Function at 0x4fa5d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
push edi
push 0x8000080
push 3
push edi
push 3
push 0xc0000000
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
jne 0x4fa633
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4fa66c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x4fa66c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
push edi
push esi
push edx
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
cmp esi, edi
mov dword [ebp - 0x28], esi
jne 0x4fa6a2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push edi
push edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4fa6d6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5c2a74]
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
push ecx
push edi
call fcn.004f7b50
mov edx, dword [ebp + 8]
add esp, 8
push str.75B22630_668E_11CF_A6D9_00AA0062CE6C
push edx
call fcn.0052f680
add esp, 8
test eax, eax
je 0x4fa726
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.005421be
mov eax, 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x18]
push eax
call fcn.004f6c50
add esp, 4
mov dword [ebp - 0x24], eax
mov esi, 0x1e
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
lea edx, [esi + edi]
push ecx
push edx
call fcn.004f7b50
mov eax, dword [ebp + 8]
add esp, 8
push str.8CABDCA1_A947_11CF_8EE4_00C00C205365
push eax
call fcn.0052f680
add esp, 8
test eax, eax
jne 0x4fa866
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, 8
mov edx, ebx
mov byte [esi + edi + 0x28], al
call fcn.00529fa0
mov byte [esi + edi + 0x29], al
mov eax, dword [ebp + 0x10]
mov ecx, 0x10
mov edx, ebx
call fcn.00529fa0
mov byte [esi + edi + 0x2a], al
mov eax, dword [ebp + 0x10]
mov ecx, 0x18
mov edx, ebx
call fcn.00529fa0
mov byte [esi + edi + 0x2b], al
mov eax, ebx
mov dword [ebp - 0x20], eax
mov edx, ebx
sar eax, 0x1f
mov eax, ebx
mov cl, bl
sar edx, 8
sar eax, 0x1f
mov byte [esi + edi + 0x2c], cl
mov byte [esi + edi + 0x2d], dl
mov eax, ebx
mov ecx, ebx
mov edx, ebx
sar eax, 0x18
sar ebx, 0x1f
sar ecx, 0x10
sar edx, 0x1f
mov byte [esi + edi + 0x2f], al
mov eax, dword [ebp + 0x18]
xor ebx, ebx
mov byte [esi + edi + 0x2e], cl
mov ecx, 8
mov edx, ebx
mov byte [esi + edi + 0x38], al
call fcn.00529fa0
mov byte [esi + edi + 0x39], al
mov eax, dword [ebp + 0x18]
mov ecx, 0x10
mov edx, ebx
call fcn.00529fa0
mov byte [esi + edi + 0x3a], al
mov eax, dword [ebp + 0x18]
mov ecx, 0x18
mov edx, ebx
call fcn.00529fa0
mov byte [esi + edi + 0x3b], al
mov eax, ebx
mov dword [ebp - 0x20], eax
mov cl, bl
sar eax, 0x1f
mov eax, ebx
mov byte [esi + edi + 0x3c], cl
sar eax, 0x1f
mov edx, ebx
mov ecx, ebx
mov eax, ebx
sar edx, 8
sar ecx, 0x10
sar eax, 0x18
mov byte [esi + edi + 0x3d], dl
mov byte [esi + edi + 0x3e], cl
mov byte [esi + edi + 0x3f], al
mov cl, byte [esi + edi + 0x58]
mov edx, ebx
and cl, 0xfe
sar edx, 0x1f
sar ebx, 0x1f
mov ebx, dword [ebp - 0x1c]
or cl, 2
mov byte [esi + edi + 0x58], cl
mov ecx, dword [ebp - 0x14]
lea edx, [esi + edi + 0x10]
inc ecx
push edx
mov dword [ebp - 0x14], ecx
call fcn.004f6c50
add esi, eax
mov eax, dword [ebp + 0xc]
add esp, 4
cmp esi, eax
jge 0x4fa9ad
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x4fa741
cmp esi, dword [ebp + 0xc]
jge 0x4fa9ad
lea ecx, [ebp + 8]
add esi, edi
push ecx
push esi
call fcn.004f7b50
mov edx, dword [ebp + 8]
add esp, 8
push str.75B22636_668E_11CF_A6D9_00AA0062CE6C
push edx
call fcn.0052f680
add esp, 8
test eax, eax
jne 0x4fa9ad
mov eax, dword [ebp + 0x18]
xor ebx, ebx
imul eax, dword [ebp + 0x1c]
add eax, 0x32
mov ecx, 8
mov edx, ebx
mov dword [ebp + 0x10], eax
mov byte [esi + 0x10], al
call fcn.00529fa0
mov byte [esi + 0x11], al
mov eax, dword [ebp + 0x10]
mov ecx, 0x10
mov edx, ebx
call fcn.00529fa0
mov byte [esi + 0x12], al
mov eax, dword [ebp + 0x10]
mov ecx, 0x18
mov edx, ebx
call fcn.00529fa0
mov byte [esi + 0x13], al
mov eax, ebx
mov dword [ebp + 0xc], eax
mov edx, ebx
sar eax, 0x1f
mov eax, ebx
mov cl, bl
sar edx, 8
sar eax, 0x1f
mov byte [esi + 0x14], cl
mov byte [esi + 0x15], dl
mov eax, ebx
mov ecx, ebx
mov edx, ebx
sar eax, 0x18
sar ebx, 0x1f
sar ecx, 0x10
sar edx, 0x1f
mov byte [esi + 0x17], al
mov eax, dword [ebp + 0x18]
xor ebx, ebx
mov byte [esi + 0x16], cl
mov ecx, 8
mov edx, ebx
mov byte [esi + 0x28], al
call fcn.00529fa0
mov byte [esi + 0x29], al
mov eax, dword [ebp + 0x18]
mov ecx, 0x10
mov edx, ebx
call fcn.00529fa0
mov byte [esi + 0x2a], al
mov eax, dword [ebp + 0x18]
mov ecx, 0x18
mov edx, ebx
call fcn.00529fa0
mov byte [esi + 0x2b], al
mov eax, ebx
mov dword [ebp + 0x18], eax
mov edx, ebx
sar eax, 0x1f
mov eax, ebx
mov cl, bl
sar edx, 8
sar eax, 0x1f
mov byte [esi + 0x2c], cl
mov byte [esi + 0x2d], dl
mov ecx, ebx
mov edx, ebx
mov eax, ebx
sar ecx, 0x10
sar edx, 0x1f
sar eax, 0x18
sar ebx, 0x1f
mov ebx, dword [ebp - 0x1c]
mov byte [esi + 0x2e], cl
mov byte [esi + 0x2f], al
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebx
call esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.005421be
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret