Function at 0x401891
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x41102c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x284], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x2c
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x2c0]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x288], 0x800b0100
mov dword [ebp - 0x2c4], ebx
call fcn.00404db0
add esp, 0xc
push 8
pop ecx
push ebx
push ebx
push 3
push ebx
push 1
xor eax, eax
mov dword [ebp - 0x2e8], ebx
lea edi, [ebp - 0x2e4]
rep stosd dword es:[edi], eax
push 0x80000000
push dword [ebp - 0x284]
mov dword [ebp - 0x290], ebx
lea edi, [ebp - 0x28c]
mov dword [ebp - 0x60], 0xf750e6c3
mov word [ebp - 0x5c], 0x38ee
mov word [ebp - 0x5a], 0x11d1
mov byte [ebp - 0x58], 0x85
mov byte [ebp - 0x57], 0xe5
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], 0xc0
mov byte [ebp - 0x54], 0x4f
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0x95
mov byte [ebp - 0x51], 0xee
stosd dword es:[edi], eax
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x280], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c29
cmp edi, ebx
je 0x401c29
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x401c22
cmp dword [ebp - 0x28c], ebx
jg 0x401c22
jl 0x4019a2
cmp dword [ebp - 0x290], 0x2000000
ja 0x401c22
mov eax, 0x100
push eax
mov dword [ebp - 0x274], eax
call fcn.00404d68
pop ecx
push ebx
push eax
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x274]
push eax
push edi
call dword [esi + 0x1058]
test eax, eax
jne 0x401a18
push dword [ebp - 0x278]
call fcn.00404ead
push dword [ebp - 0x274]
call fcn.00404d68
pop ecx
pop ecx
push ebx
push eax
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x274]
push eax
push edi
call dword [esi + 0x1058]
test eax, eax
jne 0x401a18
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x278]
call fcn.00404ead
pop ecx
jmp 0x401c29
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x280]
push eax
call dword [esi + 0x105c]
test eax, eax
je 0x401a07
mov eax, dword [ebp - 0x274]
push 0x11
pop ecx
push 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
lea eax, [eax + eax + 1]
pop edx
mul edx
seto cl
movsw word es:[edi], word [esi]
neg ecx
or ecx, eax
push ecx
call fcn.00404d68
pop ecx
xor ecx, ecx
cmp dword [ebp - 0x274], ebx
mov edi, eax
jbe 0x401aa1
mov eax, dword [ebp - 0x278]
add eax, ecx
movzx edx, byte [eax]
shr edx, 4
movsx dx, byte [ebp + edx - 0x50]
mov word [edi + ecx*4], dx
movzx eax, byte [eax]
and eax, 0xf
movsx ax, byte [ebp + eax - 0x50]
mov word [edi + ecx*4 + 2], ax
inc ecx
cmp ecx, dword [ebp - 0x274]
jb 0x401a6f
mov eax, dword [ebp - 0x274]
mov esi, dword [ebp - 0x27c]
push ebx
push ebx
mov word [edi + eax*4], bx
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push dword [ebp - 0x280]
call dword [esi + 0x1060]
push dword [ebp - 0x278]
mov dword [ebp - 0x27c], eax
call fcn.00404ead
cmp dword [ebp - 0x27c], ebx
pop ecx
je 0x401c01
push 0x208
lea eax, [ebp - 0x26c]
push ebx
push eax
mov dword [ebp - 0x270], ebx
call fcn.00404db0
add esp, 0xc
push ebx
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x27c]
call dword [esi + 0x1064]
test eax, eax
je 0x401bee
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x2d8], eax
push 2
pop eax
xor ecx, ecx
inc ecx
cmp byte [esi + 0x1032], bl
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x24
mov dword [ebp - 0x2dc], edi
mov dword [ebp - 0x2c4], 0x30
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2ac], eax
je 0x401b90
or dword [ebp - 0x29c], 0x1200
jmp 0x401b97
or dword [ebp - 0x29c], 0x10
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x60]
push eax
push 0xffffffffffffffff
call dword [esi + 0x1078]
mov ecx, dword [ebp - 0x294]
cmp ecx, ebx
mov dword [ebp - 0x288], eax
je 0x401bd1
cmp eax, 0x800b0100
mov word [ecx], bx
je 0x401bd1
push dword [ebp - 0x2a4]
mov edx, esi
call fcn.004016ba
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x60]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x2a8], 2
call dword [esi + 0x1078]
push ebx
push dword [ebp - 0x27c]
push dword [ebp - 0x280]
call dword [esi + 0x1068]
push edi
call fcn.00404ead
pop ecx
push ebx
push dword [ebp - 0x280]
call dword [esi + 0x106c]
mov eax, dword [ebp - 0x288]
call fcn.004012aa
jmp 0x401c2c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042d7
leave
ret 8