Function at 0x417bb0
Capabilities:
Access peb ldr_data
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4b497c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
mov eax, dword [0x4bd8ac]
mov dword [esp + 0xc], ecx
mov cx, word [0x4bd8b0]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x28], cx
mov dword [esp + 0x24], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x12c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x2c]
xor bl, bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
mov edi, 0x4bd8bc
xor eax, eax
lea edx, [esp + 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x13], 0
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x18], 0
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bd888
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bd884
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4bd884
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x30]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 3
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push eax
push eax
and ecx, 3
lea eax, [esp + 0x40]
push closesocket
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp esi, 0xffffffff
mov ebp, eax
je 0x417d26
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
push 0x4bd878
push ecx
call fcn.004a7d19
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x4180b5
lea edi, [ebp + 1]
push edi
call fcn.004a71d4
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
mov dword [esp + 0x24], esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
push edi
push 1
push ebp
push esi
call fcn.004a7d2c
push edi
call fcn.004a7b32
push 0x114
call fcn.004a71d4
add esp, 0x1c
mov dword [esp + 0x14], eax
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x234], ecx
je 0x417dac
lea ecx, [esp + 0x24]
push ecx
push esi
mov ecx, eax
call fcn.004a60f0
mov dword [esp + 0x14], eax
jmp 0x417db0
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x14]
or ebp, 0xffffffff
mov ecx, edi
mov dword [esp + 0x234], ebp
call fcn.004a6150
mov esi, eax
test esi, esi
je 0x4180d0
mov al, byte [esp + 0x13]
test al, al
je 0x41806d
movsx eax, al
dec eax
jne case.default.0x417df2
movsx eax, bl
dec eax
cmp eax, 8
ja case.default.0x417df2
jmp dword [eax*4 + 0x4180fc]
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x417e31
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x417e21
cmp al, 0x30
jl 0x41809a
cmp al, 0x39
jg 0x41809a
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x417e0a
push esi
call fcn.004a7ece
mov ebx, dword [esp + 0x20]
add esp, 4
mov ecx, dword [ebx + eax*4 + 0x6fb28]
test ecx, ecx
jne 0x41809a
push 0x34
call fcn.004a71d4
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x234], 1
je 0x417e75
mov ecx, eax
call fcn.004a4f30
mov edi, eax
jmp 0x417e77
xor edi, edi
push esi
mov dword [esp + 0x238], ebp
call fcn.004a7ece
push esi
mov dword [ebx + eax*4 + 0x6fb28], edi
call fcn.004a7ece
add esp, 8
mov dword [esp + 0x18], eax
mov bl, 2
jmp case.default.0x417df2
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, 7
xor eax, eax
mov edi, dword [ebx + edx*4 + 0x6fb28]
add edi, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [ebx + edx*4 + 0x6fb28]
mov bl, 3
not ecx
dec ecx
add edi, 4
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.default.0x417df2
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x417f1f
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x417f0f
cmp al, 0x30
jl 0x41809a
cmp al, 0x39
jg 0x41809a
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x417ef8
push esi
call fcn.004a7ece
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
mov bl, 4
mov ecx, dword [ecx + edx*4 + 0x6fb28]
mov dword [ecx + 0x24], eax
jmp case.default.0x417df2
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x417f79
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x417f69
cmp al, 0x30
jl 0x41809a
cmp al, 0x39
jg 0x41809a
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x417f52
push esi
call fcn.004a7ece
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov bl, 5
mov edx, dword [edx + ecx*4 + 0x6fb28]
mov dword [edx + 0x28], eax
jmp case.default.0x417df2
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x417fd3
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x417fc3
cmp al, 0x30
jl 0x41809a
cmp al, 0x39
jg 0x41809a
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x417fac
push esi
call fcn.004a7ece
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
mov bl, 6
mov ecx, dword [ecx + edx*4 + 0x6fb28]
mov dword [ecx + 0x2c], eax
jmp case.default.0x417df2
mov bl, 7
jmp case.default.0x417df2
mov bl, 8
jmp case.default.0x417df2
mov bl, 9
jmp case.default.0x417df2
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x418037
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x418027
cmp al, 0x30
jl 0x41809a
cmp al, 0x39
jg 0x41809a
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x418018
push esi
call fcn.004a7ece
mov edx, dword [esp + 0x20]
add esp, 4
test eax, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + eax*4 + 0x6fb28]
jne 0x418060
mov byte [ecx + 0x30], 0
mov byte [esp + 0x13], 0
xor bl, bl
jmp case.default.0x417df2
mov byte [ecx + 0x30], 1
mov byte [esp + 0x13], 0
xor bl, bl
jmp case.default.0x417df2
mov ecx, 5
mov edi, 0x4bd8b4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne case.default.0x417df2
mov byte [esp + 0x13], 1
mov bl, 1
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.004a6150
mov esi, eax
test esi, esi
je 0x4180d0
jmp 0x417dcf
mov eax, dword [esp + 0x20]
push eax
call fcn.004a71c9
mov ecx, dword [esp + 0x18]
add esp, 4
test ecx, ecx
je 0x4180b5
mov edx, dword [ecx]
push 1
call dword [edx]
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x228
ret
test edi, edi
je 0x4180dc
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004a71c9
mov al, byte [esp + 0x17]
add esp, 4
test al, al
jne 0x4180b5
test bl, bl
jne 0x4180b5
mov eax, 1
jmp 0x4180b7