Function at 0x401499
Capabilities:
Get file size
Move file
Parse pe header
Read file on windows
Resolve function by parsing pe exports
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x264
mov eax, dword [ebp + 0xc]
push 0
push 0x8000080
and eax, 1
cmp eax, 1
push 3
sbb eax, eax
and eax, 0xc0000000
push 0
sub eax, 0x40000000
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0x25c], 0
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x258], eax
inc eax
jne 0x4014ed
push str.Could_not_open_file_for_reading
jmp 0x401abb
lea eax, [ebp - 0x238]
push eax
push 0
push 0
push dword [ebp - 0x258]
call sub.KERNEL32.dll_GetFileTime
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x258]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0x248], eax
cmp eax, 0xffff0000
ja 0x40152b
cmp dword [ebp - 0x23c], 0
je 0x401532
push str.File_is_too_large_to_handle
jmp 0x40153c
cmp eax, 0x3f
ja 0x401551
push str.File_is_too_small_to_contain_PE_headers
call sub.msvcrt.dll_puts
push dword [ebp - 0x258]
call sub.KERNEL32.dll_CloseHandle
jmp 0x401ac0
push 0x20000
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
mov edi, eax
jne 0x40156a
push str.Error_allocating_memory
jmp 0x40153c
push 0
lea edx, [ebp - 0x240]
push edx
push 0x1000
push eax
push dword [ebp - 0x258]
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x40158f
push str.Error_reading_file
jmp 0x4015cd
cmp word [edi], 0x5a4d
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x244], 0
je 0x4015e8
push str.File_does_not_contain_a_valid_DOS_header
call sub.msvcrt.dll_puts
push dword [ebp - 0x258]
call sub.KERNEL32.dll_CloseHandle
push edi
call sub.KERNEL32.dll_GlobalFree
jmp 0x401ac0
mov edx, dword [edi + 0x3c]
lea eax, [edx + 0x108]
cmp eax, dword [ebp - 0x240]
jbe 0x401600
push str.NT_header_is_out_of_bounds
jmp 0x4015cd
lea ebx, [edi + edx]
cmp dword [ebx], 0x4550
je 0x401612
push str.PE_file_header_is_missing_a_NT_signature
jmp 0x4015cd
test byte [ebp + 0xc], 4
lea esi, [ebx + 4]
je 0x401652
mov eax, esi
sub eax, edi
add eax, 4
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x238]
push eax
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x238]
push eax
push edx
call fcn.0040146b
mov eax, dword [ebp - 0x244]
mov dword [esi + 4], eax
pop esi
pop eax
movzx ecx, word [ebx + 0x18]
movzx eax, cx
cmp ax, 0x10b
setne dl
cmp ax, 0x20b
setne al
movzx eax, al
test edx, eax
je 0x401678
push str.Unsupported_PE_format
jmp 0x4015cd
cmp dword [ebx + 0x58], 0
lea eax, [ebx + 0x58]
je 0x4016a1
mov dword [ebx + 0x58], 0
sub eax, edi
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0xc]
shr eax, 1
xor eax, 1
and eax, 1
mov dword [ebp - 0x25c], eax
lea edx, [ebx + 0x5e]
cmp cx, 0x10b
lea esi, [ebx + 0x78]
mov dword [ebp - 0x260], edx
lea eax, [ebx + 0x74]
je 0x4016c3
lea esi, [ebx + 0x88]
lea eax, [ebx + 0x84]
cmp dword [eax], 4
jbe 0x4016d5
cmp dword [esi + 0x20], 0
je 0x4016d5
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4016df
push str.No_certificate_found_in_file
jmp 0x4015cd
push eax
push dword [esi + 0x20]
push str.__Certificate_address:__u_n__Certificate_size:_____u_n_n
call sub.msvcrt.dll_printf
mov edx, dword [esi + 0x20]
add esp, 0xc
mov eax, edx
add eax, dword [esi + 0x24]
cmp eax, dword [ebp - 0x248]
je 0x40170a
push str.Invalid_certificate_position
jmp 0x4015cd
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x260]
cmp byte [eax], 0
jns 0x401742
test byte [ebp + 0xc], 8
push str.File_uses_Forced_Code_Integrity_checking_n
mov eax, str.Warning:__s_n
jne 0x401730
mov eax, 0x4041b9
push eax
call sub.msvcrt.dll_printf
test byte [ebp + 0xc], 8
pop ecx
pop ebx
je 0x4015d2
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [ebp - 0x258]
call fcn.004013b0
add esp, 0xc
test eax, eax
jne 0x401781
test byte [ebp + 0xc], 8
push str.Certificate_table_is_invalid_n
mov eax, str.Warning:__s_n
jne 0x40176f
mov eax, 0x4041b9
push eax
call sub.msvcrt.dll_printf
test byte [ebp + 0xc], 8
pop eax
pop edx
je 0x4015d2
mov dword [esi + 0x20], 0
mov edx, dword [ebp - 0x260]
mov dword [esi + 0x24], 0
sub esi, edi
add esi, 0x20
movzx eax, word [edx]
mov dword [ebp - 0x26c], esi
test al, al
jns 0x4017bb
and al, 0x7f
mov word [edx], ax
sub edx, edi
mov word [ebp - 0x11e], ax
mov dword [ebp - 0x264], edx
test byte [ebp + 0xc], 1
mov ebx, dword [ebp - 0x258]
jne 0x4017c9
xor ebx, ebx
mov esi, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x240]
mov eax, esi
cmp esi, edx
jbe 0x4017dd
mov eax, edx
test byte [ebp + 0xc], 1
mov dword [ebp - 0x240], eax
jne 0x40184b
push dword [ebp + 8]
lea ebx, [ebp - 0x11c]
push str._s.unsing
push ebx
call sub.msvcrt.dll_sprintf
push 0
push pe_nt_image_headers32
push 1
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
add esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
jne 0x401829
push str.Could_not_open_file_for_writing
jmp 0x4015cd
push 0
push 0
push dword [ebp - 0x23c]
push eax
call sub.KERNEL32.dll_SetFilePointer
push ebx
call sub.KERNEL32.dll_SetEndOfFile
push 0
push 0
push 0
push ebx
call sub.KERNEL32.dll_SetFilePointer
cmp dword [ebp - 0x25c], 0
je 0x40186f
push dword [ebp - 0x254]
push dword [ebp - 0x240]
push edi
call fcn.004012d0
mov dword [ebp - 0x254], eax
add esp, 0xc
test byte [ebp + 0xc], 1
jne 0x4018a9
push 0
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x240]
push edi
push ebx
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x40189d
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x248], eax
je 0x4018a9
push str.Error_writing_file
call sub.msvcrt.dll_puts
jmp 0x4018ed
sub esi, dword [ebp - 0x240]
lea eax, [ebp - 0x240]
push 0
push eax
cmp esi, 0x20000
mov eax, esi
jbe 0x4018c7
mov eax, 0x20000
push eax
push edi
push dword [ebp - 0x258]
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x4018f8
push str.Error_reading_file
call sub.msvcrt.dll_puts
test byte [ebp + 0xc], 1
pop esi
jne 0x4015d2
push ebx
call sub.KERNEL32.dll_CloseHandle
jmp 0x4015d2
cmp dword [ebp - 0x240], 0
jne 0x40184b
test byte [ebp + 0xc], 1
je 0x4019e1
push ebx
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call sub.KERNEL32.dll_SetEndOfFile
push 0
push 0
push dword [ebp - 0x26c]
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
lea edx, [ebp - 0x240]
lea eax, [ebp - 0x250]
push edx
push 8
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0x264], 0
je 0x401982
push 0
push 0
push dword [ebp - 0x264]
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x11e]
push 2
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0x270], 0
je 0x4019b3
push 0
push 0
push dword [ebp - 0x270]
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x254]
push 4
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
test byte [ebp + 0xc], 4
je 0x4019e1
push 0
push 0
push dword [ebp - 0x268]
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push 4
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0x25c], 0
je 0x401a1e
push 0
mov eax, dword [ebp - 0x23c]
push 0
push dword [ebp - 0x270]
add dword [ebp - 0x254], eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x254]
push 4
push eax
push ebx
call sub.KERNEL32.dll_WriteFile
test byte [ebp + 0xc], 4
jne 0x401a35
lea eax, [ebp - 0x238]
push eax
push 0
push 0
push ebx
call sub.KERNEL32.dll_SetFileTime
xor dword [ebp + 0xc], 1
mov esi, dword [ebp + 0xc]
and esi, 1
je 0x401a47
push ebx
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x258]
call sub.KERNEL32.dll_CloseHandle
push edi
call sub.KERNEL32.dll_GlobalFree
test esi, esi
je 0x401ac4
push dword [ebp + 8]
lea eax, [ebp - 0x230]
xor ebx, ebx
push str._s.bak
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
lea esi, [ebp - 0x230]
push esi
push dword [ebp + 8]
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x401aa3
push ebx
inc ebx
push dword [ebp + 8]
push str._s._3.3d
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x10
cmp ebx, 0x3e8
jle 0x401a75
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x401ac4
push str.Could_not_rename_temp_file
call sub.msvcrt.dll_puts
xor eax, eax
jmp 0x401ad3
push str.PE_file_unsigned_successfully
call sub.msvcrt.dll_puts
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret