Function at 0x4150e0
Capabilities:
Access peb ldr_data
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x4a054c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
mov eax, dword [0x4a703c]
mov dword [esp + 0xc], ecx
mov cx, word [0x4a7040]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x28], cx
mov dword [esp + 0x24], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x12c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x2c]
xor bl, bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
mov edi, 0x4a704c
xor eax, eax
lea edx, [esp + 0x12c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x13], 0
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x18], 0
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a7018
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a7014
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4a7014
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x30]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 3
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push eax
push eax
and ecx, 3
lea eax, [esp + 0x40]
push connect
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp esi, 0xffffffff
mov ebp, eax
je 0x415256
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0x2c]
push 0x4a7008
push ecx
call fcn.0049274b
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x4155e5
lea edi, [ebp + 1]
push edi
call fcn.00491cd3
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
mov dword [esp + 0x24], esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
push edi
push 1
push ebp
push esi
call fcn.0049275e
push edi
call fcn.00492564
push 0x114
call fcn.00491cd3
add esp, 0x1c
mov dword [esp + 0x14], eax
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x234], ecx
je 0x4152dc
lea ecx, [esp + 0x24]
push ecx
push esi
mov ecx, eax
call fcn.00490ba0
mov dword [esp + 0x14], eax
jmp 0x4152e0
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x14]
or ebp, 0xffffffff
mov ecx, edi
mov dword [esp + 0x234], ebp
call fcn.00490c00
mov esi, eax
test esi, esi
je 0x415600
mov al, byte [esp + 0x13]
test al, al
je 0x41559d
movsx eax, al
dec eax
jne case.default.0x415322
movsx eax, bl
dec eax
cmp eax, 8
ja case.default.0x415322
jmp dword [eax*4 + 0x41562c]
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x415361
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x415351
cmp al, 0x30
jl 0x4155ca
cmp al, 0x39
jg 0x4155ca
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x41533a
push esi
call fcn.00492900
mov ebx, dword [esp + 0x20]
add esp, 4
mov ecx, dword [ebx + eax*4 + 0x4b2e4]
test ecx, ecx
jne 0x4155ca
push 0x34
call fcn.00491cd3
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x234], 1
je 0x4153a5
mov ecx, eax
call fcn.0048f9e0
mov edi, eax
jmp 0x4153a7
xor edi, edi
push esi
mov dword [esp + 0x238], ebp
call fcn.00492900
push esi
mov dword [ebx + eax*4 + 0x4b2e4], edi
call fcn.00492900
add esp, 8
mov dword [esp + 0x18], eax
mov bl, 2
jmp case.default.0x415322
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, 7
xor eax, eax
mov edi, dword [ebx + edx*4 + 0x4b2e4]
add edi, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, esi
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [ebx + edx*4 + 0x4b2e4]
mov bl, 3
not ecx
dec ecx
add edi, 4
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.default.0x415322
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41544f
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x41543f
cmp al, 0x30
jl 0x4155ca
cmp al, 0x39
jg 0x4155ca
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x415428
push esi
call fcn.00492900
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
mov bl, 4
mov ecx, dword [ecx + edx*4 + 0x4b2e4]
mov dword [ecx + 0x24], eax
jmp case.default.0x415322
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4154a9
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x415499
cmp al, 0x30
jl 0x4155ca
cmp al, 0x39
jg 0x4155ca
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x415482
push esi
call fcn.00492900
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov bl, 5
mov edx, dword [edx + ecx*4 + 0x4b2e4]
mov dword [edx + 0x28], eax
jmp case.default.0x415322
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x415503
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x4154f3
cmp al, 0x30
jl 0x4155ca
cmp al, 0x39
jg 0x4155ca
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x4154dc
push esi
call fcn.00492900
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add esp, 4
mov bl, 6
mov ecx, dword [ecx + edx*4 + 0x4b2e4]
mov dword [ecx + 0x2c], eax
jmp case.default.0x415322
mov bl, 7
jmp case.default.0x415322
mov bl, 8
jmp case.default.0x415322
mov bl, 9
jmp case.default.0x415322
mov edi, esi
mov ecx, ebp
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x415567
mov al, byte [edx + esi]
cmp al, 0x2d
je 0x415557
cmp al, 0x30
jl 0x4155ca
cmp al, 0x39
jg 0x4155ca
mov edi, esi
mov ecx, ebp
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x415548
push esi
call fcn.00492900
mov edx, dword [esp + 0x20]
add esp, 4
test eax, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + eax*4 + 0x4b2e4]
jne 0x415590
mov byte [ecx + 0x30], 0
mov byte [esp + 0x13], 0
xor bl, bl
jmp case.default.0x415322
mov byte [ecx + 0x30], 1
mov byte [esp + 0x13], 0
xor bl, bl
jmp case.default.0x415322
mov ecx, 5
mov edi, 0x4a7044
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne case.default.0x415322
mov byte [esp + 0x13], 1
mov bl, 1
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.00490c00
mov esi, eax
test esi, esi
je 0x415600
jmp 0x4152ff
mov eax, dword [esp + 0x20]
push eax
call fcn.00491cc8
mov ecx, dword [esp + 0x18]
add esp, 4
test ecx, ecx
je 0x4155e5
mov edx, dword [ecx]
push 1
call dword [edx]
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x228
ret
test edi, edi
je 0x41560c
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00491cc8
mov al, byte [esp + 0x17]
add esp, 4
test al, al
jne 0x4155e5
test bl, bl
jne 0x4155e5
mov eax, 1
jmp 0x4155e7