Function at 0x1014edc0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x26a0
call fcn.10123010
mov eax, dword [0x101c1b88]
xor eax, ebp
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push str.GlobalLCMS_Single_EventRead
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0xc], eax
push str.GlobalLCMS_Single_EventWrite
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
je 0x1014ee83
cmp dword [ebp - 0x10], 0
je 0x1014ee83
push str.GlobalLCMS_Single_ShareMemory
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1014ee83
push 0x87804
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1014ee83
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jne 0x1014ee96
cmp dword [0x101d98b0], 0
je 0x1014f539
mov dword [ebp - 0x1128], 0
push 0x10ec
push 0
lea ecx, [ebp - 0x1124]
push ecx
call fcn.1011e8d0
add esp, 0xc
mov byte [ebp - 0x2128], 0
push 0xfff
push 0
lea edx, [ebp - 0x2127]
push edx
call fcn.1011e8d0
add esp, 0xc
mov dword [ebp - 0x30], 0
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0x1000
lea eax, [ebp - 0x2128]
push eax
call fcn.1011ab0e
add esp, 0x10
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x1129], 0
cmp dword [ebp - 0x30], 0x1000
jne 0x1014ef1f
mov ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0xffffffff
jne 0x1014ef2c
mov dword [ebp - 0x30], 0x1000
cmp dword [ebp + 8], 1
jne 0x1014f041
cmp dword [ebp - 4], 0
je 0x1014f041
mov dword [ebp - 0x252c], 0
mov edx, dword [0x101c8af0]
mov dword [ebp - 0x2528], edx
mov eax, dword [0x101c8af4]
mov dword [ebp - 0x2524], eax
push 0x3f8
push 0
lea ecx, [ebp - 0x2520]
push ecx
call fcn.1011e8d0
add esp, 0xc
push 0
push 0x3f9
lea edx, [ebp - 0x2521]
push edx
push 0x400
mov eax, dword [ebp - 4]
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea ecx, [ebp - 0x2528]
push ecx
call fcn.1011e3a0
add esp, 4
mov dword [ebp - 0x252c], eax
mov edx, 0x1000
sub edx, dword [ebp - 0x30]
sub edx, 1
cmp dword [ebp - 0x252c], edx
jge 0x1014efd1
mov eax, dword [ebp - 0x252c]
mov dword [ebp - 0x2690], eax
jmp 0x1014efe2
mov ecx, 0x1000
sub ecx, dword [ebp - 0x30]
sub ecx, 1
mov dword [ebp - 0x2690], ecx
mov edx, dword [ebp - 0x2690]
push edx
lea eax, [ebp - 0x2528]
push eax
mov ecx, dword [ebp - 0x30]
lea edx, [ebp + ecx - 0x2128]
push edx
call fcn.1011c900
add esp, 0xc
mov eax, 0x1000
sub eax, dword [ebp - 0x30]
sub eax, 1
cmp dword [ebp - 0x252c], eax
jge 0x1014f024
mov ecx, dword [ebp - 0x252c]
mov dword [ebp - 0x2694], ecx
jmp 0x1014f035
mov edx, 0x1000
sub edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x2694], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x2694]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0xf1
mov dword [ebp - 0x1128], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1124], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x10c4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10c0], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x26]
push ecx
movzx edx, word [ebp - 0x2a]
push edx
movzx eax, word [ebp - 0x2c]
push eax
push 0x101c8af8
lea ecx, [ebp - 0x1120]
push ecx
call fcn.1011a63e
add esp, 0x14
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x24]
push edx
push str._02d:_02d:_02d._03d
lea eax, [ebp - 0x1114]
push eax
call fcn.1011a63e
add esp, 0x18
mov dword [ebp - 0x263c], 0
mov byte [ebp - 0x2638], 0
push 0x103
push 0
lea ecx, [ebp - 0x2637]
push ecx
call fcn.1011e8d0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x2638]
push edx
mov eax, dword [0x101d98ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x2640], eax
mov ecx, dword [ebp - 0x2640]
sub ecx, 1
mov dword [ebp - 0x263c], ecx
jmp 0x1014f12b
mov edx, dword [ebp - 0x263c]
sub edx, 1
mov dword [ebp - 0x263c], edx
cmp dword [ebp - 0x263c], 0
jl 0x1014f14b
mov eax, dword [ebp - 0x263c]
movsx ecx, byte [ebp + eax - 0x2638]
cmp ecx, 0x5c
jne 0x1014f149
jmp 0x1014f14b
jmp 0x1014f11c
cmp dword [ebp - 0x263c], 0
jle 0x1014f1a7
mov edx, dword [ebp - 0x2640]
sub edx, dword [ebp - 0x263c]
cmp edx, 0x3f
jle 0x1014f171
mov dword [ebp - 0x2698], 0x3f
jmp 0x1014f183
mov eax, dword [ebp - 0x2640]
sub eax, dword [ebp - 0x263c]
mov dword [ebp - 0x2698], eax
mov ecx, dword [ebp - 0x2698]
push ecx
mov edx, dword [ebp - 0x263c]
lea eax, [ebp + edx - 0x2637]
push eax
lea ecx, [ebp - 0x1104]
push ecx
call fcn.1011c900
add esp, 0xc
mov dword [ebp - 0x2644], 0
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
cmp eax, 0x2e
jne 0x1014f1d1
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + 1]
cmp edx, 0x5c
jne 0x1014f1d1
mov eax, dword [ebp + 0xc]
add eax, 2
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1011e3a0
add esp, 4
mov dword [ebp - 0x2644], eax
cmp dword [ebp - 0x2644], 0x3f
jle 0x1014f1f8
mov dword [ebp - 0x269c], 0x3f
jmp 0x1014f204
mov edx, dword [ebp - 0x2644]
mov dword [ebp - 0x269c], edx
mov eax, dword [ebp - 0x269c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10bc]
push edx
call fcn.1011c900
add esp, 0xc
mov dword [ebp - 0x2648], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.1011e3a0
add esp, 4
mov dword [ebp - 0x2648], eax
cmp dword [ebp - 0x2648], 0x3f
jle 0x1014f24f
mov dword [ebp - 0x26a0], 0x3f
jmp 0x1014f25b
mov ecx, dword [ebp - 0x2648]
mov dword [ebp - 0x26a0], ecx
mov edx, dword [ebp - 0x26a0]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x107c]
push ecx
call fcn.1011c900
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x103c], edx
push 0xfff
lea eax, [ebp - 0x2128]
push eax
lea ecx, [ebp - 0x1038]
push ecx
call fcn.1011c900
add esp, 0xc
cmp dword [ebp - 0x14], 0
je 0x1014f34d
push 0x3e8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x264c], eax
cmp dword [ebp - 0x264c], 0
jne 0x1014f339
mov dword [ebp - 0x2650], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2654], eax
mov ecx, dword [ebp - 0x2654]
cmp dword [ecx], 0x80
jne 0x1014f2f0
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x2650], edx
jmp 0x1014f31e
mov eax, dword [ebp - 0x2654]
mov ecx, dword [eax]
imul ecx, ecx, 0x10f0
mov edx, dword [ebp - 0x18]
lea eax, [edx + ecx + 4]
mov dword [ebp - 0x2650], eax
mov ecx, dword [ebp - 0x2654]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp - 0x2654]
mov dword [eax], edx
push 0x10f0
lea ecx, [ebp - 0x1128]
push ecx
mov edx, dword [ebp - 0x2650]
push edx
call fcn.1011e560
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x101d98b0], 0
je 0x1014f539
cmp dword [0x101c8894], 0xffffffff
je 0x1014f539
push 0x1f4
mov edx, dword [0x101d98b4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2658], eax
cmp dword [ebp - 0x2658], 0
jne 0x1014f539
push 0
mov eax, dword [0x101c8894]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [0x101d98b8]
jae 0x1014f52c
mov dword [ebp - 0x2670], 0
mov dword [ebp - 0x266c], 0
xor ecx, ecx
mov dword [ebp - 0x2668], ecx
mov dword [ebp - 0x2664], ecx
mov dword [ebp - 0x2660], ecx
mov dword [ebp - 0x265c], ecx
mov dword [ebp - 0x2674], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x265c], eax
lea edx, [ebp - 0x266c]
push edx
push 0
mov eax, dword [ebp - 0x1128]
push eax
push 0
push 2
mov ecx, dword [0x101c8894]
push ecx
call dword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [ebp - 0x2670], eax
cmp dword [ebp - 0x2670], 0
jne 0x1014f474
push 0x1f4
mov edx, dword [ebp - 0x265c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2658], eax
cmp dword [ebp - 0x2658], 0
jne 0x1014f468
push 1
lea eax, [ebp - 0x2674]
push eax
lea ecx, [ebp - 0x266c]
push ecx
mov edx, dword [0x101c8894]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 0x2670], eax
jmp 0x1014f474
mov eax, dword [0x101c8894]
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
cmp dword [ebp - 0x2670], 0
je 0x1014f51f
mov dword [ebp - 0x268c], 0
mov dword [ebp - 0x2688], 0
xor ecx, ecx
mov dword [ebp - 0x2684], ecx
mov dword [ebp - 0x2680], ecx
mov dword [ebp - 0x267c], ecx
mov dword [ebp - 0x2678], ecx
push 0
mov edx, dword [0x101c8894]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x2680], eax
lea eax, [ebp - 0x2688]
push eax
lea ecx, [ebp - 0x268c]
push ecx
mov edx, dword [ebp - 0x1128]
push edx
lea eax, [ebp - 0x1128]
push eax
mov ecx, dword [0x101c8894]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x2670], eax
mov edx, dword [0x101c8894]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea eax, [ebp - 0x266c]
push eax
push 0
mov ecx, dword [ebp - 0x1128]
push ecx
push 0
mov edx, dword [0x101c8894]
push edx
call dword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov eax, dword [ebp - 0x265c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x101d98b4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x18], 0
je 0x1014f549
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 8], 0
je 0x1014f559
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x1014f569
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
je 0x1014f579
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.1011a380
mov esp, ebp
pop ebp
ret