Function at 0x1002a844
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x78
mov eax, 0x101d1073
call fcn.10099809
mov dword [ebp - 0x14], ecx
xor ebx, ebx
cmp dword [ecx + 0x1c], ebx
jne 0x1002a864
xor eax, eax
call fcn.100998e1
ret 4
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], ebx
call fcn.10028243
mov dword [ebp - 4], ebx
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x10], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100cef50
cmp esi, 0xffffffff
jne 0x1002a8ca
cmp dword [0x10269fe8], ebx
je 0x1002a85a
push str.MailInfo.dat
push str.ReadMailInfo_read_file__s__fail
push str.MailInfo
push 4
push 0x10269f7c
call fcn.10025270
add esp, 0x14
jmp 0x1002a85a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp dword [0x10269fe8], ebx
je 0x1002a8f6
push edi
push str.ReadMailInfo_file_size:_lu_B
push str.MailInfo
push 4
push 0x10269f7c
call fcn.10025270
add esp, 0x14
cmp edi, 0xffffffff
je 0x1002a99d
cmp edi, ebx
je 0x1002a99d
mov esi, edi
shr esi, 1
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10066294
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x1002a955
cmp dword [0x10269fe8], ebx
je 0x1002a94a
push str.ReadMailInfo_new_memory_fail
push str.MailInfo
push 4
push 0x10269f7c
call fcn.10025270
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002a9a7
lea eax, [edi + 2]
push eax
push ebx
push esi
call fcn.10099920
add esp, 0xc
push ebx
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [0x10269fe8], ebx
je 0x1002a94a
push dword [ebp - 0x18]
push eax
push str.ReadMailInfo_after_read_file__bRead__d___dwRead__lu_
push str.MailInfo
push 4
push 0x10269f7c
call fcn.10025270
add esp, 0x18
jmp 0x1002a94a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x20]
cmp esi, ebx
je 0x1002a85a
lea ecx, [ebp - 0x84]
call fcn.10150580
mov dword [ebp - 4], 1
push esi
lea ecx, [ebp - 0x84]
call fcn.101512e0
push esi
call fcn.1006629f
pop ecx
lea ecx, [ebp - 0x84]
call fcn.101519d0
push str.MailInfo
lea ecx, [ebp - 0x84]
call fcn.101514f0
test eax, eax
jne 0x1002aa09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.10150610
mov eax, ebx
jmp 0x1002a85c
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.GUID
lea ecx, [ebp - 0x84]
call fcn.10151630
mov esi, dword [ebp + 8]
test eax, eax
je 0x1002aa58
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 2
mov eax, dword [eax]
lea ecx, [esi + 8]
push ecx
push eax
call fcn.100e2de0
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.ProcID
lea ecx, [ebp - 0x84]
call fcn.10151630
mov edi, 0x101e6ac8
test eax, eax
je 0x1002aaae
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
mov dword [esi + 0x18], ebx
call fcn.10151b30
mov byte [ebp - 4], 3
mov eax, dword [eax]
lea ecx, [esi + 0x18]
push ecx
push edi
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.ProcBit
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002aaff
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
mov dword [esi + 0x1c], ebx
call fcn.10151b30
mov byte [ebp - 4], 4
mov eax, dword [eax]
lea ecx, [esi + 0x1c]
push ecx
push edi
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Direction
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002ab50
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
mov dword [esi + 0x20], ebx
call fcn.10151b30
mov byte [ebp - 4], 5
mov ecx, dword [eax]
lea eax, [esi + 0x20]
push eax
push edi
push ecx
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.MailSize
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002aba8
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.10151b30
mov byte [ebp - 4], 6
mov eax, dword [eax]
lea ecx, [esi + 0x28]
push ecx
push str._I64u
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.From
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002abef
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 7
push eax
lea ecx, [esi + 0x30]
call fcn.100cf0e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push 0x101ef298
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002ac36
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 8
push eax
lea ecx, [esi + 0x34]
call fcn.100cf0e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push 0x101ef290
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002ac7d
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 9
push eax
lea ecx, [esi + 0x38]
call fcn.100cf0e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Bccs
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002acc4
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0xa
push eax
lea ecx, [esi + 0x3c]
call fcn.100cf0e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Subject
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002ad0b
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0xb
push eax
lea ecx, [esi + 0x40]
call fcn.100cf0e0
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.HasText
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002ad80
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp + 8], ebx
call fcn.10151b30
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
push 0x101e80d4
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.100cef50
cmp dword [ebp + 8], ebx
je 0x1002ad80
mov ecx, dword [ebp - 0x14]
push 1
lea eax, [esi + 0x44]
push eax
call fcn.1002851b
mov ecx, dword [ebp - 0x14]
push ebx
lea eax, [esi + 0x48]
push eax
call fcn.1002851b
lea ecx, [ebp - 0x84]
call fcn.101519a0
jmp 0x1002b027
lea ecx, [ebp - 0x84]
call fcn.10151930
lea ecx, [ebp - 0x54]
call fcn.10027fd7
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x84]
call fcn.101519a0
push 0x101ef24c
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002adf8
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x54], ebx
call fcn.10151b30
mov byte [ebp - 4], 0xe
mov eax, dword [eax]
lea ecx, [ebp - 0x54]
push ecx
push edi
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp + 8]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Size
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002ae50
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call fcn.10151b30
mov byte [ebp - 4], 0xf
mov eax, dword [eax]
lea ecx, [ebp - 0x4c]
push ecx
push str._I64u
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x20]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Status
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002aea1
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x44], ebx
call fcn.10151b30
mov byte [ebp - 4], 0x10
mov eax, dword [eax]
lea ecx, [ebp - 0x44]
push ecx
push edi
push eax
call fcn.1009a1cc
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Name
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002aee8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0x40]
call fcn.100cf0e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x18]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.Cache
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002af2f
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x3c]
call fcn.100cf0e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.DecryptPath
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002af76
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x38]
call fcn.100cf0e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x24]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.DocWatermarkPath
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002afbd
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x34]
call fcn.100cf0e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
call fcn.100cef50
lea ecx, [ebp - 0x84]
call fcn.101519a0
push str.DecryptPath2
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
je 0x1002b004
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x84]
call fcn.10151b30
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x30]
call fcn.100cf0e0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
call fcn.100cef50
lea eax, [ebp - 0x54]
push eax
lea ecx, [esi + 0x4c]
call fcn.1002a0f1
lea ecx, [ebp - 0x84]
call fcn.10151960
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.1000d002
push str.Attach
lea ecx, [ebp - 0x84]
call fcn.10151630
test eax, eax
jne 0x1002ad90
push esi
mov esi, dword [ebp - 0x14]
lea ecx, [esi + 0x28]
call fcn.1002a2d5
xor eax, eax
inc eax
mov dword [esi + 0x24], eax
mov ebx, eax
jmp 0x1002a9f3