Function at 0x4047e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7ab4
call fcn.0043b8c0
mov eax, dword [0x45b480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
push esi
push edi
mov dword [ebp - 0x7aa8], ecx
mov dword [ebp - 0x7aac], ebx
mov dword [ebp - 0x7a9c], 0
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404834
test dl, dl
je 0x404830
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404834
add eax, 2
add ecx, 2
test dl, dl
jne 0x404814
xor eax, eax
jmp 0x404839
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404850
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cb12
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00403d50
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00434e30
add esp, 0xc
lea ecx, [ebp - 0x278]
push ecx
mov edi, ebx
call fcn.00404400
test eax, eax
je 0x40483d
push ebx
push str._s.gz
lea edx, [ebp - 0x110]
push 0x103
push edx
call fcn.0042cfab
push 0x7818
lea eax, [ebp - 0x7a90]
push 0
push eax
call fcn.00434e30
mov ecx, dword [0x5738c4]
mov edx, dword [ecx + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x1c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000100
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x7a98], edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x40483d
push ebx
push str._s.dat
lea ecx, [ebp - 0x110]
push 0x103
push ecx
call fcn.0042cfab
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea edx, [ebp - 0x110]
push edx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push esi
mov dword [ebp - 0x7a94], eax
call edi
mov ebx, eax
test ebx, ebx
je 0x404b47
cmp ebx, 0xffffffff
je 0x404b47
mov eax, dword [ebp - 0x7a94]
test eax, eax
je 0x40495e
push 0
push eax
call edi
mov dword [ebp - 0x7a9c], eax
jmp 0x404964
mov eax, dword [ebp - 0x7a9c]
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x7a90], 0x515
mov dword [ebp - 0x77f0], ecx
mov dword [ebp - 0x77f4], ebx
call sym.TQMWatcher.exe_GbCollectorGetQQUid
push esi
mov dword [ebp - 0x7a84], eax
mov dword [ebp - 0x7a80], edx
call fcn.004042f0
push edx
push eax
lea edx, [ebp - 0x77fc]
push edx
call fcn.0043d5a0
add esp, 0xc
lea eax, [ebp - 0x278]
push eax
push 0x454ef0
lea ecx, [ebp - 0x7a7c]
push 0x200
push ecx
call fcn.0042cfab
lea edx, [ebp - 0x174]
push edx
push 0x454ef0
lea eax, [ebp - 0x787c]
push 0x20
push eax
call fcn.0042cfab
mov ecx, dword [0x5738c4]
add ecx, 0x20
push ecx
push 0x454ef0
lea edx, [ebp - 0x785c]
push 0x20
push edx
call fcn.0042cfab
lea eax, [ebp - 0x154]
push eax
push 0x454ef0
lea ecx, [ebp - 0x783c]
push 0x40
push ecx
call fcn.0042cfab
lea eax, [ebp - 0x783c]
add esp, 0x40
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404a25
sub eax, edx
jne 0x404a40
mov edx, dword [0x5738c4]
cmp dword [edx + 0x18], eax
je 0x404a40
call sym.TQMWatcher.exe_GbCollectorSetDeleteDump
mov eax, dword [ebp - 0x7a98]
mov edi, dword [eax]
test edi, edi
jne 0x404a51
or eax, 0xffffffff
jmp 0x404ac7
mov edx, dword [edi + 0x28]
mov eax, dword [edi + 0x2c]
lea ecx, [ebp - 0x7a90]
mov dword [ebp - 0x7ab4], ecx
mov ecx, dword [edi + 0xc]
push ecx
mov ecx, dword [edi + 0x14]
mov dword [ebp - 0x7aa4], edx
lea edx, [ebp - 0x7ab4]
mov dword [ebp - 0x7aa0], eax
push edx
lea eax, [ebp - 0x7aa4]
push eax
push ecx
mov dword [ebp - 0x7ab0], 0x7818
call fcn.0043d680
add esp, 0x10
test eax, eax
js 0x404ac7
mov edx, dword [ebp - 0x7aa0]
mov eax, dword [ebp - 0x7aa4]
mov ecx, dword [edi]
push 0x3e8
push edx
push eax
push ecx
call fcn.0043ceb0
sub eax, dword [ebp - 0x7aa0]
add esp, 0x10
neg eax
sbb eax, eax
test eax, eax
jns 0x404ade
mov edx, dword [0x5738c4]
cmp dword [edx + 0x18], 0
je 0x404b47
push eax
call sym.TQMWatcher.exe_GbCollectorSetDeleteDump
add esp, 4
jmp 0x404b47
test esi, esi
je 0x404b05
mov eax, dword [0x5738c4]
cmp dword [eax + 0x18], 0
je 0x404af6
push ebx
call sym.TQMWatcher.exe_GbCollectorSetDeleteDump
add esp, 4
mov ecx, dword [ebp - 0x7a98]
push 1
push ebx
push esi
call fcn.00404650
cmp dword [ebp - 0x7a94], 0
je 0x404b47
mov eax, dword [ebp - 0x7a9c]
test eax, eax
je 0x404b47
cmp eax, 0xffffffff
je 0x404b47
mov ecx, dword [0x5738c4]
cmp dword [ecx + 0x18], 0
je 0x404b32
push eax
call sym.TQMWatcher.exe_GbCollectorSetDeleteDump
add esp, 4
mov edx, dword [ebp - 0x7a94]
mov ecx, dword [ebp - 0x7a98]
push 2
push eax
push edx
call fcn.00404650
call fcn.00404360
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebp - 0x7a94]
test eax, eax
je 0x404b62
push eax
call esi
mov eax, dword [ebp - 0x7aac]
mov ecx, dword [ebp - 0x7aa8]
push eax
push 0x103
push ecx
call fcn.0042cfea
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042cb12
mov esp, ebp
pop ebp
ret