Function at 0xa28a80
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0xa8c0c9
push eax
mov eax, 0x1770
mov dword fs:[0], esp
call fcn.00a7e750
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x4f0]
call fcn.00a155c0
mov edi, dword [esp + 0x1794]
lea eax, [esp + 0x4f0]
push 1
xor ebx, ebx
push eax
push edi
mov dword [esp + 0x1794], ebx
call fcn.00a24dc0
add esp, 0xc
lea ecx, [esp + 0x260]
call fcn.00a155c0
push ebx
mov byte [esp + 0x178c], 1
call fcn.00a50c00
mov esi, eax
add esp, 4
cmp esi, ebx
je 0xa28b00
push esi
call fcn.00a7e07a
add esp, 4
jmp 0xa28b02
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x268]
call fcn.00a15880
push 0x5c
lea ecx, [esp + 0x264]
call fcn.00a15cc0
mov eax, dword [esp + 0x4f8]
cmp eax, ebx
mov esi, eax
je 0xa28b36
push eax
call fcn.00a7e07a
add esp, 4
jmp 0xa28b38
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x268]
call fcn.00a15880
lea ecx, [esp + 0x2c]
push ecx
push ebx
push edi
push ebx
call fcn.009f2550
cmp eax, ebx
jne 0xa28b72
mov edx, dword [esp + 0x179c]
push edi
push str.__GetFileAttributesExW_failed_for__ls_
push edx
call fcn.00a16060
add esp, 0xc
jmp 0xa2922f
test byte [esp + 0x2c], 0x10
je 0xa28bcb
mov eax, dword [esp + 0x179c]
mov ecx, dword [esp + 0x1790]
push eax
push edi
push ecx
call fcn.00a28470
add esp, 0xc
mov byte [esp + 0x1788], bl
test al, al
lea ecx, [esp + 0x260]
je 0xa2923d
call fcn.00a155e0
lea ecx, [esp + 0x4f0]
mov dword [esp + 0x1788], 0xffffffff
call fcn.00a155e0
mov al, 1
jmp 0xa2925b
lea ecx, [esp + 0x910]
call fcn.00a155c0
lea edx, [esp + 0x910]
push ebx
push edx
push edi
mov byte [esp + 0x1794], 2
call fcn.009f1af0
add esp, 0xc
test al, al
je 0xa2921b
mov esi, dword [esp + 0x179c]
mov eax, dword [esp + 0x918]
mov ecx, dword [esp + 0x1790]
push esi
push eax
push ecx
call fcn.00a28470
add esp, 0xc
test al, al
je 0xa2921b
lea ecx, [esp + 0x700]
call fcn.00a155c0
lea ecx, [esp + 0x50]
mov byte [esp + 0x1788], 3
call fcn.00a155c0
lea edx, [esp + 0x700]
mov byte [esp + 0x1788], 4
push edx
push edi
call fcn.00a676c0
mov ecx, dword [esp + 0x270]
lea eax, [esp + 0x58]
push eax
push ecx
call fcn.00a676c0
mov al, byte [esp + 0x17a8]
add esp, 0x10
cmp al, bl
je 0xa28d41
lea ecx, [esp + 0x1570]
call fcn.00a155c0
lea ecx, [esp + 0x1360]
mov byte [esp + 0x1788], 5
call fcn.00a155c0
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x708]
push ebx
push edx
push eax
mov byte [esp + 0x1794], 6
call fcn.00a20700
test eax, eax
jne 0xa28d05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, ebx
je 0xa28cdd
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x708]
push eax
push ecx
push edx
push str._CopyToSandBox::CopyFile__ls___ls_failed__er_x_
push esi
call fcn.00a16060
add esp, 0x14
lea ecx, [esp + 0x1360]
mov byte [esp + 0x1788], 5
call fcn.00a155e0
mov byte [esp + 0x1788], 4
lea ecx, [esp + 0x1570]
jmp 0xa291f1
mov eax, dword [esp + 0x58]
push 0x80
push eax
call fcn.00a20980
lea ecx, [esp + 0x1360]
mov byte [esp + 0x1788], 5
call fcn.00a155e0
lea ecx, [esp + 0x1570]
mov byte [esp + 0x1788], 4
call fcn.00a155e0
jmp 0xa29014
lea ecx, [esp + 0xd30]
call fcn.00a155c0
mov eax, dword [esp + 0x268]
mov byte [esp + 0x1788], 7
cmp eax, ebx
mov esi, eax
je 0xa28d6d
push eax
call fcn.00a7e07a
add esp, 4
jmp 0xa28d6f
xor eax, eax
push eax
push esi
lea ecx, [esp + 0xd38]
call fcn.00a15880
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__d._d.tmp
lea ecx, [esp + 0x47c]
push 0x80
push ecx
call fcn.00a7f1ff
lea edx, [esp + 0x484]
add esp, 0x14
test edx, edx
je 0xa28dc2
lea eax, [esp + 0x470]
push eax
call fcn.00a7e07a
add esp, 4
jmp 0xa28dc4
xor eax, eax
lea ecx, [esp + 0x470]
push eax
push ecx
lea ecx, [esp + 0xd38]
call fcn.00a15880
lea ecx, [esp + 0xb20]
call fcn.00a155c0
mov eax, dword [esp + 0xd38]
lea edx, [esp + 0xb20]
push edx
push eax
mov byte [esp + 0x1790], 8
call fcn.00a676c0
mov ecx, dword [esp + 0xb30]
add esp, 8
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push ecx
call fcn.00a227b0
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0xa28e58
mov edx, dword [esp + 0x708]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push edx
push ebx
call fcn.00a2dcc0
mov ebp, eax
cmp ebp, edi
jne 0xa28ed8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xb20]
mov byte [esp + 0x1788], 7
call fcn.00a155e0
lea ecx, [esp + 0xd30]
mov byte [esp + 0x1788], 4
call fcn.00a155e0
lea ecx, [esp + 0x50]
mov byte [esp + 0x1788], 3
call fcn.00a155e0
lea ecx, [esp + 0x700]
mov byte [esp + 0x1788], 2
call fcn.00a155e0
lea ecx, [esp + 0x910]
mov byte [esp + 0x1788], 1
call fcn.00a155e0
lea ecx, [esp + 0x260]
mov byte [esp + 0x1788], bl
call fcn.00a155e0
mov dword [esp + 0x1788], edi
jmp 0xa2924d
push 0x10000
call fcn.009ef3b0
add esp, 4
mov edi, eax
lea eax, [esp + 0x10]
push ebx
push eax
push 0x10000
push edi
push ebp
push ebx
mov dword [esp + 0x28], ebx
call fcn.00a2aaf0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa28f21
lea ecx, [esp + 0x20]
push ebx
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebx
je 0xa28f21
cmp dword [esp + 0x20], ebx
jne 0xa28ee7
lea edx, [esp + 0x1c]
push edx
push ebp
push ebx
call fcn.00a28320
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [esp + 0x2c], eax
call fcn.009ef440
add esp, 4
push ebp
push ebx
call fcn.00a2af50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp eax, ecx
jne 0xa29199
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp edx, eax
jne 0xa29199
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0xb28]
push eax
push ecx
call fcn.00a1faf0
test eax, eax
jne 0xa28fe5
mov edx, dword [esp + 0x58]
push edx
call fcn.00a20610
cmp eax, ebx
jne 0xa28fc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xa28fc0
mov eax, dword [esp + 0x58]
push 0x80
push eax
call fcn.00a20980
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00a20610
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0xb28]
push edx
push eax
call fcn.00a1faf0
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00a1fd60
cmp eax, 0xffffffff
je 0xa291ce
lea ecx, [esp + 0xb20]
mov byte [esp + 0x1788], 7
call fcn.00a155e0
lea ecx, [esp + 0xd30]
mov byte [esp + 0x1788], 4
call fcn.00a155e0
mov edi, dword [esp + 0x1794]
lea ecx, [esp + 0xf40]
call fcn.00a155c0
lea ecx, [esp + 0x1150]
mov byte [esp + 0x1788], 9
call fcn.00a155c0
lea edx, [esp + 0x24]
lea eax, [esp + 0xf40]
push edx
push eax
push edi
mov byte [esp + 0x1794], 0xa
call fcn.009f1af0
add esp, 0xc
test al, al
jne 0xa2907e
lea ecx, [esp + 0x1150]
mov byte [esp + 0x1788], 9
call fcn.00a155e0
mov byte [esp + 0x1788], 4
lea ecx, [esp + 0xf40]
jmp 0xa291f1
mov edx, dword [esp + 0xf48]
lea ecx, [esp + 0x1150]
push 1
push ecx
push edx
call fcn.00a24dc0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1164]
mov edx, dword [esp + 0x179c]
push eax
push ecx
push edx
call fcn.00a27e90
mov eax, dword [esp + 0x70]
add esp, 0x18
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
push eax
call fcn.00a227b0
mov esi, eax
cmp esi, 0xffffffff
je 0xa290f2
lea ecx, [esp + 0x40]
lea edx, [esp + 0x40]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xa290f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x58]
push ecx
push edx
call fcn.00a20980
lea ecx, [esp + 0x1150]
mov byte [esp + 0x1788], 9
call fcn.00a155e0
lea ecx, [esp + 0xf40]
mov byte [esp + 0x1788], 4
call fcn.00a155e0
lea ecx, [esp + 0x50]
mov byte [esp + 0x1788], 3
call fcn.00a155e0
lea ecx, [esp + 0x700]
mov byte [esp + 0x1788], 2
call fcn.00a155e0
lea ecx, [esp + 0x910]
mov byte [esp + 0x1788], 1
call fcn.00a155e0
lea ecx, [esp + 0x260]
mov byte [esp + 0x1788], bl
call fcn.00a155e0
lea ecx, [esp + 0x4f0]
mov dword [esp + 0x1788], 0xffffffff
call fcn.00a155e0
mov al, 1
jmp 0xa2925b
mov eax, dword [esp + 0xb28]
push eax
call fcn.00a20610
cmp eax, ebx
jne 0xa291ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0xa291ce
mov ecx, dword [esp + 0x58]
push 0x80
push ecx
call fcn.00a20980
mov edx, dword [esp + 0x58]
push edx
call fcn.00a20610
lea ecx, [esp + 0xb20]
mov byte [esp + 0x1788], 7
call fcn.00a155e0
mov byte [esp + 0x1788], 4
lea ecx, [esp + 0xd30]
call fcn.00a155e0
lea ecx, [esp + 0x50]
mov byte [esp + 0x1788], 3
call fcn.00a155e0
lea ecx, [esp + 0x700]
mov byte [esp + 0x1788], 2
call fcn.00a155e0
lea ecx, [esp + 0x910]
mov byte [esp + 0x1788], 1
call fcn.00a155e0
mov byte [esp + 0x1788], bl
lea ecx, [esp + 0x260]
call fcn.00a155e0
mov dword [esp + 0x1788], 0xffffffff
lea ecx, [esp + 0x4f0]
call fcn.00a155e0
xor al, al
mov ecx, dword [esp + 0x1780]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x177c
ret