Function at 0x42a000
Capabilities:
Get file size
Get file version info
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x4a95d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
xor edx, edx
mov dword [ebp - 0x138], eax
mov eax, dword [0x4aaf04]
push edi
mov edi, dword [ebp + 0x10]
inc edx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x15c], ecx
test eax, eax
jne 0x42a093
test byte [0x4b502c], 0x40
mov dword [ebp - 0x134], edx
jne 0x42a099
mov dword [ebp - 0x134], ecx
cmp dword [ebx + 0x14], ecx
jg 0x42a0a9
mov dword [0x4b2304], edx
jmp 0x42b125
cmp dword [0x4aaf08], ecx
je 0x42a0b9
mov dword [ebx + 0x28], edx
mov eax, dword [0x4aaf04]
mov edx, dword [ebx + 0x44]
test edx, edx
jne 0x42a0c5
cmp dword [ebx + 0x40], ecx
je 0x42a0e6
cmp dword [ebx + 0x24], ecx
jne 0x42b112
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42a0e6
xor edi, edi
cmp word [ecx], di
mov edi, dword [ebp - 0x11c]
jne 0x42b112
test edx, edx
je 0x42a137
mov ecx, dword [ebx]
test ecx, ecx
je 0x42a0f5
cmp byte [ecx], 0
jne 0x42a120
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x42a101
cmp byte [ecx], 0
jne 0x42a120
mov ecx, dword [ebx + 0x10]
xor edx, edx
test ecx, ecx
je 0x42a10f
cmp word [ecx], dx
jne 0x42a120
cmp dword [ebx + 0x28], edx
jne 0x42a120
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x42a139
cmp byte [ecx], 0
je 0x42a139
call fcn.0043714c
test eax, eax
je 0x42b125
push 0x4040b0
jmp 0x42b120
xor edx, edx
cmp dword [0x4b2300], 0
je 0x42a15e
cmp dword [ebx + 0x28], edx
je 0x42a15e
call fcn.0043714c
test eax, eax
je 0x42b125
push 0x4040f4
jmp 0x42b120
mov ecx, dword [0x4bf800]
test ecx, ecx
je 0x42a19e
test eax, eax
jne 0x42a19e
mov dword [ebp - 0x170], edx
lea edi, [ebp - 0x16c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x170]
push eax
mov dword [ebp - 0x16c], edx
call ecx
mov eax, dword [0x4aaf04]
mov edi, dword [ebp - 0x11c]
cmp eax, 5
jne 0x42a1ed
cmp dword [ebx + 0x2c], 0
jne 0x42a1b8
push 0x30303030
call fcn.0044a6b6
jmp 0x42b125
xor eax, eax
cmp dword [ebx + 0x28], eax
jne 0x42a1dd
test esi, esi
je 0x42a1dd
cmp word [esi], ax
je 0x42a1dd
push dword [ebx + 0x2c]
push esi
call fcn.004374c2
test eax, eax
je 0x42b125
xor eax, eax
jmp 0x42a1e7
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x150], eax
mov eax, dword [ebx]
test eax, eax
je 0x42a234
cmp byte [eax], 0
je 0x42a234
xor ebx, ebx
mov esi, eax
cmp byte [eax], bl
je 0x42a20a
cmp byte [esi], 0x3b
je 0x42a20a
inc esi
cmp byte [esi], bl
jne 0x42a200
push ebx
lea ecx, [ebp - 0x12c]
push ecx
push eax
cmp byte [esi], bl
jne 0x42a220
call fcn.0042d370
mov eax, esi
jmp 0x42a22a
mov byte [esi], bl
call fcn.0042d370
lea eax, [esi + 1]
cmp byte [eax], bl
jne 0x42a1fa
mov ebx, dword [ebp - 0x148]
mov eax, dword [ebx + 4]
test eax, eax
je 0x42a27d
cmp byte [eax], 0
je 0x42a27d
xor ebx, ebx
mov esi, eax
cmp byte [eax], bl
je 0x42a252
cmp byte [esi], 0x3b
je 0x42a252
inc esi
cmp byte [esi], bl
jne 0x42a248
push 1
lea ecx, [ebp - 0x12c]
push ecx
push eax
cmp byte [esi], bl
jne 0x42a269
call fcn.0042d370
mov eax, esi
jmp 0x42a273
mov byte [esi], bl
call fcn.0042d370
lea eax, [esi + 1]
cmp byte [eax], bl
jne 0x42a242
mov ebx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x42a2cd
xor ecx, ecx
cmp dword [eax], ecx
jbe 0x42a2cd
push eax
call fcn.0042cf7c
mov esi, eax
mov dword [ebp - 0x13c], esi
test esi, esi
jle 0x42a2cd
inc esi
push esi
mov dword [ebp - 0x13c], esi
call fcn.0044a635
mov dword [ebp - 0x120], eax
test eax, eax
je 0x42a2c5
push esi
push eax
push dword [ebp - 0x12c]
call fcn.0042cfb4
jmp 0x42a2cd
xor eax, eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x42a2e6
cmp byte [eax], 0
je 0x42a2e6
lea ecx, [ebp - 0x128]
push ecx
push eax
call fcn.0042c995
xor eax, eax
cmp dword [ebx + 0x24], eax
je 0x42a30b
test edi, edi
je 0x42a30b
lea eax, [ebp - 0x124]
push eax
call fcn.0042e113
mov esi, dword [ebp - 0x124]
mov dword [ebp - 0x148], esi
jmp 0x42a311
mov dword [ebp - 0x148], eax
lea esi, [ebx + 0xc]
push esi
call fcn.0042e1eb
test eax, eax
je 0x42b05c
lea edi, [ebx + 0x10]
push edi
call fcn.0042e1eb
test eax, eax
je 0x42b05c
cmp dword [esi], 0
je 0x42a592
lea eax, [ebp - 0x130]
push eax
push 0x404124
push dword [esi]
call fcn.0045d6d7
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x124], edi
xor eax, eax
push eax
push 0x8000000
push 3
push eax
push 3
push SysReAllocString
push edi
mov byte [ebp - 0x111], al
call fcn.0043a329
mov esi, eax
mov dword [ebp - 0x160], esi
cmp esi, 0xffffffff
je 0x42a4a5
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x140], eax
test eax, eax
je 0x42a491
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x42a485
push 0x402759
push edi
call fcn.0043a25a
mov edi, eax
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
push 0x10c
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0045d10c
add esp, 0xc
push esi
mov dword [ebp - 0x10c], esi
call fcn.0044a635
mov dword [ebp - 0x110], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.0041f22d
cmp dword [ebp - 0x110], 0
je 0x42a924
push dword [ebp - 0x10c]
mov esi, dword [ebp - 0x11c]
push esi
push dword [ebp - 0x110]
call fcn.0045cdc1
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x42a924
xor eax, eax
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebx + 0x2c]
call fcn.0043db03
test eax, eax
je 0x42a924
push edi
call fcn.0044a645
push esi
mov byte [ebp - 0x111], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x160]
mov edi, dword [ebp - 0x124]
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x111], 0
jne 0x42a554
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x402759
push edi
mov dword [ebp - 0x140], eax
call fcn.0043a25a
mov esi, eax
xor eax, eax
push 0x10c
push eax
lea eax, [ebp - 0x110]
push eax
mov byte [esi], 0x21
call fcn.0045d10c
add esp, 0xc
push 4
pop eax
push eax
mov dword [ebp - 0x10c], eax
call fcn.0044a635
mov dword [ebp - 0x110], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0041f22d
cmp dword [ebp - 0x110], 0
je 0x42a950
push dword [ebp - 0x10c]
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x110]
call fcn.0045cdc1
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x42a950
xor eax, eax
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebx + 0x2c]
call fcn.0043db03
test eax, eax
je 0x42a950
push esi
call fcn.0044a645
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea eax, [ebp - 0x130]
push eax
xor eax, eax
push 0x404124
push eax
call fcn.0045d6d7
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x124], eax
test edi, edi
jne 0x42a35a
lea esi, [ebx + 0xc]
lea edi, [ebx + 0x10]
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x42a979
xor ecx, ecx
cmp dword [ebx + 0x24], ecx
je 0x42a841
push eax
call fcn.0041f203
lea esi, [eax + 1]
lea ecx, [esi + esi]
push ecx
call fcn.0044a635
mov edi, eax
test edi, edi
je 0x42acd5
mov eax, dword [ebp - 0x148]
push esi
push edi
push eax
call fcn.0042027c
lea eax, [ebp - 0x144]
push eax
push 0x404128
push edi
call fcn.0045d6d7
add esp, 0xc
mov dword [ebp - 0x11c], eax
xor ecx, ecx
push ecx
push 0x8000000
push 3
push ecx
push 3
push SysReAllocString
push eax
mov byte [ebp - 0x111], cl
call fcn.0043a329
mov esi, eax
mov dword [ebp - 0x140], esi
cmp esi, 0xffffffff
je 0x42a748
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x160], eax
test eax, eax
je 0x42a734
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x124], eax
test eax, eax
je 0x42a728
push 0x402759
push dword [ebp - 0x11c]
call fcn.0043a25a
mov dword [ebp - 0x130], eax
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
push 0x10c
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0045d10c
add esp, 0xc
push esi
mov dword [ebp - 0x10c], esi
call fcn.0044a635
mov esi, dword [ebp - 0x130]
mov dword [ebp - 0x110], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0041f22d
cmp dword [ebp - 0x110], 0
je 0x42a953
push dword [ebp - 0x10c]
push dword [ebp - 0x124]
push dword [ebp - 0x110]
call fcn.0045cdc1
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x42a953
xor eax, eax
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebx + 0x2c]
call fcn.0043db03
test eax, eax
je 0x42a953
push esi
call fcn.0044a645
push dword [ebp - 0x124]
mov byte [ebp - 0x111], 1
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 0x140]
push dword [ebp - 0x160]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x111], 0
jne 0x42a7fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x402759
push dword [ebp - 0x11c]
mov dword [ebp - 0x130], eax
call fcn.0043a25a
mov esi, eax
xor eax, eax
push 0x10c
push eax
lea eax, [ebp - 0x110]
push eax
mov byte [esi], 0x21
call fcn.0045d10c
add esp, 0xc
push 4
pop eax
push eax
mov dword [ebp - 0x10c], eax
call fcn.0044a635
mov dword [ebp - 0x110], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0041f22d
cmp dword [ebp - 0x110], 0
je 0x42a953
push dword [ebp - 0x10c]
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x110]
call fcn.0045cdc1
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x42a953
xor eax, eax
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebx + 0x2c]
call fcn.0043db03
test eax, eax
je 0x42a953
push esi
call fcn.0044a645
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea eax, [ebp - 0x144]
push eax
xor eax, eax
push 0x404128
push eax
call fcn.0045d6d7
add esp, 0xc
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x42a5f0
push edi
call fcn.0044a645
mov eax, dword [ebp - 0x148]
lea edi, [ebx + 0x10]
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x128]
push eax
push dword [ebx + 0x28]
lea eax, [ebx + 0x38]
push eax
push dword [edi]
mov edi, dword [ebp - 0x120]
push dword [ebx + 0xc]
push edx
push ecx
push edi
call fcn.0042d54b
test eax, eax
je 0x42a9f5
cmp dword [0x4b22d8], 0
je 0x42a9bc
cmp dword [0x4b22dc], 0
jne 0x42a893
cmp dword [0x4aaf04], 5
je 0x42a9c7
xor edx, edx
inc edx
cmp dword [ebp - 0x134], 0
mov dword [ebp - 0x118], edx
mov dword [ebx + 0x3c], edx
je 0x42a8d9
mov ecx, dword [0x4bf800]
test ecx, ecx
je 0x42a8d9
xor eax, eax
lea edi, [ebp - 0x170]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x170]
push eax
push ecx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
call fcn.0043b075
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4000
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.0041f266
test eax, eax
je 0x42acd5
push 0xffffffffffffffff
push 0xffffffffffffffff
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push eax
call esi
mov eax, dword [ebx + 0x2c]
xor ecx, ecx
cmp dword [eax], ecx
je 0x42aa00
xor eax, eax
inc eax
mov dword [ebp - 0x14c], eax
jmp 0x42aa02
push edi
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x118], ebx
call fcn.0044a645
cmp dword [ebp - 0x110], ebx
je 0x42b062
push dword [ebp - 0x110]
call fcn.0044a645
jmp 0x42b062
push esi
jmp 0x42a925
xor eax, eax
mov ebx, eax
push esi
mov dword [ebp - 0x118], ebx
call fcn.0044a645
cmp dword [ebp - 0x110], ebx
je 0x42a976
push dword [ebp - 0x110]
call fcn.0044a645
push edi
jmp 0x42a946
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
jg 0x42a847
mov edx, dword [ebp - 0x128]
test edx, edx
je 0x42a99a
cmp dword [edx], 0
ja 0x42a84d
cmp dword [ebx + 0x28], 0
jne 0x42a84d
cmp dword [esi], 0
jne 0x42a84d
xor esi, esi
cmp dword [edi], esi
je 0x42a893
jmp 0x42a84d
xor eax, eax
cmp dword [ebx + 0x30], eax
jne 0x42a893
push ebx
push 0x4308b8
push dword [0x4bf7bc]
push 0x6d
push dword [0x4784a8]
call fcn.0043261c
test eax, eax
jne 0x42a893
mov eax, dword [ebp - 0x138]
mov dword [eax + 8], 1
mov ebx, dword [ebp - 0x118]
jmp 0x42b068
mov eax, ecx
cmp dword [ebx + 0x28], ecx
je 0x42aa16
cmp dword [ebp - 0x158], ecx
jne 0x42aa16
inc eax
mov dword [ebp - 0x14c], eax
test eax, eax
je 0x42aa21
call fcn.00431763
xor ecx, ecx
mov dword [0x4b2330], ecx
mov eax, dword [ebx + 0x2c]
cmp dword [eax], ecx
je 0x42ab34
mov dword [0x4b2330], 1
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x11c], ecx
cmp dword [eax], ecx
jbe 0x42ab24
mov edi, ecx
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0xc]
add eax, 8
add eax, edi
push eax
call fcn.0042025c
lea esi, [eax + 1]
push esi
lea eax, [ebp - 0x138]
push eax
mov dword [ebp - 0x144], esi
call fcn.0042023c
test eax, eax
je 0x42acd5
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0xc]
add eax, 8
push esi
mov esi, dword [ebp - 0x138]
add eax, edi
push eax
push esi
call fcn.0045cdc1
add esp, 0xc
push dword [ebp - 0x144]
push esi
call fcn.0043a1e0
mov ecx, dword [ebx + 0x2c]
mov eax, dword [ecx + 0xc]
push dword [eax + edi + 4]
xor eax, eax
push dword [ecx]
push dword [ebp - 0x11c]
push dword [ebp - 0x14c]
push eax
call fcn.004317a6
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0xc]
push dword [eax + edi + 4]
push dword [edi + eax]
push esi
call fcn.0041f362
push esi
test eax, eax
je 0x42ace2
call fcn.0044a645
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov esi, dword [ebp - 0x11c]
mov eax, dword [ebx + 0x2c]
inc esi
add edi, 0x10c
mov dword [ebp - 0x11c], esi
cmp esi, dword [eax]
jb 0x42aa4f
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor ecx, ecx
mov dword [ebp - 0x15c], 1
mov dword [0x4b2330], ecx
cmp dword [0x4aaf04], 5
je 0x42ab7b
lea eax, [ebp - 0x154]
push eax
call fcn.0042e0c3
test eax, eax
je 0x42ab7b
push dword [ebp - 0x154]
call fcn.0042025c
inc eax
push eax
push dword [ebp - 0x154]
push 0x40412c
call fcn.0041f362
test eax, eax
je 0x42acd5
push 0xffffffffffffffff
push 0xffffffffffffffff
call edi
push eax
call esi
cmp dword [ebp - 0x12c], 0
je 0x42ab9e
push dword [ebp - 0x13c]
push dword [ebp - 0x120]
call fcn.0042d3ff
push 0xffffffffffffffff
push 0xffffffffffffffff
call edi
push eax
call esi
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x42abb7
push eax
call fcn.0042d426
push 0xffffffffffffffff
push 0xffffffffffffffff
call edi
push eax
call esi
cmp dword [ebx + 0x10], 0
je 0x42acc1
lea eax, [ebp - 0x130]
push eax
push 0x404124
push dword [ebx + 0x10]
call fcn.0045d6d7
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x11c], esi
lea eax, [ebp - 0x138]
push eax
push esi
call fcn.0043a3ad
mov edi, eax
test edi, edi
jle 0x42ac52
push edi
call fcn.0044a635
mov esi, eax
test esi, esi
je 0x42ac0c
push edi
xor eax, eax
push eax
push esi
call fcn.0045d10c
add esp, 0xc
push esi
push edi
push dword [ebp - 0x138]
push dword [ebp - 0x11c]
call sub.VERSION.dll_GetFileVersionInfoW
push 0x404138
push dword [ebp - 0x11c]
call fcn.0043a25a
push edi
push esi
push eax
mov dword [ebp - 0x134], eax
call fcn.0041f362
push dword [ebp - 0x134]
test eax, eax
je 0x42ace2
call fcn.0044a645
jmp 0x42ac81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x404138
push esi
mov dword [ebp - 0x144], eax
call fcn.0043a25a
mov esi, eax
push 4
lea eax, [ebp - 0x144]
push eax
push esi
mov byte [esi], 0x21
call fcn.0041f362
test eax, eax
je 0x42acef
push esi
call fcn.0044a645
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffffffffffffffff
push 0xffffffffffffffff
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea eax, [ebp - 0x130]
push eax
xor eax, eax
push 0x404124
push eax
call fcn.0045d6d7
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x11c], eax
test esi, esi
jne 0x42abe0
xor ecx, ecx
cmp dword [ebx + 0x30], ecx
je 0x42ad0c
lea eax, [ebx + 0x18]
push eax
call fcn.0041f41a
test eax, eax
jne 0x42acfd
xor eax, eax
mov dword [ebp - 0x118], eax
jmp 0x42b00c
xor eax, eax
mov dword [ebp - 0x118], eax
jmp 0x42afec
xor eax, eax
mov dword [ebp - 0x118], eax
push esi
jmp 0x42afec
push 0xffffffffffffffff
push 0xffffffffffffffff
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor ecx, ecx
cmp dword [ebx + 0x28], ecx
je 0x42b00c
cmp dword [ebp - 0x158], 0
jne 0x42b00c
cmp dword [0x4aaf04], 0
jne 0x42adc3
cmp dword [0x4bf160], 0
jne 0x42ad55
mov dword [ebp - 0x118], ecx
call fcn.0043714c
test eax, eax
je 0x42b00c
push 0x404140
jmp 0x42b007
push dword [0x4bf164]
push 1
push ecx
push dword [ebp - 0x14c]
push dword [ebp - 0x15c]
call fcn.004317a6
test byte [0x4b502c], 0x20
mov dword [0x4b2330], 1
mov eax, 0x404164
jne 0x42ad8c
mov eax, 0x404174
push dword [0x4bf164]
push dword [0x4bf160]
push eax
call fcn.0041f362
test eax, eax
jne 0x42af95
mov dword [ebp - 0x118], eax
call fcn.0043714c
test eax, eax
je 0x42b00c
push 0x404180
jmp 0x42b007
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x42aff3
cmp word [eax], cx
je 0x42aff3
push eax
call fcn.0041f203
lea esi, [eax + 1]
lea ecx, [esi + esi]
push ecx
call fcn.0044a635
mov edi, eax
test edi, edi
jne 0x42ae0f
mov dword [ebp - 0x118], eax
call fcn.0043714c
test eax, eax
je 0x42b00c
push 0x4041cc
jmp 0x42b007
mov eax, dword [ebp - 0x150]
push esi
push edi
push eax
call fcn.0042027c
push 0x7c
push edi
call fcn.0043a44b
inc eax
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x140]
push eax
push 0x404128
push edi
mov dword [0x4b2330], 1
call fcn.0045d6d7
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x150], esi
xor eax, eax
push eax
push 0x8000000
push 3
push eax
push 3
push SysReAllocString
push esi
mov byte [ebp - 0x111], al
call fcn.0043a329
mov dword [ebp - 0x124], eax
cmp eax, 0xffffffff
je 0x42afc3
xor ecx, ecx
push ecx
push ecx
push ecx
push 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x130], eax
test eax, eax
je 0x42af3c
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x134], eax
test eax, eax
je 0x42af30
push 0x402759
push esi
call fcn.0043a25a
mov dword [ebp - 0x144], eax
test eax, eax
je 0x42af24
xor eax, eax
push eax
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push dword [ebp - 0x138]
xor eax, eax
push eax
push dword [ebp - 0x14c]
push dword [ebp - 0x15c]
call fcn.004317a6
push esi
push dword [ebp - 0x134]
mov esi, dword [ebp - 0x144]
push esi
call fcn.0041f362
push esi
test eax, eax
je 0x42afab
call fcn.0044a645
mov esi, dword [ebp - 0x150]
mov byte [ebp - 0x111], 1
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x111], 0
je 0x42afc3
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea eax, [ebp - 0x140]
push eax
xor eax, eax
push 0x404128
push eax
call fcn.0045d6d7
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x150], eax
test esi, esi
jne 0x42ae53
push edi
call fcn.0044a645
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffffffffffffffff
xor eax, eax
push 0xffffffffffffffff
mov dword [0x4b2330], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp 0x42b00c
xor eax, eax
mov dword [ebp - 0x118], eax
call fcn.0044a645
push edi
call fcn.0044a645
jmp 0x42adac
call fcn.0043714c
test eax, eax
je 0x42afd9
push esi
push 0x4041f8
call fcn.004370fa
pop ecx
pop ecx
push 0x30303030
call fcn.0044a6b6
xor ecx, ecx
mov dword [ebp - 0x118], ecx
push edi
call fcn.0044a645
jmp 0x42b00c
mov dword [ebp - 0x118], ecx
call fcn.0043714c
test eax, eax
je 0x42b00c
push 0x4041a4
call fcn.00439586
lea esi, [ebx + 0x1c]
lea edi, [ebx + 0x20]
mov ebx, dword [ebp - 0x118]
push ebx
push esi
push edi
call fcn.0041f44e
test eax, eax
je 0x42b028
test ebx, ebx
jne 0x42b049
call fcn.0043714c
test eax, eax
je 0x42b03b
push 0x40421c
call fcn.00439586
xor eax, eax
mov ebx, eax
mov dword [esi], eax
mov dword [edi], eax
mov dword [ebp - 0x118], ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp 0x42b062
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x120]
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x42b09f
xor ecx, ecx
mov esi, ecx
cmp dword [eax], ecx
jbe 0x42b099
mov ebx, eax
mov eax, dword [ebx + 0xc]
push dword [eax + esi*4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc esi
cmp esi, dword [ebx]
jb 0x42b07c
mov ebx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x128]
push eax
call fcn.0043d8de
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x42b0d4
xor edx, edx
mov esi, edx
cmp dword [eax], edx
jbe 0x42b0ce
mov ecx, dword [eax + 0xc]
cmp dword [ecx + esi*4], edx
je 0x42b0c9
push dword [ecx + esi*4]
call fcn.0044a645
mov eax, dword [ebp - 0x12c]
xor edx, edx
inc esi
cmp esi, dword [eax]
jb 0x42b0b1
push eax
call fcn.0043d8de
test edi, edi
je 0x42b0de
push edi
call fcn.0044a645
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x42b0ee
push eax
call fcn.0044a645
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, ebx
jmp 0x42b127
call fcn.0043714c
test eax, eax
je 0x42b125
push 0x404074
call fcn.00439586
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cd7f
leave
ret 0x10