Function at 0x4a56f0
Capabilities:
Get file size
Parse pe header

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
xor ebx, ebx
push 0x30
mov esi, eax
lea eax, [esp + 0x38]
push ebx
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.00436ad0
add esp, 0xc
lea ecx, [esp + 0x54]
push ecx
push esi
mov dword [esp + 0x3c], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4a5744
push str.GetFileSizeEx__
push ebx
push 0x112
push str..QHImageHlp.c
call fcn.0049d640
jmp 0x4a5b14
push 0x4000
mov dword [esp + 0x64], 0x4000
call fcn.004a6fe0
add esp, 4
mov dword [esp + 0x5c], eax
cmp eax, ebx
jne 0x4a577b
push 0x4cbb04
push ebx
push 0x20e
push str..QHImageHlp.c
call fcn.0049d640
jmp 0x4a5b14
push 0x40
push edi
push ebx
push ebx
lea ebx, [esp + 0x44]
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
mov edx, 0x5a4d
cmp word [edi], dx
je 0x4a57af
push str._rN_f
push 1
push 0x214
jmp 0x4a5b0a
push 4
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi + 0x3c]
cdq
push edx
push eax
lea ebx, [esp + 0x44]
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
cmp dword [esp + 0x28], 0x4550
je 0x4a57eb
push str._rN_f
push 1
push 0x219
jmp 0x4a5b0a
mov esi, dword [edi + 0x3c]
push 0x14
xor eax, eax
push edi
push eax
add esi, 4
push esi
lea ebx, [esp + 0x44]
mov dword [esp + 0x40], eax
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
mov eax, dword [esp + 0x30]
push 2
add esi, 0x14
lea ecx, [esp + 0x28]
adc eax, 0
push ecx
push eax
push esi
mov dword [esp + 0x40], eax
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
mov eax, dword [esp + 0x24]
mov edx, 0x10b
cmp ax, dx
jne 0x4a5872
movzx eax, word [edi + 0x10]
cmp ax, 0x78
jae 0x4a5860
push 0x4cd580
push 1
push 0x226
jmp 0x4a5b0a
mov dword [esp + 0x1c], 1
mov dword [esp + 0x10], 0xe0
jmp 0x4a58af
mov ecx, 0x20b
cmp ax, cx
jne 0x4a5afe
movzx eax, word [edi + 0x10]
mov edx, 0x88
cmp ax, dx
jae 0x4a589f
push 0x4cd580
push 1
push 0x22c
jmp 0x4a5b0a
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0xf0
movzx eax, ax
cmp eax, dword [esp + 0x10]
jae 0x4a58bc
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
movzx eax, word [edi + 2]
push ecx
push edi
push edx
push esi
lea ebx, [esp + 0x44]
mov dword [esp + 0x1c], eax
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
xor eax, eax
cmp dword [esp + 0x1c], eax
je 0x4a5923
lea ecx, [esi + 0x40]
mov dword [ebp], ecx
lea edx, [esi + 0x80]
mov dword [ebp + 4], edx
mov ecx, dword [edi + 0x80]
mov dword [ebp + 0xc], ecx
mov edx, dword [edi + 0x84]
mov dword [ebp + 0x14], edx
mov ecx, dword [edi + 0x40]
mov dword [ebp + 0x10], ecx
mov edx, dword [edi + 0x70]
mov ecx, dword [edi + 0x74]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
jmp 0x4a595e
lea edx, [esi + 0x40]
mov dword [ebp], edx
lea ecx, [esi + 0x90]
mov dword [ebp + 4], ecx
mov edx, dword [edi + 0x90]
mov dword [ebp + 0xc], edx
mov ecx, dword [edi + 0x94]
mov dword [ebp + 0x14], ecx
mov edx, dword [edi + 0x40]
mov dword [ebp + 0x10], edx
mov ecx, dword [edi + 0x80]
mov edx, dword [edi + 0x84]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov ecx, dword [ebp + 4]
add ecx, 4
add esi, dword [esp + 0x10]
mov dword [ebp + 8], ecx
adc dword [esp + 0x30], eax
mov dword [ebp + 0x18], eax
cmp dword [esp + 0x6c], eax
je 0x4a5af4
cmp dword [esp + 0x1c], eax
je 0x4a5af4
mov ecx, dword [esp + 0xc]
mov eax, 0x333
mov edx, eax
mov dword [esp + 0x24], eax
cmp cx, dx
jbe 0x4a59a0
mov dword [esp + 0xc], eax
jmp 0x4a59b2
mov eax, 0xffff
cmp cx, ax
jne 0x4a59b2
mov dword [esp + 0xc], 0xfffe
movzx ebx, word [esp + 0xc]
lea ebx, [ebx + ebx*4]
add ebx, ebx
add ebx, ebx
add ebx, ebx
push ebx
call fcn.004a6fe0
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4a59eb
push 0x4cbb04
push eax
push 0x259
push str..QHImageHlp.c
call fcn.0049d640
jmp 0x4a5b14
mov ecx, dword [esp + 0x30]
push ebx
push eax
push ecx
push esi
lea ebx, [esp + 0x44]
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
call fcn.004a4b10
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
test esi, esi
je 0x4a5af4
push 0x8000
push 0xa
push esi
mov eax, ebx
mov ecx, edi
call fcn.004a4a60
add esp, 0xc
test eax, eax
je 0x4a5af4
mov eax, dword [eax + 4]
test eax, eax
jns 0x4a5af4
and eax, 0x7fffffff
push 0x8000
add eax, esi
push 0x360
push eax
mov eax, ebx
mov ecx, edi
call fcn.004a4a60
add esp, 0xc
test eax, eax
je 0x4a5af4
mov eax, dword [eax + 4]
test eax, eax
jns 0x4a5af4
and eax, 0x7fffffff
push 0x8000
add eax, esi
push 0
push eax
mov eax, ebx
mov ecx, edi
call fcn.004a4a60
add esp, 0xc
test eax, eax
je 0x4a5af4
mov eax, dword [eax + 4]
test eax, eax
js 0x4a5af4
push 0x10
push edi
add eax, esi
push 0
push eax
call fcn.004a4830
add esp, 0x10
test eax, eax
je 0x4a5b17
cmp dword [edi + 4], 0x80
jne 0x4a5af4
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [edi]
push 0x80
call fcn.004a4b10
push 0x80
lea ecx, [ebp + 0x1c]
push ecx
push 0
push eax
call fcn.004a4830
add esp, 0x14
test eax, eax
je 0x4a5b17
mov edx, dword [esp + 0x1c]
mov dword [ebp + 0x18], edx
mov dword [esp + 0x18], 1
jmp 0x4a5b17
push str._rN_e
push 1
push 0x230
push str..QHImageHlp.c
call fcn.0049d6b0
add esp, 0x10
mov eax, dword [esp + 0x5c]
pop esi
pop ebp
pop ebx
test eax, eax
je 0x4a5b2b
push eax
call fcn.004a6ff0
add esp, 4
mov eax, dword [esp + 8]
test eax, eax
je 0x4a5b3c
push eax
call fcn.004a6ff0
add esp, 4
mov eax, dword [esp + 0xc]
add esp, 0x58
ret