Function at 0x411cb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x48706c
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x4acab8]
xor eax, esp
mov dword [esp + 0x328], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4acab8]
xor eax, esp
push eax
lea eax, [esp + 0x340]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x350]
push 0x104
lea eax, [esp + 0x138]
xor esi, esi
push eax
mov ebx, ecx
push esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
push esi
cmp edi, 0xffffffff
jne 0x411d57
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], esi
push 0x490721
mov ecx, ebp
mov byte [ebp + 4], 0
call fcn.0040b580
jmp 0x412380
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push 0
push 0
mov esi, eax
push 0x61a80
sub esi, 0x61a80
push edi
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push esi
call fcn.00470f6e
add esp, 4
push 0
lea edx, [esp + 0x38]
push edx
push esi
push eax
push edi
mov dword [ebx + 0x958], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x411da7
cmp dword [esp + 0x34], esi
jne 0x411da7
xor bl, bl
jmp 0x411da9
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test bl, bl
je 0x411dd9
push 0
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], 0
push 0x490721
mov ecx, ebp
mov byte [ebp + 4], 0
call fcn.0040b580
jmp 0x412380
mov eax, str._attachedFile__
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411de1
sub eax, edx
mov dword [esp + 0x18], eax
mov eax, str._parameters_
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411df6
sub eax, edx
xor ebx, ebx
mov ecx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0xfc], 0xf
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
mov dword [esp + 0x348], ebx
test esi, esi
jbe 0x412341
jmp 0x411e35
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx + 0x958]
mov eax, dword [esp + 0x18]
lea esi, [ebx + edx]
mov edi, str._attachedFile__
mov ebp, esi
cmp eax, 4
jb 0x411e67
mov edx, dword [ebp]
cmp edx, dword [edi]
jne 0x411e9c
sub eax, 4
add edi, 4
add ebp, 4
cmp eax, 4
jae 0x411e52
test eax, eax
je 0x411fbf
mov dl, byte [edi]
cmp dl, byte [ebp]
jne 0x411e9c
cmp eax, 1
jbe 0x411fbf
mov dl, byte [edi + 1]
cmp dl, byte [ebp + 1]
jne 0x411e9c
cmp eax, 2
jbe 0x411fbf
mov al, byte [edi + 2]
cmp al, byte [ebp + 2]
je 0x411fbf
mov eax, ecx
mov edi, str._parameters_
mov ebp, esi
cmp ecx, 4
jb 0x411ec9
lea ebx, [ebx]
mov ecx, dword [ebp]
cmp ecx, dword [edi]
jne 0x412332
sub eax, 4
add edi, 4
add ebp, 4
cmp eax, 4
jae 0x411eb0
test eax, eax
je 0x411efa
mov dl, byte [edi]
cmp dl, byte [ebp]
jne 0x412332
cmp eax, 1
jbe 0x411efa
mov cl, byte [edi + 1]
cmp cl, byte [ebp + 1]
jne 0x412332
cmp eax, 2
jbe 0x411efa
mov dl, byte [edi + 2]
cmp dl, byte [ebp + 2]
jne 0x412332
lea eax, [esp + 0xe4]
push esi
lea ecx, [esp + 0x6c]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], 0x463af0
call fcn.00406e40
push str.__parameters_.___parameters__
lea ecx, [esp + 0x74]
call fcn.0040c390
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0xa8]
push edx
mov ecx, eax
mov byte [esp + 0x38c], 6
call fcn.004631f0
lea ecx, [esp + 0x70]
mov byte [esp + 0x17], al
mov byte [esp + 0x348], 0
call fcn.004639f0
cmp byte [esp + 0x17], 0
je 0x412332
mov eax, dword [esp + 0xf8]
lea ebx, [ebx + eax - 1]
jmp 0x412332
push str.__attachedFile_.___attachedFile__
lea ecx, [esp + 0x104]
call fcn.0040c390
mov ebp, 0xf
xor edi, edi
mov dword [esp + 0xbc], ebp
mov dword [esp + 0xb8], edi
mov byte [esp + 0xa8], 0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x958]
add eax, ebx
lea ecx, [esp + 0xa4]
mov byte [esp + 0x348], 2
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 0x463af0
mov dword [esp + 0x58], eax
lea edx, [eax + 1]
jmp 0x412020
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412020
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
sub eax, edx
push 0x4ac8fc
lea edx, [esp + 0x7c]
mov dword [esp + 0x98], eax
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x144]
call fcn.004631f0
test al, al
je 0x4122e6
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xd4], edi
mov byte [esp + 0xc4], 0
mov dword [esp + 0xdc], edi
mov eax, dword [esp + 0xb8]
lea ecx, [eax + ebx]
add ecx, dword [esi + 0x958]
mov edi, 0x10
lea edx, [esp + 0xc0]
mov byte [esp + 0x348], 3
mov dword [esp + 0xe0], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0x463af0
cmp dword [esp + 0xbc], edi
jb 0x412106
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x2c], ecx
jmp 0x412111
lea edx, [esp + 0xa8]
mov dword [esp + 0x2c], edx
push str._name__.____name_
lea ecx, [esp + 0x74]
mov dword [esp + 0x34], eax
call fcn.0040c390
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x6c]
push edx
mov ecx, eax
mov byte [esp + 0x38c], 4
call fcn.004631f0
lea ecx, [esp + 0x70]
mov byte [esp + 0x348], 3
call fcn.004639f0
lea eax, [esp + 0xdc]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0x462f20
cmp dword [esp + 0xbc], edi
jb 0x4121c4
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x38], ecx
jmp 0x4121cf
lea edx, [esp + 0xa8]
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0xb8]
push str._size__d___size_
lea ecx, [esp + 0x74]
mov dword [esp + 0x40], eax
call fcn.0040c390
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
push 0x4ac8fc
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x78]
push edx
mov ecx, eax
mov byte [esp + 0x38c], 5
call fcn.004631f0
lea ecx, [esp + 0x70]
mov byte [esp + 0x348], 3
call fcn.004639f0
mov edi, dword [esi + 0x970]
mov ecx, dword [edi + 4]
add esi, 0x95c
lea eax, [esp + 0xc0]
push eax
push ecx
push edi
mov ecx, esi
call fcn.00419df0
push 1
mov ecx, esi
mov ebp, eax
call fcn.0045ce30
mov dword [edi + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
mov edx, dword [esp + 0xdc]
mov eax, dword [esp + 0xb8]
add eax, edx
cmp dword [esp + 0xd8], 0x10
lea ebx, [ebx + eax - 1]
jb 0x4122c1
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.0046fa18
add esp, 4
xor edi, edi
mov dword [esp + 0xd8], 0xf
mov dword [esp + 0xd4], 0
mov byte [esp + 0xc4], 0
lea ebp, [edi + 0xf]
jmp 0x4122ee
mov edx, dword [esp + 0x18]
lea ebx, [ebx + edx - 1]
cmp dword [esp + 0xbc], 0x10
jb 0x412308
mov eax, dword [esp + 0xa8]
push eax
call fcn.0046fa18
add esp, 4
lea ecx, [esp + 0x100]
mov dword [esp + 0xbc], ebp
mov dword [esp + 0xb8], edi
mov byte [esp + 0xa8], 0
mov byte [esp + 0x348], 0
call fcn.004639f0
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x411e31
mov ebp, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xec]
push ecx
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], 0
mov ecx, ebp
mov byte [ebp + 4], 0
call fcn.0040b360
cmp dword [esp + 0xfc], 0x10
jb 0x412380
mov edx, dword [esp + 0xe8]
push edx
call fcn.0046fa18
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x340]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x328]
xor ecx, esp
call fcn.00470538
add esp, 0x338
ret 4