Function at 0x495940
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4adc90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebx + 0xa0], edi
mov eax, dword [ebx + 8]
cmp eax, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edi
je 0x49597d
call fcn.00496250
cmp dword [ebp + 0xc], edi
jne 0x495987
mov dword [ebx + 0x20], edi
jmp 0x49598e
mov dword [ebx + 0x20], 1
lea ecx, [ebx + 0x24]
call fcn.0049bf20
push 0x10000
call fcn.004a5840
add esp, 4
cmp eax, edi
mov dword [ebx + 0x7c], eax
jne 0x4959bf
push 0x548bf0
push edi
push 0x53
push 0x548b80
call fcn.004a4ed0
add esp, 0x10
mov esi, dword [ebp + 8]
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push esi
call dword [0x54b4dc]
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
jne 0x4959f7
push esi
push str.CreateFile__s__
push edi
push 0x56
push 0x548b80
call fcn.004a4ed0
add esp, 0x14
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x495a1e
push 0x548b58
push edi
push 0x57
push 0x548b80
call fcn.004a4ed0
add esp, 0x10
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x9c], edi
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x88], edi
lea esi, [ebx + 0xa4]
mov dword [ebx + 0x8c], edi
lea ecx, [ebp - 0x14]
mov dword [ebx + 0x80], edi
push edi
mov word [esi], di
mov edx, dword [ebx + 8]
push ecx
push 2
push esi
push edx
call dword [0x54b4c4]
cmp eax, edi
jne 0x495a80
mov eax, dword [ebp + 8]
push eax
push str.ReadFile__s__
push edi
push 0x63
push 0x548b80
call fcn.004a4ed0
add esp, 0x14
cmp word [esi], 0x5a4d
je 0x495a9d
push 0x548b38
push 1
push 0x64
push 0x548b80
call fcn.004a5660
add esp, 0x10
mov edx, dword [ebx + 0x20]
xor ecx, ecx
push edx
xor eax, eax
push 0x40
push ecx
push eax
push esi
mov ecx, ebx
call fcn.00497af0
cmp eax, edi
jne 0x495aba
call fcn.004a57d0
mov eax, dword [ebx + 0xe0]
mov ecx, dword [ebx + 0x14]
add eax, 4
cmp edi, ecx
jl 0x495af1
jg 0x495ad1
cmp eax, dword [ebx + 0x10]
jbe 0x495af1
push 0x548b24
push 1
push 0x6e
push 0x548b80
mov dword [ebx + 0xa0], 2
call fcn.004a5660
add esp, 0x10
mov eax, dword [ebx + 0xe0]
lea ecx, [ebp - 0x18]
cdq
mov esi, eax
mov eax, dword [ebx + 0x20]
mov edi, edx
push eax
push 4
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00497af0
test eax, eax
jne 0x495b18
call fcn.004a57d0
mov ecx, dword [ebp - 0x18]
mov eax, ecx
and eax, 0xffff
sub eax, 0x454c
je 0x495b76
sub eax, 2
je 0x495b61
sub eax, 2
je 0x495b4b
push 0x548b24
push 1
mov dword [ebx + 0xa0], 2
push 0x86
jmp 0x495b89
cmp ecx, 0x4550
je 0x495b96
push 0x548b18
push 1
push 0x82
jmp 0x495b89
push 0x548b04
push 1
mov dword [ebx + 0xa0], 3
push 0x7a
jmp 0x495b89
push 0x548af0
push 1
mov dword [ebx + 0xa0], 4
push 0x7e
push 0x548b80
call fcn.004a5660
add esp, 0x10
mov dword [ebx + 0xa0], 6
mov edx, dword [ebx + 0x20]
add esi, 4
push edx
adc edi, 0
push 0x14
lea eax, [ebx + 0xe4]
push edi
push esi
push eax
mov ecx, ebx
call fcn.00497af0
test eax, eax
jne 0x495bc5
call fcn.004a57d0
mov ax, word [ebx + 0xe4]
add esi, 0x14
adc edi, 0
cmp ax, 0x14c
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
je 0x495c0d
cmp ax, 0x200
je 0x495c0d
cmp ax, 0x8664
je 0x495c0d
push 0x548ad0
push 1
push 0x94
push 0x548b80
mov dword [ebx + 0xa0], 5
call fcn.004a5660
add esp, 0x10
mov ecx, dword [ebx + 0x20]
lea eax, [ebx + 0xf8]
push ecx
push 2
push edi
push esi
push eax
mov ecx, ebx
call fcn.00497af0
test eax, eax
jne 0x495c2c
call fcn.004a57d0
mov ax, word [ebx + 0xf8]
cmp ax, 0x10b
jne 0x495e90
xor eax, eax
mov ax, word [ebx + 0xf4]
cmp eax, 0xe0
mov dword [ebp - 0x14], eax
jbe 0x495c58
mov eax, 0xe0
mov dword [ebp - 0x14], eax
mov edx, dword [ebx + 0x20]
lea ecx, [ebx + 0x2a4]
push edx
push eax
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00497af0
test eax, eax
jne 0x495c76
call fcn.004a57d0
lea eax, [ebx + 0x2a4]
mov dword [ebx + 0x210], eax
add eax, 0x60
mov dword [ebx + 0x218], eax
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x5c]
mov dword [ebx + 0xfc], ecx
mov edx, dword [ebx + 0x210]
mov eax, dword [edx + 0x10]
mov dword [ebx + 0x100], eax
mov ecx, dword [ebx + 0x210]
mov edx, dword [ecx + 0x20]
mov dword [ebx + 0x104], edx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x10c], ecx
mov edx, dword [ebx + 0x210]
mov eax, dword [edx + 0x24]
mov dword [ebx + 0x108], eax
mov ecx, dword [ebx + 0x210]
mov edx, dword [ecx + 4]
mov dword [ebx + 0x110], edx
mov eax, dword [ebx + 0x210]
xor edx, edx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x118], ecx
mov dword [ebx + 0x11c], edx
mov eax, dword [ebx + 0x210]
mov cx, word [eax]
mov word [ebx + 0x120], cx
mov eax, dword [ebx + 0x210]
mov cl, byte [eax + 2]
mov byte [ebx + 0x122], cl
mov eax, dword [ebx + 0x210]
mov cl, byte [eax + 3]
mov byte [ebx + 0x123], cl
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 4]
mov dword [ebx + 0x124], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 8]
mov dword [ebx + 0x128], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0x12c], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x130], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x134], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x138], ecx
mov dword [ebx + 0x13c], edx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x140], ecx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x144], ecx
mov cx, word [eax + 0x28]
mov word [ebx + 0x148], cx
mov cx, word [eax + 0x2a]
mov word [ebx + 0x14a], cx
mov cx, word [eax + 0x2c]
mov word [ebx + 0x14c], cx
mov cx, word [eax + 0x2e]
mov word [ebx + 0x14e], cx
mov cx, word [eax + 0x30]
mov word [ebx + 0x150], cx
mov cx, word [eax + 0x32]
mov word [ebx + 0x152], cx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x154], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x158], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x15c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x160], ecx
mov cx, word [eax + 0x44]
mov word [ebx + 0x164], cx
mov cx, word [eax + 0x46]
mov word [ebx + 0x166], cx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x168], ecx
mov dword [ebx + 0x16c], edx
mov ecx, dword [eax + 0x4c]
lea esi, [eax + 0x60]
mov dword [ebx + 0x170], ecx
mov dword [ebx + 0x174], edx
mov ecx, dword [eax + 0x50]
lea edi, [ebx + 0x190]
mov dword [ebx + 0x178], ecx
mov dword [ebx + 0x17c], edx
mov ecx, dword [eax + 0x54]
mov dword [ebp - 0x24], edx
mov dword [ebx + 0x180], ecx
mov dword [ebx + 0x184], edx
mov ecx, dword [eax + 0x58]
mov dword [ebx + 0x188], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebx + 0x18c], ecx
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x24]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x495f6d
cmp ax, 0x20b
jne 0x495f54
xor eax, eax
mov ax, word [ebx + 0xf4]
cmp eax, 0xf0
mov dword [ebp - 0x14], eax
jbe 0x495eb5
mov eax, 0xf0
mov dword [ebp - 0x14], eax
mov edx, dword [ebx + 0x20]
lea ecx, [ebx + 0x2a4]
push edx
push eax
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00497af0
test eax, eax
jne 0x495ed3
call fcn.004a57d0
lea eax, [ebx + 0x2a4]
lea edi, [ebx + 0x120]
mov dword [ebx + 0x214], eax
mov esi, eax
lea ecx, [eax + 0x70]
mov dword [ebp - 0x24], 0
mov dword [ebx + 0x218], ecx
mov edx, dword [eax + 0x6c]
mov dword [ebx + 0xfc], edx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x100], ecx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x104], edx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x10c], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x108], edx
mov ecx, dword [eax + 4]
mov dword [ebx + 0x110], ecx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x118], edx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x11c], ecx
mov ecx, 0x3c
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 0x24]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
jmp 0x495f6d
push 0x548ab8
push 1
push 0xde
push 0x548b80
call fcn.004a5660
add esp, 0x10
mov ecx, dword [ebx + 0xfc]
mov eax, 0x10
cmp ecx, eax
jbe 0x495f82
mov dword [ebx + 0xfc], eax
xor eax, eax
mov ecx, ebx
mov ax, word [ebx + 0xf4]
cdq
add esi, eax
adc edi, edx
call fcn.00498560
test eax, eax
jne 0x495fa0
call fcn.004a57d0
xor eax, eax
mov ax, word [ebx + 0xe6]
mov dword [ebx + 0x394], eax
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.004a5840
add esp, 4
mov dword [ebx + 0x398], eax
test eax, eax
jne 0x495fe0
push 0x548bf0
push eax
push 0xe7
push 0x548b80
call fcn.004a4ed0
add esp, 0x10
mov eax, dword [ebx + 0x394]
mov ecx, dword [ebx + 0x20]
push ecx
mov ecx, ebx
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x398]
shl edx, 3
push edx
push edi
push esi
push eax
call fcn.00497af0
test eax, eax
jne 0x49600a
call fcn.004a57d0
mov eax, dword [ebx + 0x394]
lea ecx, [eax + eax*4]
shl ecx, 3
add esi, ecx
mov ecx, ebx
adc edi, 0
call fcn.004981d0
test eax, eax
jne 0x49602b
call fcn.004a57d0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov edx, ecx
push eax
add edx, esi
mov esi, eax
adc esi, edi
sub edx, 1
sbb esi, 0
push ecx
push esi
push edx
call sub.ntdll.dll__alldiv
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
push ecx
push edx
push eax
call sub.ntdll.dll__allmul
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
mov edx, dword [ebx + 0x394]
shl edx, 2
push edx
call fcn.004a5840
add esp, 4
mov dword [ebx + 0x39c], eax
test eax, eax
jne 0x496091
push 0x548bf0
push eax
push 0xef
push 0x548b80
call fcn.004a4ed0
add esp, 0x10
mov ecx, dword [ebx + 0x394]
mov edi, dword [ebx + 0x39c]
shl ecx, 2
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor esi, esi
rep stosb byte es:[edi], al
mov dword [ebp + 8], esi
cmp esi, dword [ebx + 0x394]
jae 0x496158
mov ecx, dword [ebx + 0x398]
lea eax, [esi + esi*4]
push 8
lea edx, [ecx + eax*8]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.ntdll.dll_strncpy]
lea edi, [ebp - 0x3c]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x34], 0
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.004a5840
mov ecx, dword [ebx + 0x39c]
add esp, 0x10
mov dword [ecx + esi*4], eax
mov edx, dword [ebx + 0x39c]
cmp dword [edx + esi*4], 0
jne 0x496121
push 0x548bf0
push 0
push 0xf9
push 0x548b80
call fcn.004a4ed0
add esp, 0x10
lea edi, [ebp - 0x3c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebx + 0x39c]
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 8]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov edi, dword [edi + eax*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov esi, eax
jmp 0x4960b5
mov eax, dword [ebx + 0x394]
shl eax, 2
push eax
call fcn.004a5840
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [ebx + 0x3a0], eax
jne 0x49618e
push 0x548bf0
push esi
push 0xff
push 0x548b80
call fcn.004a4ed0
add esp, 0x10
mov ecx, ebx
call fcn.004980c0
mov ecx, dword [ebx + 0x394]
mov edx, dword [ebx + 0x3a0]
mov eax, dword [edx + ecx*4 - 4]
mov ecx, dword [ebx + 0x398]
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*8 + 0x14]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x10]
xor eax, eax
add edx, ecx
mov ecx, dword [ebx + 0x10]
sub ecx, edx
mov edx, dword [ebx + 0x14]
sbb edx, eax
mov dword [ebx + 0x3a8], ecx
mov eax, edx
mov dword [ebx + 0x3ac], edx
cmp eax, esi
jg 0x4961ee
jl 0x4961e2
cmp dword [ebx + 0x3a8], esi
jae 0x4961ee
mov dword [ebx + 0x3a8], esi
mov dword [ebx + 0x3ac], esi
mov esi, 1
mov dword [ebx + 0xa0], esi
jmp 0x496215
test esi, esi
mov dword [ebp - 4], 0xffffffff
jne 0x496227
mov ecx, ebx
call fcn.00496250
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8