Function at 0x4027ee
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x411034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x284], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x2c
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x2c0]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x288], 0x800b0100
mov dword [ebp - 0x2c4], ebx
call fcn.00404fe0
add esp, 0xc
push 8
pop ecx
push ebx
push ebx
push 3
push ebx
push 1
xor eax, eax
mov dword [ebp - 0x2e8], ebx
lea edi, [ebp - 0x2e4]
rep stosd dword es:[edi], eax
push 0x80000000
push dword [ebp - 0x284]
mov dword [ebp - 0x290], ebx
lea edi, [ebp - 0x28c]
mov dword [ebp - 0x60], 0xf750e6c3
mov word [ebp - 0x5c], 0x38ee
mov word [ebp - 0x5a], 0x11d1
mov byte [ebp - 0x58], 0x85
mov byte [ebp - 0x57], 0xe5
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], 0xc0
mov byte [ebp - 0x54], 0x4f
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0x95
mov byte [ebp - 0x51], 0xee
stosd dword es:[edi], eax
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x280], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402b86
cmp edi, ebx
je 0x402b86
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x402b7f
cmp dword [ebp - 0x28c], ebx
jg 0x402b7f
jl 0x4028ff
cmp dword [ebp - 0x290], 0x2000000
ja 0x402b7f
mov eax, 0x100
push eax
mov dword [ebp - 0x274], eax
call fcn.00404f46
pop ecx
push ebx
push eax
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x274]
push eax
push edi
call dword [esi + 0x1058]
test eax, eax
jne 0x402975
push dword [ebp - 0x278]
call fcn.0040505a
push dword [ebp - 0x274]
call fcn.00404f46
pop ecx
pop ecx
push ebx
push eax
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x274]
push eax
push edi
call dword [esi + 0x1058]
test eax, eax
jne 0x402975
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x278]
call fcn.0040505a
pop ecx
jmp 0x402b86
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x280]
push eax
call dword [esi + 0x105c]
test eax, eax
je 0x402964
mov eax, dword [ebp - 0x274]
push 0x11
pop ecx
push 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
lea eax, [eax + eax + 1]
pop edx
mul edx
seto cl
movsw word es:[edi], word [esi]
neg ecx
or ecx, eax
push ecx
call fcn.00404f46
pop ecx
xor ecx, ecx
cmp dword [ebp - 0x274], ebx
mov edi, eax
jbe 0x4029fe
mov eax, dword [ebp - 0x278]
add eax, ecx
movzx edx, byte [eax]
shr edx, 4
movsx dx, byte [ebp + edx - 0x50]
mov word [edi + ecx*4], dx
movzx eax, byte [eax]
and eax, 0xf
movsx ax, byte [ebp + eax - 0x50]
mov word [edi + ecx*4 + 2], ax
inc ecx
cmp ecx, dword [ebp - 0x274]
jb 0x4029cc
mov eax, dword [ebp - 0x274]
mov esi, dword [ebp - 0x27c]
push ebx
push ebx
mov word [edi + eax*4], bx
push dword [ebp - 0x274]
push dword [ebp - 0x278]
push dword [ebp - 0x280]
call dword [esi + 0x1060]
push dword [ebp - 0x278]
mov dword [ebp - 0x27c], eax
call fcn.0040505a
cmp dword [ebp - 0x27c], ebx
pop ecx
je 0x402b5e
push 0x208
lea eax, [ebp - 0x26c]
push ebx
push eax
mov dword [ebp - 0x270], ebx
call fcn.00404fe0
add esp, 0xc
push ebx
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x27c]
call dword [esi + 0x1064]
test eax, eax
je 0x402b4b
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x2d8], eax
push 2
pop eax
xor ecx, ecx
inc ecx
cmp byte [esi + 0x1032], bl
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2e8], 0x24
mov dword [ebp - 0x2dc], edi
mov dword [ebp - 0x2c4], 0x30
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x2ac], eax
je 0x402aed
or dword [ebp - 0x29c], 0x1200
jmp 0x402af4
or dword [ebp - 0x29c], 0x10
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x60]
push eax
push 0xffffffffffffffff
call dword [esi + 0x1078]
mov ecx, dword [ebp - 0x294]
cmp ecx, ebx
mov dword [ebp - 0x288], eax
je 0x402b2e
cmp eax, 0x800b0100
mov word [ecx], bx
je 0x402b2e
push dword [ebp - 0x2a4]
mov edx, esi
call fcn.00402617
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x60]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x2a8], 2
call dword [esi + 0x1078]
push ebx
push dword [ebp - 0x27c]
push dword [ebp - 0x280]
call dword [esi + 0x1068]
push edi
call fcn.0040505a
pop ecx
push ebx
push dword [ebp - 0x280]
call dword [esi + 0x106c]
mov eax, dword [ebp - 0x288]
call fcn.00402207
jmp 0x402b89
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404335
leave
ret 8