 0x406b4a
cmp al, 9
je 0x406b4a
push esi
push edx
push dword [ebp - 8]
push edi
call fcn.00406925
add esp, 0x10
mov dword [ebp - 8], eax
jmp 0x406b73
mov al, byte [esi]
cmp al, 0xa
je 0x406b77
cmp al, 0xd
je 0x406b77
inc esi
cmp byte [esi], bl
jne 0x406b68
mov byte [esi], bl
inc esi
mov al, byte [esi]
cmp al, 0xa
je 0x406b79
cmp al, 0xd
je 0x406b79
cmp esi, dword [0x425ea8]
jb 0x406a82
jmp 0x406bca
push dword [ebp + 8]
mov dword [0x425e98], ebx
mov dword [0x425eac], ebx
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push ebx
push dword [0x4255ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [0x425e9c], eax
je 0x406bca
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [0x425e98]
pop edi
pop esi
pop ebx
leave
ret 4