Function at 0x5b835e49
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5b89bae4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x10]
cmp dword [esi], 0xffffffff
je 0x5b835e74
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi], 0xffffffff
push ecx
push ecx
push 0
push 3
push 0
push 0xc0000000
mov edx, edi
mov ecx, esi
call fcn.5b871749
test eax, eax
js 0x5b835ec5
lea eax, [ebp - 0x2c]
xor esi, esi
push eax
lfence
push dword [ebx + 0x10]
xor edi, edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5b835eb3
call fcn.5b87185e
jmp 0x5b835ec1
mov esi, dword [ebp - 0x2c]
xor eax, eax
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
test eax, eax
jns 0x5b835ecd
lfence
jmp 0x5b836191
mov eax, 0x1000
test edi, edi
ja 0x5b835ee6
jb 0x5b835edc
cmp esi, eax
ja 0x5b835ee6
mov eax, 0x800700de
jmp 0x5b836191
lfence
and dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov edx, eax
call fcn.5b87157d
mov esi, dword [ebp - 0x28]
mov edi, eax
mov dword [ebp - 0x28], esi
test edi, edi
js 0x5b836184
lfence
mov ecx, dword [ebx + 0x10]
lea edx, [ebp - 0x20]
push esi
mov dword [ebp - 0x20], 0x1000
call fcn.5b871892
mov edi, eax
test edi, edi
js 0x5b836184
cmp dword [ebp - 0x20], 0x1000
je 0x5b835f3a
mov edi, 0x8007012b
jmp 0x5b836184
lea eax, [ebp - 0x44]
xor edx, edx
push eax
call fcn.5b8357dd
mov esi, eax
lea edi, [ebp - 0x18]
lea ecx, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
xor edi, edi
mov eax, dword [esi + edi*4]
cmp eax, dword [ecx + edi*4]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
jne 0x5b835f8f
inc edi
lea ecx, [ebp - 0x18]
cmp edi, 4
jne 0x5b835f56
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
add ecx, 0xfffff000
push 0
push dword [ebp + 0x10]
adc eax, 0xffffffff
push eax
push ecx
call fcn.5b888070
mov ecx, dword [ebp - 0x20]
mov edx, eax
jmp 0x5b835fc4
lea eax, [ebp - 0x44]
push eax
call fcn.5b835813
mov esi, eax
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
xor edi, edi
mov eax, dword [esi + edi*4]
lea ecx, [ebp - 0x18]
cmp eax, dword [ecx + edi*4]
mov ecx, dword [ebp - 0x20]
jne 0x5b83606e
inc edi
cmp edi, 4
jne 0x5b835fa6
mov edx, dword [esi + 0xbc]
cmp ecx, edx
jae 0x5b836070
mov ecx, edx
mov dword [ebp - 0x20], ecx
push ecx
lea ecx, [ebx + 0x20]
lfence
call fcn.5b835582
mov edi, eax
test edi, edi
js 0x5b836184
lea eax, [ebp - 0x44]
mov byte [ebp - 0x19], 0
push eax
call fcn.5b8357dd
mov esi, eax
lea edi, [ebp - 0x18]
lea edx, [ebp - 0x18]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x5b836080
inc ecx
cmp ecx, 4
jne 0x5b836005
push dword [ebp + 0x10]
lfence
push dword [ebp - 0x20]
mov eax, dword [ebx + 0x24]
push dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x30]
push esi
call fcn.5b837091
mov edi, eax
test edi, edi
js 0x5b836184
push 0
push dword [ebp + 0x10]
lfence
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x28]
push esi
call fcn.5b836f7b
mov edi, eax
test edi, edi
js 0x5b836184
xor edi, edi
test edi, edi
js 0x5b836184
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov byte [ebp - 0x19], 1
jmp 0x5b836086
cmp ecx, edx
jbe 0x5b835fd1
mov edi, 0x800700de
jmp 0x5b836184
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
push dword [ebp + 0x10]
lfence
push dword [ebp - 0x20]
push ecx
push eax
push esi
mov ecx, ebx
call fcn.5b8371c5
mov edi, eax
test edi, edi
js 0x5b836184
lfence
mov eax, dword [esi + 0x20]
lea edi, [ebx + 0x14]
cmp dword [edi], 0
mov ecx, dword [esi + 0x24]
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
je 0x5b8360d4
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
push 0
push 0
push ecx
push eax
push 4
mov ecx, edi
call fcn.5b8701c0
mov edi, eax
test edi, edi
js 0x5b836184
lfence
mov eax, dword [ebx + 0x14]
lea edi, [ebx + 0x18]
cmp dword [edi], 0
mov dword [ebp - 0x28], eax
je 0x5b83610c
push dword [edi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [edi], 0
mov eax, dword [ebp - 0x28]
push 0
push ecx
push ecx
push 6
mov edx, eax
mov ecx, edi
call fcn.5b87027c
mov edi, eax
test edi, edi
js 0x5b836184
cmp byte [ebp - 0x19], 0
lfence
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x1c], ecx
je 0x5b836146
push 0xc0
lfence
push esi
push dword [ebx + 0x1c]
call fcn.5b886ad0
add esp, 0xc
jmp 0x5b836182
push dword [ebx + 0x24]
mov eax, dword [ecx + 0x98]
add eax, ecx
push eax
push dword [ebx + 0x28]
call fcn.5b886ad0
add esp, 0xc
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b836182
test byte [eax + 0x1c], 4
je 0x5b836182
push dword [eax + 0x14]
mov edx, 0x5b80c428
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.5b81ae17
xor edi, edi
test esi, esi
je 0x5b83618f
push esi
call fcn.5b884351
pop ecx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5b884340
leave
ret 0xc