Function at 0x5fefbc5e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x1c], ebx
jne 0x5fefbc76
xor eax, eax
jmp 0x5fefbf54
cmp dword [ebp + 0x14], ebx
je 0x5fefbc6f
cmp dword [ebp + 0x18], ebx
jbe 0x5fefbc6f
push esi
push edi
push ebx
push dword [ebp + 0x1c]
call fcn.5ff22963
pop ecx
pop ecx
test eax, eax
jne 0x5fefbf1d
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp + 0x1c], esi
cmp esi, 0xffffffff
je 0x5fefbf1d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x5fefbf16
cmp edi, 0xffffffff
je 0x5fefbf16
lea eax, [edi + 2]
mov esi, 0x5ff44f7c
push esi
push eax
mov dword [ebp - 0xc], eax
call fcn.5ff21e90
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x5fefbcf9
push dword [ebp + 0x1c]
jmp 0x5fefbf17
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x1c]
test eax, eax
jne 0x5fefbd19
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5fefbd73
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
je 0x5fefbd73
and dword [ebp - 8], 0
cmp edi, 3
jb 0x5fefbd4c
cmp byte [ebx], 0xff
jne 0x5fefbd4c
cmp byte [ebx + 1], 0xfe
jne 0x5fefbd4c
mov ecx, edi
shr ecx, 1
lea eax, [ebx + 2]
xor edx, edx
mov dword [ebp - 4], eax
mov word [eax + ecx*2 - 2], dx
jmp 0x5fefbdba
mov eax, dword [ebp - 0xc]
push esi
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
mov word [ebx + edi], 0
neg ecx
or ecx, eax
push ecx
call fcn.5ff21e90
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x5fefbd79
push ebx
jmp 0x5fefbece
and dword [ebp - 0x14], 0
push edi
push ebx
push dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.5ff22eee
add esp, 0x14
test eax, eax
je 0x5fefbda7
push ebx
call fcn.5ff1fe4c
push dword [ebp - 4]
call fcn.5ff1fe4c
pop ecx
jmp 0x5fefbed3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
xor eax, eax
mov word [edx + ecx*2], ax
mov dword [ebp - 8], 1
push esi
xor ecx, ecx
push 2
pop edx
cmp dword [ebp + 0xc], ecx
jne 0x5fefbe7a
mov eax, dword [ebp - 0xc]
mul edx
mov byte [ebp + 0x1f], cl
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.5ff21e90
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x5fefbe93
push dword [ebp - 0xc]
xor eax, eax
push edi
push dword [ebp + 8]
mov word [edi], ax
push dword [ebp - 4]
call fcn.5fefb5d7
mov esi, eax
add esp, 0x10
cmp dword [ebp + 0x18], esi
jae 0x5fefbe0f
mov esi, dword [ebp + 0x18]
mov byte [ebp + 0x1f], 1
cmp esi, 1
jbe 0x5fefbe3e
lea edx, [esi - 2]
test edx, edx
je 0x5fefbe34
mov eax, dword [ebp + 0x14]
mov ecx, edi
sub ecx, eax
mov dword [ebp - 0xc], edx
mov dx, word [ecx + eax]
mov word [eax], dx
add eax, 2
dec dword [ebp - 0xc]
jne 0x5fefbe25
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov word [ecx + esi*2 - 4], ax
mov ecx, dword [ebp + 0x14]
xor eax, eax
push edi
mov word [ecx + esi*2 - 2], ax
call fcn.5ff1fe4c
push ebx
call fcn.5ff1fe4c
cmp dword [ebp - 8], 1
pop ecx
pop ecx
jne 0x5fefbe65
push dword [ebp - 4]
call fcn.5ff1fe4c
pop ecx
cmp byte [ebp + 0x1f], 0
lea eax, [esi - 2]
jne 0x5fefbf52
lea eax, [esi - 1]
jmp 0x5fefbf52
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.5ff21e90
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5fefbe9b
push ebx
call fcn.5ff1fe4c
jmp 0x5fefbec4
push edi
push esi
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
mov word [esi], ax
push dword [ebp - 4]
call fcn.5fefb1f1
add esp, 0x14
push esi
test eax, eax
jne 0x5fefbed6
call fcn.5ff1fe4c
push ebx
call fcn.5ff1fe4c
pop ecx
cmp dword [ebp - 8], 1
pop ecx
jne 0x5fefbf1d
push dword [ebp - 4]
call fcn.5ff1fe4c
pop ecx
jmp 0x5fefbf1d
mov edi, dword [ebp + 0x18]
push 0x5ff370e4
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
call fcn.5ff22c6b
mov ecx, dword [ebp + 0x14]
xor eax, eax
push esi
mov word [ecx + edi*2 - 2], ax
call fcn.5ff1fe4c
push ebx
call fcn.5ff1fe4c
add esp, 0x1c
cmp dword [ebp - 8], 1
jne 0x5fefbf11
push dword [ebp - 4]
call fcn.5ff1fe4c
pop ecx
push dword [ebp + 0x14]
jmp 0x5fefbf4c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 0x18]
push 0xffffffffffffffff
lea eax, [esi - 1]
jne 0x5fefbf32
push 0x5ff355d4
jmp 0x5fefbf35
push dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call fcn.5ff22510
mov ecx, dword [ebp + 0x14]
add esp, 0x10
xor eax, eax
mov word [ecx + esi*2 - 2], ax
push ecx
call fcn.5ff1f982
pop ecx
pop edi
pop esi
pop ebx
leave
ret