Function at 0x411cc4
Capabilities:
Get file size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
add eax, 0xdc
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x411e94
cmp dword [ebp - 0x10], 0
je 0x411e94
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
add eax, 0xa00000
cmp eax, dword [ebp - 0x2c]
jbe 0x411d95
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
je 0x411d62
push 5
mov eax, dword [0x4207c4]
mov eax, dword [eax]
push eax
mov eax, dword [0x420598]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jne 0x411d7f
mov al, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00411cc4
jmp 0x411e94
cmp dword [ebp - 0x14], 2
jne 0x411e94
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
jmp 0x411e94
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax + 0x38], dl
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2c], 0
jne 0x411e22
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0xc0], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xbc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x411dda
mov eax, dword [ebp - 4]
call fcn.00411f28
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x34]
mov edx, dword [ebp - 4]
movsx edx, byte [edx + 0x35]
sub edx, eax
ja 0x411e8e
dec edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
push ebp
mov al, byte [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x38]
call fcn.00411c6c
pop ecx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx + 0x3a], al
dec dword [ebp - 0x10]
inc dword [ebp - 0x18]
jne 0x411dfe
jmp 0x411e8e
cmp dword [ebp - 8], 0
je 0x411e8e
push 0x64
mov eax, dword [ebp - 0xc]
push eax
push 0x404
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
movsx eax, byte [eax + 0x34]
mov edx, dword [ebp - 4]
movsx edx, byte [edx + 0x35]
sub edx, eax
ja 0x411e8e
dec edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp byte [eax + edx + 0x3a], 0
jne 0x411e7a
push ebp
mov al, byte [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x38]
call fcn.00411c6c
pop ecx
test al, al
jne 0x411e7a
xor eax, eax
jmp 0x411e7c
mov al, 1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx + 0x3a], al
dec dword [ebp - 0x10]
inc dword [ebp - 0x18]
jne 0x411e55
mov eax, dword [ebp - 4]
inc dword [eax + 0x2c]
mov esp, ebp
pop ebp
ret 4