Function at 0x4bebc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ecx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4bebfe
call fcn.004b34f0
mov edi, eax
test edi, edi
js 0x4bec72
jmp 0x4bec03
mov ebx, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
jne 0x4bec3a
call fcn.004b34f0
mov edi, eax
jmp 0x4bec65
mov eax, dword [ebp - 0x20]
push 0
push eax
push 0
push 0
push 4
push ecx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jne 0x4bec99
call fcn.004b34f0
push dword [ebp - 0xc]
mov edi, eax
call esi
test edi, edi
jns 0x4bec84
test ebx, ebx
je 0x4bec70
push ebx
call esi
xor esi, esi
cmp edi, 0x80030104
jne 0x4bede3
push esi
jmp 0x4bee2b
test ebx, ebx
je 0x4bec8b
push ebx
call esi
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 8]
xor edi, edi
cmp edx, 0x24
jbe 0x4bede9
cmp dword [ecx], 0x51515346
jne 0x4bede9
cmp dword [ecx + 4], 0xb069260e
mov eax, dword [ecx + 0x20]
jne 0x4becc3
cmp edx, eax
jae 0x4becc8
mov edi, 0x80030104
mov ebx, dword [ebp - 0x10]
add ecx, eax
mov eax, dword [ebp - 0x14]
add ebx, 0x458
add eax, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], eax
xor esi, esi
mov dword [ebp - 8], 0
nop word [eax + eax]
mov edx, dword [esi + 0x600864]
cmp edx, 0xffffffff
je case.default.0x4bed1e
movzx eax, word [esi + 0x600856]
add eax, edx
add eax, ecx
cmp eax, dword [ebp - 0x1c]
ja 0x4bed9e
mov eax, dword [esi + 0x600850]
cmp eax, 0xa
ja case.default.0x4bed1e
jmp dword [eax*4 + 0x4bee4c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebx]
mov al, byte [edx + eax]
mov byte [ecx], al
jmp 0x4bed84
mov eax, dword [ebp - 4]
mov ecx, dword [ebx]
mov ax, word [edx + eax]
mov word [ecx], ax
jmp 0x4bed84
mov eax, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, dword [edx + eax]
mov dword [ecx], eax
jmp 0x4bed84
mov ecx, dword [ebx]
mov eax, dword [ebp - 4]
mov eax, dword [edx + eax]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov eax, dword [edx + eax + 4]
mov dword [ecx + 4], eax
jmp 0x4bed84
mov eax, dword [ebx]
movsd xmm0, qword [edx + ecx]
movsd qword [eax], xmm0
jmp case.default.0x4bed1e
movzx eax, word [esi + 0x600856]
push eax
lea eax, [edx + ecx]
push eax
push dword [ebx]
call fcn.0058bd80
add esp, 0xc
mov ecx, dword [ebp - 4]
inc dword [ebp - 8]
add esi, 0x18
add ebx, 4
cmp esi, 0x1188
jb 0x4becf0
jmp 0x4beda3
mov edi, 0x80030104
push dword [ebp - 0x14]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x4bedb9
call fcn.004b34f0
mov esi, eax
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
test eax, eax
jne 0x4bedd1
test esi, esi
js 0x4bedd1
call fcn.004b34f0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4beddb
push eax
call ebx
mov esi, dword [ebp - 8]
jmp 0x4bec72
test edi, edi
jns 0x4bee41
jmp 0x4bee23
push ecx
mov edi, 0x8007000b
xor esi, esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x4bee02
call fcn.004b34f0
mov esi, eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4bee18
test esi, esi
js 0x4bee18
call fcn.004b34f0
test ebx, ebx
je 0x4bee23
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0
je 0x4bee41
push 0
mov ecx, dword [ebp - 0x10]
call fcn.004bf0d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
call fcn.004bf1a0
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8