Function at 0x4177f0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x41e3b0]
push ebx
mov ebx, dword [esp + 0x150]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [esp + 0x154]
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [esp + 0x20], 0
test eax, eax
je 0x417860
push ebx
call fcn.00401aa0
push eax
lea eax, [esp + 0x30]
push str.Starting_to_rebuild__s...
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x417899
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417953
push str.File_access_error__
jmp 0x417944
mov edx, dword [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [0x41e3b0]
test eax, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
je 0x417913
push ebx
lea eax, [esp + 0x2c]
push str.Filesize:__Xh
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 0x41de50
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push 4
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x417971
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417953
push str.Not_enough_memory__
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push 0
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.IMAGEHLP.dll_ImageNtHeader]
test eax, eax
jne 0x4179b4
mov eax, dword [0x41e3b0]
push str.Invalid_PE_file__
test eax, eax
je 0x4179fe
jmp 0x4179d3
mov edx, dword [esp + 0x10]
push edx
call fcn.00417620
add esp, 4
test eax, eax
je 0x417a0c
mov eax, dword [0x41e3b0]
test eax, eax
je 0x4179f8
push str.PE32_files_not_supported__
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
jmp 0x417f3d
mov eax, dword [str.This_feature_currently_doesnt_support_PE32_formated_files__]
push eax
push esi
call fcn.004043a0
add esp, 8
jmp 0x417f3d
mov eax, dword [0x41e3b4]
test eax, eax
je 0x417a88
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00416370
mov ebx, eax
mov eax, dword [0x41e3b0]
add esp, 4
test eax, eax
je 0x417a88
lea edx, [esp + 0x28]
push str.Dumpfix...
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x417a53
lea eax, [esp + 0x28]
push str.done
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x417a63
lea ecx, [esp + 0x28]
push str.failed
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3d0]
test eax, eax
je 0x417b49
mov eax, dword [0x41e3d4]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call sub.realign.dll_ReBasePEImage
mov ebx, eax
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417b49
mov edx, dword [0x41e3d4]
lea eax, [esp + 0x28]
push edx
push str.Rebasing_to_0x_X...
push eax
call ebp
add esp, 0xc
cmp ebx, 5
ja case.default.0x417acf
jmp dword [ebx*4 + 0x418114]
push str.done
jmp 0x417b19
lea edx, [esp + 0x28]
push str.invalid_PE
push edx
jmp 0x417b1e
lea eax, [esp + 0x28]
push str.no_Relocation_present
push eax
jmp 0x417b1e
push str.invalid_RVA_s_
jmp 0x417b19
lea edx, [esp + 0x28]
push str.new_ImageBase_is_invalid
push edx
jmp 0x417b1e
lea eax, [esp + 0x28]
push str.access_violation
push eax
jmp 0x417b1e
push str.failed
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3c0]
test eax, eax
je 0x417c73
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call sub.realign.dll_WipeReloc
mov ebx, eax
cmp ebx, 0xf0000000
jae 0x417bf7
cmp ebx, 0x1e
jbe 0x417bf7
push str.WipeRelocation...done
push 0
push 0x180
push 0x467
push esi
mov dword [esp + 0x2c], ebx
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push ebx
lea edx, [esp + 0x2c]
push str.Current_filesize:__Xh
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
lea eax, [ebx + ebx*4]
xor edx, edx
lea ecx, [esp + 0x28]
lea eax, [eax + eax*4]
shl eax, 2
div dword [esp + 0x1c]
push eax
push str.File_minimized_to:__d__
push ecx
call ebp
add esp, 0xc
jmp 0x417c4e
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417c73
lea eax, [esp + 0x28]
push str.Wipe_Relocation...
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 0xfffffffc
je 0x417c3e
cmp ebx, 0xfffffffd
je 0x417c32
cmp ebx, 0xfffffffe
je 0x417c26
push str.failed
jmp 0x417c43
lea edx, [esp + 0x28]
push str.no_Relocation_present
push edx
jmp 0x417c48
lea eax, [esp + 0x28]
push str.no_own_section
push eax
jmp 0x417c48
push str.file_is_a_dll
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3b8]
test eax, eax
je 0x417d9e
mov al, byte [0x41e3bc]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call sub.realign.dll_RealignPE
mov ebx, eax
cmp ebx, 0xf0000000
jae 0x417d30
cmp ebx, 0x1e
jbe 0x417d30
push str.Realigning...done
push 0
push 0x180
push 0x467
push esi
mov dword [esp + 0x2c], ebx
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push ebx
lea eax, [esp + 0x2c]
push str.Current_filesize:__Xh
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
lea eax, [ebx + ebx*4]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 2
div dword [esp + 0x1c]
lea edx, [esp + 0x28]
push eax
push str.File_minimized_to:__d__
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
push eax
jmp 0x417d7e
mov eax, dword [0x41e3b0]
test eax, eax
je 0x417d9e
lea ecx, [esp + 0x28]
push str.Realigning...
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
sub ebx, 3
je 0x417d69
dec ebx
je 0x417d5d
lea edx, [esp + 0x28]
push str.failed
push edx
jmp 0x417d73
lea eax, [esp + 0x28]
push str.not_enough_memory
push eax
jmp 0x417d73
lea ecx, [esp + 0x28]
push str.too_many_sections
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3c8]
test eax, eax
je 0x417e56
mov eax, dword [esp + 0x10]
push eax
call fcn.00404080
mov ebx, eax
mov eax, dword [0x41e3b0]
add esp, 4
test eax, eax
je 0x417e56
lea ecx, [esp + 0x28]
push str.Rebuild_ImportTable...
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp ebx, 7
ja case.0x417ddc.1
jmp dword [ebx*4 + 0x41812c]
push str.done
jmp 0x417e26
lea eax, [esp + 0x28]
push str.incomplete
push eax
jmp 0x417e2b
lea ecx, [esp + 0x28]
push str.invalid_RVA_found
push ecx
jmp 0x417e2b
push str.dll_not_found
jmp 0x417e26
lea eax, [esp + 0x28]
push str.access_violation
push eax
jmp 0x417e2b
lea ecx, [esp + 0x28]
push str.not_needed
push ecx
jmp 0x417e2b
push str.failed
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3c4]
test eax, eax
je 0x417ed1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.00418150
mov ebx, eax
mov eax, dword [0x41e3b0]
add esp, 8
test eax, eax
je 0x417ed1
lea eax, [esp + 0x28]
push str.Validate_PE_image...
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x417e9c
lea ecx, [esp + 0x28]
push str.done
push ecx
jmp 0x417ea6
lea edx, [esp + 0x28]
push str.failed
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41d994]
test eax, eax
je 0x417ee7
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004162d0
add esp, 4
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push edx
call ebx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push 0
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push 0
push ecx
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x20], 1
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov edx, dword [esp + 0x10]
push 0x8000
push 0
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x418103
mov eax, dword [0x41e3cc]
test eax, eax
je 0x41800f
mov ecx, dword [esp + 0x15c]
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.IMAGEHLP.dll_BindImageEx]
mov ebx, eax
mov eax, dword [0x41e3b0]
test eax, eax
je 0x41800b
lea edx, [esp + 0x28]
push str.Binding_Imports...
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x417fd6
mov eax, dword [esp + 0x15c]
push 0xb
push eax
call fcn.00417390
add esp, 8
test eax, eax
je 0x417fd6
lea ecx, [esp + 0x28]
push str.done
push ecx
jmp 0x417fe0
lea edx, [esp + 0x28]
push str.failed
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov ebx, dword [esp + 0x1c]
mov eax, dword [0x41e3b0]
test eax, eax
je 0x4180ee
push str._____________________________________________________
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x28]
push ecx
push str.New_filesize:__Xh
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [esp + 0x18]
xor edx, edx
lea ecx, [esp + 0x28]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
div ebx
push eax
push str.File_minimized_to:__d__
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x28]
push edx
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
push str.Rebuilding_finished.
push 0
push 0x180
push 0x467
push esi
call edi
push 0
push 1
push 0x115
push 0x467
push esi
call edi
mov eax, dword [0x41e3b0]
test eax, eax
jne 0x418103
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push str.Rebuilding_done.
push esi
call fcn.004043e0
add esp, 8
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret