Function at 0x3047211
Capabilities:
Get file size
Parse pe header

Disassembly:
push 0x380
push 0x310b668
call fcn.03105bbc
mov ebx, edx
mov esi, ecx
xor eax, eax
mov word [ebp - 0x94], ax
push 0x3e
xor edi, edi
push edi
lea eax, [ebp - 0x92]
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x1dc], edi
push 0xf4
push edi
lea eax, [ebp - 0x1d8]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov eax, edi
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x364], edi
mov dword [ebp - 0x36c], edi
mov dword [ebp - 0x374], edi
mov dword [ebp - 0x360], eax
mov eax, ebx
dec eax
je 0x3047325
dec eax
je 0x30472d0
dec eax
je 0x304728f
xor eax, eax
jmp 0x3047d9f
mov dword [ebp - 0x350], edi
mov ecx, dword [esi + 0x86c]
call fcn.030483f0
mov dword [esi + 0x870], eax
cdq
mov edi, eax
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x354], edx
xor eax, eax
push eax
push dword [esi + 0x86c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xcb0], 3
jmp 0x304730f
mov dword [ebp - 0x350], edi
mov ecx, dword [esi + 0x448]
call fcn.030483f0
mov dword [esi + 0x450], eax
cdq
mov edi, eax
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x354], edx
xor eax, eax
push eax
push dword [esi + 0x448]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xcb0], 2
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x354]
xor edx, edx
jmp 0x3047355
mov eax, dword [esi + 0xd54]
mov dword [ebp - 0x350], eax
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x34c], edi
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x354], ecx
xor edx, edx
mov dword [ebp - 0x378], edx
mov dword [esi + 0xcb0], 5
mov dword [esi + 0xfb8], edx
mov dword [ebp - 0x390], edx
mov dword [ebp - 0x368], edx
xor edx, edx
mov dword [ebp - 4], edx
push 2
lea edx, [ebp - 0x370]
push edx
xor edx, edx
push edx
push edx
push ecx
push edi
mov edx, eax
call fcn.03048393
test eax, eax
jne 0x304739c
mov dword [0x310fb1c], 6
mov dword [ebp - 4], 0xfffffffe
jmp 0x3047288
mov dword [esi + 0xca8], ebx
mov eax, 0x4944
mov edx, dword [ebp - 0x350]
cmp word [ebp - 0x370], ax
jne 0x30475df
push 0x30
lea eax, [ebp - 0x50]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x354]
push edi
call fcn.03048393
test eax, eax
je 0x3047390
mov eax, 0x14c
mov cx, word [ebp - 0x4c]
cmp cx, ax
je 0x3047400
add eax, 0x38
cmp cx, ax
je 0x3047400
push dword [esi + 0x870]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
mov dword [esi + 0x870], eax
jmp 0x3047390
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0xd40], eax
mov eax, dword [ebp - 0x44]
mov dword [esi + 0x24], eax
mov word [esi + 0x30], cx
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x28], eax
movzx eax, word [ebp - 0x4a]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x18]
or eax, dword [esi + 0x1c]
jne 0x3047435
mov eax, dword [ebp - 0x40]
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x1c], eax
jmp 0x3047437
xor eax, eax
cmp dword [esi + 0x20], eax
jne 0x3047442
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x358], eax
imul eax, eax, 0x28
mov dword [ebp - 0x36c], eax
mov ecx, eax
call fcn.0303767c
mov edi, eax
mov dword [ebp - 0x35c], edi
test edi, edi
je 0x30474ee
push dword [ebp - 0x36c]
push edi
xor eax, eax
push eax
push 0x30
push dword [ebp - 0x354]
push dword [ebp - 0x34c]
mov edx, dword [ebp - 0x350]
call fcn.03048393
test eax, eax
je 0x30474ee
push ecx
push dword [ebp - 0x358]
push edi
lea ecx, [esi + 0xd18]
call fcn.0304842c
mov dword [esi + 0xd10], edi
mov eax, dword [ebp - 0x358]
mov dword [esi + 0xd38], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x30474ee
xor edx, edx
push 0x1c
pop ecx
div ecx
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x384], eax
imul edx, dword [ebp - 0x38], 0x28
mov eax, dword [ebp - 0x34]
add edx, 0x30
add eax, edx
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x388], eax
xor edi, edi
inc edi
jmp 0x30474f7
xor edi, edi
inc edi
mov eax, dword [ebp - 0x368]
mov ecx, dword [ebp - 0x360]
push 0x1c
pop edx
mov dword [ebp - 0x390], edi
cmp ebx, 2
jne 0x3047517
mov dword [esi + 0xd24], eax
mov dword [esi + 0xd28], ecx
test ecx, ecx
je 0x3047d92
push edx
lea ecx, [ebp - 0x348]
push ecx
xor ecx, ecx
push ecx
push eax
push dword [ebp - 0x354]
push dword [ebp - 0x34c]
mov edx, dword [ebp - 0x350]
call fcn.03048393
test eax, eax
je 0x3047390
cmp dword [ebp - 0x338], 0
je 0x3047d5c
xor eax, eax
push eax
push ebx
mov edx, dword [ebp - 0x33c]
mov ecx, dword [esi + 0xfc4]
call fcn.030482a0
mov eax, dword [ebp - 0x33c]
dec eax
je 0x3047c5e
dec eax
je 0x3047ba8
dec eax
dec eax
jne 0x3047c98
mov ecx, dword [ebp - 0x330]
cmp ecx, dword [ebp - 0x378]
jae 0x3047b8e
mov edx, dword [ebp - 0x34c]
cmp dword [edx + ecx], edi
jne 0x3047c9e
cmp ebx, 3
jne 0x3047b40
lea eax, [esi + 0x23c]
xor edx, edx
cmp word [eax], dx
mov edx, dword [ebp - 0x34c]
jne 0x3047c9e
push 0x105
add edx, 0xc
add ecx, edx
mov edx, eax
call fcn.030426c9
jmp 0x3047c98
mov eax, 0x5a4d
cmp word [ebp - 0x370], ax
jne 0x3047678
push 0x40
lea eax, [ebp - 0x94]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x354]
push edi
call fcn.03048393
test eax, eax
je 0x3047386
push 0xf8
lea eax, [ebp - 0x1dc]
push eax
mov eax, dword [ebp - 0x58]
cdq
push edx
push eax
push dword [ebp - 0x354]
push edi
mov edx, dword [ebp - 0x350]
call fcn.03048393
test eax, eax
je 0x3047386
mov edx, dword [ebp - 0x1dc]
cmp edx, 0x4550
je 0x30476b5
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x380], eax
movzx ecx, word [ebp - 0x1c8]
mov eax, dword [ebp - 0x58]
add ecx, 0x18
add eax, ecx
lea ecx, [ebp - 0x1c4]
jmp 0x3047732
mov eax, 0x14c
cmp word [ebp - 0x370], ax
jne 0x30476bd
push 0xf4
lea eax, [ebp - 0x1d8]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x354]
push edi
call fcn.03048393
test eax, eax
je 0x3047390
mov edx, 0x524f4d20
mov dword [ebp - 0x1dc], edx
mov ecx, dword [ebp - 0x358]
jmp 0x3047738
push 0x4c
lea eax, [ebp - 0xe4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x354]
push edi
call fcn.03048393
test eax, eax
je 0x3047386
mov eax, 0x14c
cmp word [ebp - 0xe4], ax
je 0x304770a
add eax, 0x38
cmp word [ebp - 0xe4], ax
je 0x304770a
mov eax, 0x284
cmp word [ebp - 0xe4], ax
jne 0x3047390
lea ecx, [ebp - 0xd0]
lea eax, [ebp - 0xe4]
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x380], eax
movzx eax, word [ebp - 0xd4]
add eax, 0x14
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x36c], eax
test ecx, ecx
je 0x3047781
mov eax, 0x107
cmp word [ecx], ax
jne 0x3047772
xor edi, edi
inc edi
mov dword [esi + 0xd48], edi
mov ax, word [ecx]
mov word [esi + 0x454], ax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x18], eax
xor edx, edx
mov dword [esi + 0x1c], edx
mov eax, dword [ecx + 4]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x30478bc
mov dword [esi + 0x11f0], 0xb
jmp 0x3047390
mov ecx, 0x20b
mov ax, word [ebp - 0x1c4]
cmp ax, cx
jne 0x304783d
push pe_nt_image_headers32
lea eax, [ebp - 0x32c]
push eax
mov eax, dword [ebp - 0x58]
cdq
push edx
push eax
push dword [ebp - 0x354]
push edi
mov edx, dword [ebp - 0x350]
call fcn.03048393
test eax, eax
je 0x3047386
lea eax, [ebp - 0x328]
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x58]
add eax, 0x108
mov dword [ebp - 0x36c], eax
mov ax, word [ebp - 0x314]
mov word [esi + 0x454], ax
xor edi, edi
inc edi
mov dword [esi + 0xd44], edi
cmp ebx, 2
je 0x304780e
cmp ebx, edi
jne 0x3047835
mov eax, dword [ebp - 0x2fc]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2f8]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x2f4]
mov dword [esi + 0xd40], eax
mov eax, dword [ebp - 0x2d4]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x2dc]
jmp 0x30478b9
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x380], ecx
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x374], ecx
mov word [esi + 0x454], ax
cmp edx, 0x524f4d20
jne 0x3047876
mov dword [ebp - 0x36c], 0xf4
jmp 0x3047884
mov eax, dword [ebp - 0x58]
add eax, 0xf8
mov dword [ebp - 0x36c], eax
xor edi, edi
inc edi
cmp ebx, 2
je 0x3047890
cmp ebx, edi
jne 0x30478b3
mov eax, dword [ebp - 0x1a8]
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x1a4]
mov dword [esi + 0xd40], eax
mov eax, dword [ebp - 0x184]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x18c]
mov dword [esi + 0x20], eax
push ebx
push ebx
push 0x64
pop edx
mov ecx, dword [esi + 0xfc4]
call fcn.030482a0
mov ecx, dword [ebp - 0x364]
movzx eax, word [ecx + 2]
mov dword [ebp - 0x358], eax
imul eax, eax, 0x28
mov dword [ebp - 0x37c], eax
mov ecx, eax
call fcn.0303767c
mov dword [ebp - 0x35c], eax
test eax, eax
je 0x30474f1
push dword [ebp - 0x37c]
push eax
xor eax, eax
push eax
push dword [ebp - 0x36c]
push dword [ebp - 0x354]
push dword [ebp - 0x34c]
mov edx, dword [ebp - 0x350]
call fcn.03048393
test eax, eax
je 0x30474f1
push ecx
push dword [ebp - 0x358]
push dword [ebp - 0x35c]
lea ecx, [esi + 0xd18]
call fcn.0304842c
mov eax, dword [ebp - 0x35c]
mov dword [esi + 0xd0c], eax
mov eax, dword [ebp - 0x358]
mov dword [esi + 0xd34], eax
mov ecx, dword [ebp - 0x364]
mov ax, word [ecx]
mov word [esi + 0x30], ax
mov eax, dword [ecx + 4]
mov dword [esi + 0x28], eax
movzx eax, word [ecx + 0x12]
mov dword [esi + 0x2c], eax
push ebx
push ebx
push 0x65
pop edx
mov ecx, dword [esi + 0xfc4]
call fcn.030482a0
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x38c], ecx
mov eax, dword [ebp - 0x35c]
mov edx, 0x200
cmp ecx, dword [ebp - 0x358]
jae 0x30474f1
xor ecx, ecx
cmp dword [esi + 0xd48], ecx
je 0x30479fc
mov ecx, dword [ebp - 0x364]
test word [ecx + 0x12], dx
jne 0x30479fc
push 7
push 0x3018288
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x30479f6
mov ecx, edi
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x384], ecx
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x388], eax
jmp 0x30474fd
mov eax, dword [ebp - 0x35c]
push dword [ebp - 0x374]
mov edx, eax
mov ecx, dword [ebp - 0x350]
call fcn.03048196
mov edx, eax
test edx, edx
je 0x3047a5c
mov dword [esi + 0xf68], ebx
mov eax, dword [ebp - 0x374]
mov ecx, dword [eax + 4]
mov dword [esi + 0xfd0], ecx
mov ecx, dword [eax]
mov dword [esi + 0xfc8], ecx
xor ecx, ecx
mov dword [esi + 0xfcc], ecx
push 0x28
lea eax, [esi + 0xf90]
push eax
push ecx
push edx
push dword [ebp - 0x354]
push dword [ebp - 0x34c]
mov edx, dword [ebp - 0x350]
call fcn.03048393
mov eax, dword [ebp - 0x374]
add eax, 0x30
push eax
mov edx, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0x350]
call fcn.03048196
test eax, eax
je 0x3047aa5
mov edx, eax
mov dword [ebp - 0x368], edx
mov dword [ebp - 0x388], edx
mov eax, dword [ebp - 0x374]
mov eax, dword [eax + 0x34]
xor edx, edx
push 0x1c
pop ecx
div ecx
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x374]
add eax, 0x70
push eax
mov edx, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0x350]
call fcn.03048196
mov dword [ebp - 0x37c], eax
test eax, eax
je 0x3047b1f
push 0x48
xor eax, eax
push eax
lea eax, [ebp - 0x224]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x48
lea eax, [ebp - 0x224]
push eax
xor eax, eax
push eax
push dword [ebp - 0x37c]
push dword [ebp - 0x354]
push dword [ebp - 0x34c]
mov edx, dword [ebp - 0x350]
call fcn.03048393
cmp dword [ebp - 0x1e0], 0
ja 0x3047b19
test byte [ebp - 0x214], 1
je 0x3047b1f
mov dword [esi + 0x1228], edi
mov ecx, dword [ebp - 0x38c]
inc ecx
mov dword [ebp - 0x38c], ecx
mov eax, dword [ebp - 0x35c]
add eax, 0x28
mov dword [ebp - 0x35c], eax
jmp 0x3047993
mov eax, 0x200
mov edx, dword [ebp - 0x364]
push 0x105
test word [edx + 0x12], ax
je 0x3047b7a
lea edx, [esi + 0x660]
mov eax, dword [ebp - 0x34c]
add eax, 0xc
add ecx, eax
call fcn.030426c9
mov eax, dword [ebp - 0x344]
mov dword [esi + 0x874], eax
jmp 0x3047b8e
lea edx, [esi + 0x23c]
add ecx, 0xc
add ecx, dword [ebp - 0x34c]
call fcn.030426c9
push ebx
xor eax, eax
push eax
mov edx, dword [ebp - 0x33c]
mov ecx, dword [esi + 0xfc4]
call fcn.030482a0
jmp 0x3047c98
cmp dword [ebp - 0x350], 0
je 0x3047c23
cmp dword [ebp - 0x334], 0
je 0x3047390
mov ecx, dword [ebp - 0x338]
call fcn.0303767c
mov dword [ebp - 0x358], eax
test eax, eax
je 0x3047c98
push dword [ebp - 0x338]
push eax
xor eax, eax
push eax
push dword [ebp - 0x334]
push dword [ebp - 0x354]
push dword [ebp - 0x34c]
mov edx, dword [ebp - 0x350]
call fcn.03048393
test eax, eax
jne 0x3047c12
mov ecx, dword [ebp - 0x358]
call fcn.030376c2
jmp 0x3047390
xor eax, eax
push eax
push dword [ebp - 0x338]
push dword [ebp - 0x358]
jmp 0x3047c41
mov ecx, dword [ebp - 0x330]
cmp ecx, dword [ebp - 0x378]
jae 0x3047c98
push edi
push dword [ebp - 0x338]
mov eax, dword [ebp - 0x34c]
add eax, ecx
push eax
lea ecx, [esi + 0xcb4]
call fcn.03031ea2
mov dword [esi + 0xf70], ebx
mov ecx, esi
call fcn.030481e5
jmp 0x3047b8e
mov ecx, dword [ebp - 0x330]
cmp ecx, dword [ebp - 0x378]
jae 0x3047c92
push edi
push dword [ebp - 0x338]
mov eax, dword [ebp - 0x34c]
add eax, ecx
push eax
lea ecx, [esi + 0xcc0]
call fcn.03031ea2
mov dword [esi + 0xf6c], ebx
jmp 0x3047b8e
mov dword [esi + 0xfb8], edi
mov edx, dword [ebp - 0x34c]
mov ecx, dword [ebp - 0x330]
cmp ecx, dword [ebp - 0x378]
jae 0x3047d5c
mov eax, dword [ebp - 0x33c]
sub eax, 3
je 0x3047d22
dec eax
dec eax
je 0x3047d13
dec eax
dec eax
je 0x3047cec
dec eax
jne 0x3047d5c
push edi
mov eax, dword [ebp - 0x338]
shr eax, 3
push eax
lea eax, [edx + ecx]
push eax
lea ecx, [esi + 0xd00]
call fcn.03031ea2
mov dword [esi + 0xf80], ebx
jmp 0x3047d47
push edi
mov eax, dword [ebp - 0x338]
shr eax, 3
push eax
mov eax, dword [ebp - 0x330]
add eax, edx
push eax
lea ecx, [esi + 0xcf4]
call fcn.03031ea2
mov dword [esi + 0xf7c], ebx
jmp 0x3047d47
mov dword [esi + 0xf84], ebx
push ebx
xor eax, eax
push eax
push 5
pop edx
jmp 0x3047d51
push edi
mov eax, dword [ebp - 0x338]
shr eax, 4
push eax
mov eax, dword [ebp - 0x330]
add eax, edx
push eax
lea ecx, [esi + 0xcd0]
call fcn.03031ea2
mov dword [esi + 0xf78], ebx
push ebx
xor eax, eax
push eax
mov edx, dword [ebp - 0x33c]
mov ecx, dword [esi + 0xfc4]
call fcn.030482a0
push 0x1c
pop edx
mov eax, dword [ebp - 0x368]
add eax, edx
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x388], eax
mov ecx, dword [ebp - 0x360]
dec ecx
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x384], ecx
jmp 0x3047517
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x390]
call fcn.03105c04
ret