Function at 0x4f15d0
Capabilities:
Get file size
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56912c
mov eax, dword fs:[0]
push eax
mov eax, 0x101fc
call fcn.00543120
mov eax, dword [0x5b3680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x5ba584]
push 0x5ba590
mov dword [ebp - 0x10014], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ecx
mov ecx, edi
call fcn.004f2f80
xor ecx, ecx
mov esi, eax
mov edx, 0xc50
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0050e106
push ecx
lea ecx, [ebp - 0x10020]
mov dword [ebp - 0x10044], eax
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x10020], esi
call fcn.004f3000
mov eax, dword [0x5b9c88]
mov dword [ebp - 0x1001c], eax
test eax, eax
jne 0x4f169c
push 0x48
call fcn.00529b2d
add esp, 4
mov dword [ebp - 0x10018], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4f1688
mov ecx, eax
call fcn.004385b0
jmp 0x4f168a
xor eax, eax
mov dword [ebp - 0x1001c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x5b9c88], eax
cmp dword [ebp - 0x10020], 0
mov dword [ebp - 0x10038], 0
jle 0x4f198b
mov ebx, dword [ebp - 0x10044]
add ebx, 0x208
nop
cmp dword [ebx + 0x628], 0
jbe 0x4f1985
push ecx
lea ecx, [ebp - 0x10208]
call fcn.00424e90
mov dword [ebp - 4], 1
lea eax, [ebx - 0x208]
test eax, eax
jne 0x4f16ee
xor ecx, ecx
jmp 0x4f1706
lea ecx, [ebx - 0x208]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f16f7
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebx - 0x208]
push eax
lea ecx, [ebp - 0x101c4]
call fcn.00402600
lea edx, [ebx + 0x410]
test edx, edx
jne 0x4f1727
xor ecx, ecx
jmp 0x4f173f
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1730
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x101c0]
call fcn.00402600
mov eax, dword [ebp - 0x10208]
lea esi, [ebp - 0x101b8]
mov eax, dword [eax + 4]
add esi, eax
test ebx, ebx
jne 0x4f1765
xor ecx, ecx
jmp 0x4f177f
mov ecx, ebx
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1770
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov ecx, esi
call fcn.00402600
mov eax, dword [ebx + 0x628]
mov dword [ebp - 0x101bc], eax
lea eax, [ebp - 0x101b8]
push eax
lea eax, [ebx + 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x10018]
mov dword [ebp - 0x10018], 0x7fff
push eax
lea eax, [ebp - 0x10010]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 0x10208]
lea ecx, [ebp - 0x101b4]
lea edx, [ebp - 0x10010]
lea esi, [edx + 2]
mov eax, dword [eax + 4]
add ecx, eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4f17e0
sub edx, esi
lea eax, [ebp - 0x10010]
sar edx, 1
push edx
push eax
call fcn.00402600
cmp word [ebx + 0x838], 0x2f
lea edi, [ebx + 0x838]
je 0x4f192c
xor esi, esi
mov dword [ebp - 0x10040], esi
mov byte [ebp - 4], 2
mov dword [ebp - 0x1003c], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x100a0]
call fcn.00423e90
mov byte [ebp - 4], 4
test edi, edi
jne 0x4f183d
xor ecx, ecx
jmp 0x4f1851
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1842
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x1008c]
call fcn.00402600
lea eax, [ebp - 0x100a0]
push eax
lea ecx, [ebp - 0x10204]
call fcn.00480f50
cmp dword [ebp - 0x10200], 0
jbe 0x4f1b24
mov eax, dword [ebp - 0x10204]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4f1a1f
call fcn.004160c0
test eax, eax
je 0x4f1a27
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 6
lea eax, [ebp - 0x10080]
mov dword [ebp - 0x10034], eax
mov byte [ebp - 4], 6
mov ecx, eax
call fcn.00431f40
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1008c]
mov dword [ebp - 0x10034], eax
mov byte [ebp - 4], 5
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1008c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f1909
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov dword [ebp - method.SecC::CSerialObject.virtual_0], vtable.SecC::CSerialObject.0
mov byte [ebp - 4], 1
test esi, esi
je 0x4f192c
push esi
call edi
mov dword [ebp - 0x10040], 0
mov eax, dword [ebp - 0x10208]
lea ecx, [ebp - 0x10208]
mov eax, dword [eax + 4]
add eax, ecx
mov ecx, dword [ebp - 0x1001c]
push eax
call fcn.00438b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1017c]
call fcn.00425920
lea ecx, [ebp - 0x1017c]
call fcn.0041f1f0
mov ecx, dword [ebp - 0x10038]
add ebx, 0xc50
inc ecx
mov dword [ebp - 0x10038], ecx
cmp ecx, dword [ebp - 0x10020]
jl 0x4f16c0
mov edi, dword [ebp - 0x10014]
push dword [ebp - 0x10044]
call fcn.0052c39b
mov eax, dword [edi + 0x50]
add esp, 4
mov esi, dword [eax]
cmp esi, eax
je 0x4f1bab
jmp 0x4f19b0
mov eax, dword [esi + 0x850]
test eax, 0x100
jne 0x4f1b4b
test al, al
js 0x4f1b4b
lea ecx, [esi + 0x1c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f19d0
sub ecx, edx
sar ecx, 1
je 0x4f1b4b
cmp byte [esi + 0xd], al
jne 0x4f1ba2
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x4f1b2e
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x4f1ba2
lea esp, [esp]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x4f1a10
jmp 0x4f1ba2
mov esi, eax
mov dword [ebp - 0x10040], esi
cmp dword [ebp - 0x10200], 0
jbe 0x4f1b24
mov edi, dword [ebp - 0x10204]
lea eax, [ebp - 0x1004c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10050], eax
cmp eax, 0xffffffff
jne 0x4f1a82
call fcn.004160c0
test eax, eax
jns 0x4f1a7c
je 0x4f1a8e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4f18ba
push esi
call edi
xor esi, esi
mov dword [ebp - 0x10040], esi
jmp 0x4f18ba
mov eax, dword [ebp - 0x10050]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x1004c]
mov dword [edi + 0x1c], eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4f1aa3
push esi
call edi
xor esi, esi
mov dword [ebp - 0x10040], esi
xor eax, eax
mov dword [ebp - 0x10030], 0
lea ecx, [ebp - 0x10030]
mov dword [ebp - 0x1002c], eax
mov dword [ebp - 0x10028], eax
mov dword [ebp - 0x10024], eax
call fcn.004f4a10
cmp dword [ebp - 0x10200], 0
jbe 0x4f1b24
mov eax, dword [ebp - 0x10204]
sub esp, 0x10
movdqu xmm0, xmmword [ebp - 0x10030]
mov ecx, dword [eax + 0x14]
mov eax, esp
push ecx
mov ecx, dword [ebp - 0x10014]
movdqu xmmword [eax], xmm0
call fcn.00438910
test eax, eax
js 0x4f18ba
cmp dword [ebp - 0x10200], 0
jbe 0x4f1b24
mov eax, dword [ebp - 0x10204]
movdqu xmm0, xmmword [ebp - 0x10030]
movdqu xmmword [eax + 4], xmm0
jmp 0x4f18ba
push 0x80070057
call fcn.004027b0
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x4f1b47
cmp esi, dword [eax + 8]
jne 0x4f1b47
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x4f1b37
mov esi, eax
jmp 0x4f1ba2
cmp byte [esi + 0xd], 0
mov eax, esi
jne 0x4f1b92
mov ecx, dword [esi + 8]
cmp byte [ecx + 0xd], 0
jne 0x4f1b72
mov esi, ecx
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4f1b92
mov esi, ecx
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
je 0x4f1b66
jmp 0x4f1b92
mov ecx, dword [esi + 4]
cmp byte [ecx + 0xd], 0
jne 0x4f1b90
jmp 0x4f1b80
cmp esi, dword [ecx + 8]
jne 0x4f1b90
mov esi, ecx
mov ecx, dword [ecx + 4]
cmp byte [ecx + 0xd], 0
je 0x4f1b80
mov esi, ecx
push eax
lea eax, [ebp - 0x10018]
push eax
lea ecx, [edi + 0x50]
call fcn.004f3780
cmp esi, dword [edi + 0x50]
jne 0x4f19b0
push 0x5ba590
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005295e2
mov esp, ebp
pop ebp
ret