Function at 0x410c71
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
test edi, edi
je 0x410ec5
xor esi, esi
cmp word [edi], si
je 0x410ec5
push ebx
push 0x8001
mov ebx, esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push 0x8000080
push 3
push esi
inc esi
mov dword [ebp - 0x10], eax
push esi
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x410e89
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push ebx
test edi, edi
jne 0x410ce1
mov ecx, dword [ebp + 8]
call fcn.00410ed0
jmp 0x410ea9
push ebx
push ebx
push 2
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x410e89
xor eax, eax
push eax
push eax
push eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x410e86
cmp edi, esi
jbe 0x410d94
movzx eax, word [ebx]
mov ecx, 0xfeff
cmp ax, cx
jne 0x410d50
mov ecx, dword [ebp + 8]
and edi, 0xfffffffe
push edi
call fcn.00410ed0
mov esi, eax
test esi, esi
js 0x410e6e
mov eax, dword [ebp + 8]
mov esi, dword [eax]
lea eax, [edi - 2]
push eax
lea eax, [ebx + 2]
push eax
push esi
call fcn.0041b880
jmp 0x410d83
mov ecx, 0xfffe
cmp ax, cx
jne 0x410d94
mov ecx, dword [ebp + 8]
and edi, 0xfffffffe
push edi
call fcn.00410ed0
mov esi, eax
test esi, esi
js 0x410e6e
mov eax, dword [ebp + 8]
mov esi, dword [eax]
lea eax, [edi - 2]
push eax
lea eax, [ebx + 2]
push esi
push eax
call fcn.0041c016
shr edi, 1
add esp, 0xc
xor eax, eax
mov word [esi + edi*2 - 2], ax
jmp 0x410e6c
cmp edi, 3
jb 0x410df6
cmp word [ebx], 0xbbef
jne 0x410df6
cmp byte [ebx + 2], 0xbf
jne 0x410df6
mov ecx, dword [ebp + 8]
sub edi, 3
lea eax, [edi*2 + 2]
push eax
call fcn.00410ed0
mov esi, eax
test esi, esi
js 0x410e6e
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp + 8], eax
test edi, edi
je 0x410de2
push edi
push eax
lea ecx, [ebx + 3]
mov edx, edi
call fcn.00410afc
mov ecx, eax
mov eax, dword [ebp + 8]
jmp 0x410de5
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov word [eax + ecx*2], dx
lea eax, [ecx*2 + 2]
mov ecx, esi
jmp 0x410e66
lea eax, [edi - 1]
mov edx, 0xfa
cmp eax, edx
jae 0x410e09
lea edx, [edi - 1]
test edx, edx
je 0x410e2a
mov eax, ebx
movzx ecx, byte [eax]
inc eax
mov dword [ebp - 0xc], eax
cmp ecx, 0x20
jae 0x410e25
mov eax, esi
shl eax, cl
test eax, 0x8003780
je 0x410e7a
mov eax, dword [ebp - 0xc]
sub edx, 1
jne 0x410e0b
mov ecx, dword [ebp + 8]
lea eax, [edi*2 + 2]
push eax
call fcn.00410ed0
mov esi, eax
test esi, esi
js 0x410e6e
mov eax, dword [ebp + 8]
mov esi, dword [eax]
lea eax, [edi + 1]
push eax
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [eax*2 + 2]
mov ecx, dword [ebp + 8]
push eax
call fcn.00410ed0
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [ebp - 4]
jmp 0x410ea2
mov ecx, dword [ebp + 8]
push 0
call fcn.00410ed0
jmp 0x410e6e
mov ebx, dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x410e9e
movzx esi, si
or esi, 0x80070000
test ebx, ebx
je 0x410ea9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop ebx
test eax, eax
je 0x410eb8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, esi
jmp 0x410eca
mov eax, 0x80070057
pop edi
pop esi
leave
ret 4