Function at 0x49cd60
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x3c
mov eax, 0x4d64b8
call fcn.004cbc99
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], ebx
call sym.QQProtectUpd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call sym.QQProtectUpd.exe_int___cdecl_FS::IsFileSystemFile_wchar_t_const__
test eax, eax
pop ecx
je 0x49ce37
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
push eax
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sym.QQProtectUpd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call sym.QQProtectUpd.exe_int___cdecl_FS::CreateFileW_wchar_t_const___unsigned_long_int__struct_ITXFile___
add esp, 0xc
test eax, eax
jne 0x49cddb
mov eax, dword [ebp - 0x30]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x49cdc5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
call fcn.004cbd1c
ret 8
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 2
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x49ce10
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x49ce1e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x49cf08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x49cf08
push ebx
push 0x80
push 3
push ebx
push 1
push accept
lea ecx, [ebp + 8]
call sym.QQProtectUpd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x49cdc5
xor eax, eax
mov dword [ebp - 0x44], ebx
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x49ce85
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49cdc5
cmp dword [ebp - 0x40], ebx
ja 0x49ce79
mov edi, dword [ebp - 0x44]
cmp edi, 0xffffffff
ja 0x49ce79
push edi
lea ecx, [ebp - 0x24]
call fcn.004302e0
push ebx
lea eax, [ebp - 0x48]
push eax
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
mov dword [ebp - 0x48], ebx
call fcn.0042cf60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49cedf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x49cdc5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x24], ebx
jmp 0x49cdc5
lea ecx, [ebp - 0x24]
call fcn.0042cf90
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], eax
call fcn.0048d9e3
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x49cf08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
call fcn.0042cf20
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 0x20], 0xae
mov byte [ebp - 0x1f], 0xde
mov byte [ebp - 0x1e], 0x3a
mov byte [ebp - 0x1d], 0x46
mov byte [ebp - 0x1c], 0x86
mov byte [ebp - 0x1b], 0xf6
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 0x19], 0x9b
mov byte [ebp - 0x18], 0x85
mov byte [ebp - 0x17], 0x1d
mov byte [ebp - 0x16], 0x9c
mov byte [ebp - 0x15], 0x8a
mov byte [ebp - 0x14], 0xbf
mov byte [ebp - 0x13], 0x7e
mov byte [ebp - 0x12], 0x6b
mov byte [ebp - 0x11], 0xf4
call fcn.0042cf60
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x34]
call fcn.00415740
add esp, 0x14
test eax, eax
je 0x49cdc5
cmp dword [ebp - 0x3c], ebx
jg 0x49cf98
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, ebx
jmp 0x49cdd3
push dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
call fcn.0042cf20
xor ebx, ebx
inc ebx
jmp 0x49cf85