Function at 0x4e2a60
Capabilities:
Create thread
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push ebx
push 0x69d8f9
push 0x15c
call fcn.004e0530
mov esi, eax
add esp, 0xc
cmp esi, ebx
mov dword [esp + 0xc], esi
jne 0x4e2a8c
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push edi
mov dword [esp + 0x14], 0x15c
mov dword [esp + 0x18], ebx
cld
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0xc], ecx
jne 0x4e2ac8
cmp ecx, ebx
jne 0x4e2ac8
xor eax, eax
jmp 0x4e2acd
mov eax, 1
cmp eax, 1
push ebp
push ebx
push 0x80
push 3
push ebx
push 1
mov dword [esi + 4], eax
push 0x80000000
jne 0x4e2c80
mov ebp, dword [esp + 0x3c]
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4e2c92
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 8], ebx
mov dword [esi], ebx
je 0x4e2b5b
push ebx
push 0x69d8f9
push 0x20000
call fcn.004e0530
add esp, 0xc
cmp eax, ebx
mov dword [esi + 0x150], eax
jne 0x4e2b5b
push ebx
call fcn.004e0760
push esi
call fcn.004e0760
push 0x6a1984
call fcn.004e16a0
add esp, 0xc
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebx
push ebx
push 1
push ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], ebx
call edi
push ebx
push 1
push 1
push ebx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x1c]
push eax
push ebx
push eax
push 0x4dea10
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x20], eax
jne 0x4e2bd8
mov eax, dword [esi + 0x150]
cmp eax, ebx
je 0x4e2ba9
push eax
call fcn.004e0760
add esp, 4
mov ecx, dword [esi + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
push esi
call fcn.004e0760
push 0x6a1950
call fcn.004e16a0
add esp, 8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebp
lea eax, [esi + 0x3c]
push eax
mov dword [esi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x38], 1
jne 0x4e2cb0
mov eax, dword [esi + 0x150]
cmp eax, ebx
je 0x4e2c23
push eax
call fcn.004e0760
add esp, 4
mov ecx, dword [esi + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call edi
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call ebp
cmp dword [esp + 0x10], 0x103
je 0x4e2c41
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004e0760
push 0x6a192c
call fcn.004e16a0
add esp, 8
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4e2ca5
push esi
call fcn.004e0760
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x18], eax
pop ebp
pop edi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret