Function at 0x546c60
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x9b0
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x8a8], 0
mov qword [rbp + 0x498], 0
mov qword [rbp + 0x488], 0
mov qword [rbp + 0x480], 0
nop
mov eax, dword [0x00588ea4]
add eax, 0xaafc4583
mov dword [0x00588e90], eax
mov eax, dword [0x00588ea4]
add eax, 0x80b992cb
mov dword [0x00588ea0], eax
mov eax, dword [0x00588ea0]
add eax, 0x89206acd
mov dword [0x00588ea4], eax
add dword [0x00588e94], 0xa80b8077
mov eax, dword [0x00588ea0]
add eax, 0xbbb4774d
mov dword [0x00588e90], eax
mov eax, dword [0x00588ea4]
add eax, 0x1b50ff1d
mov dword [0x00588e94], eax
mov eax, dword [0x00588e9c]
xor eax, 0x862fa5c1
mov dword [0x00588e98], eax
add dword [0x00588ea0], 0x6e3dc4b0
and dword [0x00588ea8], 0x76a49cb2
mov eax, dword [0x00588ea8]
add eax, 0x2d76d450
mov dword [0x00588e90], eax
add dword [0x00588ea0], 0xb8ae3407
mov eax, dword [0x00588e9c]
add eax, 0x5e9d3d67
mov dword [0x00588e98], eax
mov eax, dword [0x00588ea4]
add eax, 0xb2f7a663
mov dword [0x00588ea0], eax
mov ecx, 0x2d4bd7dc
mov eax, dword [0x00588ea0]
xor edx, edx
div ecx
mov dword [0x00588e98], eax
mov ecx, 0x24cf81a0
mov eax, dword [0x00588ea8]
xor edx, edx
div ecx
mov dword [0x00588ea4], eax
mov eax, dword [0x00588ea0]
add eax, 0x6de7cbc8
mov dword [0x00588e94], eax
mov eax, dword [0x00588ea0]
add eax, 0x5fca6622
mov dword [0x00588e90], eax
mov eax, dword [0x00588e90]
and eax, 0x4c0bf112
mov dword [0x00588e98], eax
mov eax, dword [0x00588e98]
xor eax, 0xafdbe4e3
mov dword [0x00588ea8], eax
mov eax, dword [0x00588ea0]
add eax, 0xe81100cd
mov dword [0x00588e98], eax
mov eax, dword [0x00588e94]
and eax, 0x3afdc660
mov dword [0x00588e90], eax
mov eax, dword [0x00588ea4]
sub eax, 0x165c2312
mov dword [0x00588e94], eax
mov eax, dword [0x00588e9c]
add eax, 0x9a84cff6
mov dword [0x00588e98], eax
mov eax, dword [0x00588e90]
add eax, 0x9bdcf525
mov dword [0x00588e98], eax
mov eax, dword [0x00588ea0]
add eax, 0x1a64929f
mov dword [0x00588e90], eax
add dword [0x00588e94], 0x107a98fa
mov ecx, 0x83c017a0
mov eax, dword [0x00588e98]
xor edx, edx
div ecx
mov dword [0x00588e90], eax
mov eax, dword [0x00588e94]
and eax, 0x67854c54
mov dword [0x00588e98], eax
mov ecx, 0x26be5bf4
mov eax, dword [0x00588e9c]
xor edx, edx
div ecx
mov dword [0x00588ea8], eax
mov eax, dword [0x00588ea8]
add eax, 0x713e443a
mov dword [0x00588e90], eax
mov eax, dword [0x00588e9c]
add eax, 0x1f6f2e73
mov dword [0x00588e98], eax
mov eax, dword [0x00588ea4]
and eax, 0xe0006342
mov dword [0x00588e9c], eax
mov eax, dword [0x00588ea8]
add eax, 0x16c7dbc3
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e9c]
add eax, 0x16b25d89
mov dword [0x00588ea0], eax
mov eax, dword [0x00588ea4]
add eax, 0x996d6704
mov dword [0x00588ea0], eax
mov eax, dword [0x00588ea8]
add eax, 0x16876115
mov dword [0x00588e9c], eax
mov eax, dword [0x00588e9c]
add eax, 0xe535fb8a
mov dword [0x00588ea4], eax
mov eax, dword [0x00588ea0]
add eax, 0x8849be18
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e98]
add eax, 0xffc2a8bf
mov dword [0x00588e94], eax
mov eax, dword [0x00588ea4]
add eax, 0xeec9fc47
mov dword [0x00588ea8], eax
mov ecx, 0xb23677e8
mov eax, dword [0x00588ea4]
xor edx, edx
div ecx
mov dword [0x00588ea4], eax
mov eax, dword [0x00588e9c]
add eax, 0xf2d26bd4
mov dword [0x00588e94], eax
imul eax, dword [0x00588e94], 0x5968283d
mov dword [0x00588e90], eax
mov eax, dword [0x00588e9c]
add eax, 0x1192850a
mov dword [0x00588ea0], eax
mov eax, dword [0x00588ea8]
add eax, 0xe4748b80
mov dword [0x00588e90], eax
mov eax, dword [0x00588e90]
xor eax, 0x61790757
mov dword [0x00588e98], eax
mov eax, dword [0x00588e98]
and eax, 0x54b3c6e0
mov dword [0x00588e90], eax
mov eax, dword [0x00588e90]
add eax, 0xc51dfeb4
mov dword [0x00588ea0], eax
add dword [0x00588e98], 0x2a4617b4
mov eax, dword [0x00588e90]
add eax, 0x69746837
mov dword [0x00588e98], eax
mov eax, dword [0x00588ea8]
xor eax, 0x2b73406f
mov dword [0x00588ea4], eax
imul eax, dword [0x00588ea4], 0x909b596f
mov dword [0x00588e98], eax
mov eax, dword [0x00588e98]
add eax, 0x161c2b82
mov dword [0x00588ea4], eax
mov eax, dword [0x00588ea8]
add eax, 0x4a085d31
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e98]
xor eax, 0xfb24072b
mov dword [0x00588e90], eax
mov eax, dword [0x00588e9c]
add eax, 0xa69ea1bb
mov dword [0x00588ea8], eax
lea rcx, [rbp + 0x68]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x488]
mov rdx, qword [rbp + 0x68]
xor r8, r8
call fcn.0040f580
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x488]
call fcn.00546ac0
lea rcx, [rbp + 0x480]
mov rdx, qword [rbp + 0x60]
lea r8, [0x00547454]
call fcn.0040ee80
mov rcx, qword [rbp + 0x480]
call fcn.0040f240
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x547129
xor rcx, rcx
call sub.kernel32.dll_ExitProcess_1
mov rcx, rbx
xor rdx, rdx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
mov ecx, 0x40
mov edx, esi
call sub.kernel32.dll_GlobalAlloc
mov r13, rax
mov rcx, rbx
mov rdx, r13
mov r8d, esi
lea r9, [rbp + 0x4a4]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile_1
mov rcx, rbx
call sub.kernel32.dll_CloseHandle_1
mov byte [rbp + 0x7f], 0x48
mov byte [rbp + 0x80], 0x23
mov byte [rbp + 0x81], 0x62
mov byte [rbp + 0x82], 0x3f
mov byte [rbp + 0x83], 0x73
mov byte [rbp + 0x84], 0x71
mov byte [rbp + 0x85], 0x25
mov byte [rbp + 0x86], 0x2c
mov byte [rbp + 0x87], 0
mov rcx, r13
mov edx, esi
lea r8, [rbp + 0x7f]
mov r9d, 7
call fcn.00546bf0
mov rdi, rax
test rdi, rdi
jne 0x5471cd
xor rcx, rcx
call sub.kernel32.dll_ExitProcess_1
add rdi, 8
mov eax, edi
sub eax, r13d
sub esi, eax
mov eax, esi
xor rbx, rbx
sub eax, 1
cmp ebx, eax
jg 0x547207
add eax, 1
movsxd rcx, ebx
cmp byte [rdi + rcx], 0
je 0x547200
movsxd rcx, ebx
cmp byte [rdi + rcx], 0x56
je 0x547200
movsxd rcx, ebx
xor byte [rdi + rcx], 0x56
add ebx, 1
cmp ebx, eax
jne 0x5471e7
nop
mov rcx, qword [0x00588ed8]
call fcn.0040f240
mov rcx, rax
lea rdx, [0x00547460]
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x547265
lea rcx, [rbp + 0x58]
call fcn.00546620
mov rcx, qword [rbp + 0x58]
call fcn.0040f240
lea rcx, [rbp + 0x8b0]
mov rdx, rax
call sub.kernel32.dll_lstrcpyA
lea rcx, [0x00588ed8]
lea rdx, [rbp + 0x8b0]
mov r8d, pe_nt_image_headers64
xor r9, r9
call fcn.0040ecc0
lea rcx, [rbp + 0x498]
mov rdx, qword [0x00588ed8]
call fcn.0040f6a0
lea rcx, [rbp + 0x8a8]
call fcn.0040e080
xor rbx, rbx
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00588ed8]
call fcn.0040f6a0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x8a8]
call fcn.0040f6a0
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
mov r8, rdi
xor r9, r9
call fcn.00543830
mov rsi, rax
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep_1
mov rcx, rsi
lea rdx, [rbp + 0x494]
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [rbp + 0x494], 0x103
jne 0x547303
mov ecx, 1
call fcn.005494f0
mov ecx, 0x64
call sub.kernel32.dll_Sleep_1
xor rcx, rcx
call sub.kernel32.dll_ExitProcess_1
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep_1
add ebx, 1
cmp ebx, 6
jne 0x547287
nop
mov ecx, 1
call fcn.005494f0
mov ecx, 0x64
call sub.kernel32.dll_Sleep_1
xor rcx, rcx
call sub.kernel32.dll_ExitProcess_1