Function at 0x10024483
Capabilities:
Get file size
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002487c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 6
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x100244e6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x38], 0xfffffff6
jmp 0x100244f6
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffea
jne 0x10024538
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x10024516
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x10024536
push 0
push 0xa67
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x100244ef
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x130], 0xe91a049f
mov dword [ebp - 0x12c], 0xe91a049f
mov dword [ebp - 0x128], 0xe91a049f
mov dword [ebp - 0x124], 0xe91a049f
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0
jmp 0x10024580
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1002459e
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x1002459c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10024579
mov dword [ebp - 0x1c], 0
jmp 0x100245ae
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x100245d4
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x100245d2
push 0x1545
push 0x2085
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x100245a7
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.10016420
mov dword [eax], 3
jmp 0x100245fe
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.10016420
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.10016420
cmp dword [eax], 0
jl 0x10024877
mov dword [ebp - 0xec], 0xffff
mov dword [ebp - 0x18], 0
jmp 0x1002462b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002463e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0xfffffffb
jmp 0x10024624
mov dword [ebp - 0x18], 0
jmp 0x1002464e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10024661
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x14], 1
jmp 0x10024647
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x48], 0xe0648261
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x14], 1
jmp 0x10024694
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
jl 0x10024844
mov dword [ebp - 0xfc], 9
mov dword [ebp - 0xe4], 0xd1cb6a7f
mov eax, 0x7d8cf4c5
test eax, eax
je 0x10024767
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov eax, dword [ebp + eax*4 - 0x48]
mov dword [ebp - 0xfc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 5
jbe 0x100246f3
mov dword [ebp - 0x8c], 1
jmp 0x100246fa
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 0xf3cc
jl 0x10024712
mov dword [ebp - 0xb0], 1
jmp 0x10024719
and dword [ebp - 0xb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0xb0], eax
jle 0x10024734
mov dword [ebp - 0x60], 1
jmp 0x10024738
and dword [ebp - 0x60], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov eax, dword [ebp + eax*4 - 0x48]
imul ecx, dword [ebp - 0x60], 0x664a
imul eax, ecx
test eax, eax
jne 0x1002475b
push 3
pop eax
test eax, eax
je 0x10024767
mov dword [ebp - 0x88], 1
jmp 0x1002476e
and dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 0xe623
je 0x10024783
mov dword [ebp - 0x68], 1
jmp 0x10024787
and dword [ebp - 0x68], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0x68], eax
jg 0x100247a6
mov dword [ebp - 0xac], 1
jmp 0x100247ad
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xac], eax
jl 0x100247c4
mov dword [ebp - 0x70], 1
jmp 0x100247c8
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x70], eax
jge 0x100247df
mov dword [ebp - 0x94], 1
jmp 0x100247e6
and dword [ebp - 0x94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, dword [ebp - 0x94]
jge 0x10024805
mov dword [ebp - 0x78], 1
jmp 0x10024809
and dword [ebp - 0x78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0x78], eax
je 0x10024828
mov dword [ebp - 0xa4], 1
jmp 0x1002482f
and dword [ebp - 0xa4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa4]
mov dword [ebp + eax - 0x48], ecx
jmp 0x1002467f
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.10016420
push dword [eax]
mov ecx, dword [ebp - 0x80]
call fcn.10016420
mov esi, eax
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.10016420
push dword [eax]
mov ecx, dword [ebp - 0x80]
call fcn.10016420
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100245e6
jmp 0x10024c90
mov eax, dword [ebp + 8]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x10], 0x324ec2e0
mov dword [ebp - 0x110], 0x1fe511bd
mov dword [ebp - 0x10c], 0x1fe511bd
mov dword [ebp - 0x108], 0x1fe511bd
mov dword [ebp - 0x104], 0x1fe511bd
lea ecx, [ebp - 0x4d]
call fcn.100091d3
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x138]
call fcn.1001642f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd8]
call fcn.100163de
and dword [ebp - 4], 0
mov dword [ebp - 0x3c], 0x4e2e0f61
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x10024901
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe7
jl 0x10024c34
mov dword [ebp - 0x28], 0xcd329b3a
push 2
lea ecx, [ebp - 0xbc]
call fcn.10016382
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x40], 0
jmp 0x1002493a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10024956
push dword [ebp - 0x40]
lea ecx, [ebp - 0xbc]
call fcn.10016420
mov dword [eax], 0xfffffffe
jmp 0x10024933
xor eax, eax
jne 0x100249e8
cmp dword [ebp - 0x28], 0
jae 0x10024970
mov dword [ebp - 0xcc], 1
jmp 0x10024977
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x10], 0
jne 0x1002499b
cmp dword [ebp - 0x10], 0
jne 0x1002499b
cmp dword [ebp - 0x28], 0
jne 0x1002499b
and dword [ebp - 0xf8], 0
jmp 0x100249a5
mov dword [ebp - 0xf8], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x10]
add eax, 0xe075
cmp eax, 0x70e81de9
je 0x100249cc
cmp dword [ebp - 0x10], 0
jne 0x100249cc
and dword [ebp - 0xe0], 0
jmp 0x100249d6
mov dword [ebp - 0xe0], 1
mov eax, 0x21b0
test eax, eax
jne 0x100249e8
and dword [ebp - 0x9c], 0
jmp 0x100249f2
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9c], eax
jle 0x10024a06
mov dword [ebp - 0x4c], 1
jmp 0x10024a0a
and dword [ebp - 0x4c], 0
push 1
lea ecx, [ebp - 0xbc]
call fcn.10016420
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x28]
jl 0x10024a3c
cmp dword [ebp - 0x10], 0
je 0x10024a3c
mov dword [ebp - 0x54], 1
jmp 0x10024a40
and dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], 0x2589
jl 0x10024a52
mov dword [ebp - 0x5c], 1
jmp 0x10024a56
and dword [ebp - 0x5c], 0
push 2
lea ecx, [ebp - 0xd8]
call fcn.10016420
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xd8]
call fcn.10016420
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x11c], eax
xor eax, eax
jne 0x10024a8e
cmp dword [ebp - 0x28], 0
jne 0x10024a8e
and dword [ebp - 0x64], 0
jmp 0x10024a95
mov dword [ebp - 0x64], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x64], eax
jl 0x10024aa6
mov dword [ebp - 0x6c], 1
jmp 0x10024aaa
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x10024b0f
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x84], 0x4db9bec7
mov dword [ebp - 0xf0], 0xdbd3d38e
mov dword [ebp - 0x3c], 0xafbcae26
mov eax, dword [ebp - 0x3c]
neg eax
cmp dword [ebp - 0x10], eax
jl 0x10024aeb
mov dword [ebp - 0x74], 1
jmp 0x10024aef
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xf0], eax
jmp 0x10024c20
mov dword [ebp - 0x30], 0xb25bb54a
mov dword [ebp - 0xc8], 0xaef1792f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x118], eax
push 1
lea ecx, [ebp - 0xbc]
call fcn.10016420
mov esi, dword [ebp - 0x34]
push 1
lea ecx, [ebp - 0xbc]
call fcn.10016420
cmp esi, dword [eax]
jne 0x10024b56
mov dword [ebp - 0x90], 1
jmp 0x10024b5d
and dword [ebp - 0x90], 0
push 2
lea ecx, [ebp - 0xd8]
call fcn.10016420
mov ecx, dword [ebp - 0x90]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x34]
mov dword [ebp - 0x30], ecx
jne 0x10024b81
cmp dword [ebp - 0x30], 0
je 0x10024b87
cmp dword [ebp - 0x30], 0
jne 0x10024b96
cmp dword [ebp - 0x30], 0
jne 0x10024b96
and dword [ebp - 0xe8], 0
jmp 0x10024ba0
mov dword [ebp - 0xe8], 1
push 2
lea ecx, [ebp - 0xd8]
call fcn.10016420
push 1
lea ecx, [ebp - 0xbc]
call fcn.10016420
imul eax, dword [eax], 0xfffffffb
cmp eax, 0xffff
jb 0x10024bd0
mov dword [ebp - 0x98], 1
jmp 0x10024bd7
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0x15e
jl 0x10024bef
mov dword [ebp - 0xa0], 1
jmp 0x10024bf6
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xa0], eax
jg 0x10024c0d
mov dword [ebp - 0xa8], 1
jmp 0x10024c14
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.10016404
jmp 0x100248fa
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x10024c4a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.10016404
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
movzx eax, byte [eax]
test eax, eax
je 0x10024c90
push 0x266c
push 0x2505
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret