Function at 0x41026f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
xor eax, eax
lea edx, [ebp - 4]
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 8]
push ebx
push esi
push edi
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.0040e864
test eax, eax
je 0x410396
mov esi, dword [ebp - 8]
xor eax, eax
push 0x11695
lea ebx, [esi - 0x121c]
add ebx, dword [ebp - 4]
mov word [ebx + 0x41a], ax
mov word [ebx + 0xe2e], ax
mov word [ebx + 0x61a], ax
mov word [ebx + 0x81a], ax
mov word [ebx + 0xa1a], ax
mov word [ebx + 0xc1a], ax
mov word [ebx + 0xe1a], ax
mov word [ebx + 0x402], ax
mov word [ebx + 0x202], ax
mov word [ebx + 0x121a], ax
call fcn.0043d630
mov dword [esp], 0x11695
mov edi, eax
push 0
push edi
call fcn.00443b90
add esp, 0xc
mov dword [edi + 0xd851], esi
mov eax, dword [ebx]
lea edx, [edi + 0xd85d]
lea ecx, [edi + 0xd859]
mov dword [edi + 0xd855], eax
call fcn.0040e69f
push 0x121c
push ebx
push edi
call fcn.004434a0
add esp, 0xc
mov dword [0x4ae264], edi
lea ecx, [ebx + 0x408]
lea esi, [ebp - 0x30]
sub esi, ecx
push 2
pop edx
movzx eax, word [ecx]
mov word [esi + ecx], ax
add ecx, edx
test ax, ax
jne 0x410368
lea ecx, [ebx + 0xe1c]
lea esi, [ebp - 0x1c]
sub esi, ecx
movzx eax, word [ecx]
mov word [esi + ecx], ax
add ecx, edx
test ax, ax
jne 0x410381
xor ebx, ebx
jmp 0x4104d8
mov ebx, 0x11695
push ebx
call fcn.0043d630
pop ecx
push ebx
mov edi, eax
push 0x494890
push edi
call fcn.004434a0
add esp, 0xc
lea eax, [ebp - 0x137]
xor ebx, ebx
mov byte [ebp - 0x138], bl
push 0x103
push ebx
push eax
call fcn.00443b90
add esp, 0xc
lea edx, [ebp - 0x138]
push str.data.cab
push ecx
call fcn.0040b8b5
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x41043a
push 0
push esi
call ebx
push eax
mov dword [edi + 0xd855], eax
call fcn.0041ed01
pop ecx
push 0
lea ecx, [ebp - 4]
mov dword [edi + 0xd851], eax
push ecx
push dword [edi + 0xd855]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.theme.cab
push ecx
lea edx, [ebp - 0x138]
call fcn.0040b8b5
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4104a3
push 0
push esi
call ebx
push eax
mov dword [edi + 0xd85d], eax
call fcn.0041ed01
pop ecx
xor ebx, ebx
mov dword [edi + 0xd859], eax
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [edi + 0xd85d]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4104a5
xor ebx, ebx
push 2
mov dword [0x4ae264], edi
mov ecx, ebx
pop edx
movzx eax, word [ecx + 0x494c98]
mov word [ebp + ecx - 0x30], ax
add ecx, edx
test ax, ax
jne 0x4104b0
mov ecx, ebx
movzx eax, word [ecx + 0x4956ac]
mov word [ebp + ecx - 0x1c], ax
add ecx, edx
test ax, ax
jne 0x4104c5
lea ecx, [ebp - 0x1c]
mov dword [edi + 0x133c], ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, edx
cmp ax, bx
jne 0x4104e4
sub ecx, esi
sar ecx, 1
cmp word [ebp + ecx*2 - 0x1e], 0x2a
jne 0x410510
mov eax, dword [0x4ae264]
mov dword [eax + 0x133c], 1
xor eax, eax
mov word [ebp + ecx*2 - 0x1e], ax
mov esi, dword [0x4ae264]
lea ecx, [ebp - 0x1c]
add esi, 0x1328
movzx eax, word [ecx]
add ecx, edx
mov word [esi], ax
add esi, edx
test ax, ax
jne 0x41051f
mov eax, dword [0x4ae264]
lea esi, [ebp - 0x30]
add eax, 0x1340
movzx ecx, word [esi]
add esi, edx
mov word [eax], cx
add eax, edx
test cx, cx
jne 0x41053b
mov ecx, dword [0x4ae264]
call fcn.0040ee2f
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret