Function at 0x41ea30
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 0x20]
push ebx
push esi
push edi
lea ecx, [eax + 0xccc]
mov eax, dword [eax]
push edx
push eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x41ea78
push str.GetFileSizeEx__
push 0x11e
push str.QHImageHlp.c
xor edx, edx
call fcn.00421a10
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 8
xor edi, edi
xor ebx, ebx
cmp eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ecx
jne 0x41ea9b
mov eax, dword [ebp + 0x20]
mov esi, dword [eax]
mov edx, eax
mov eax, dword [edx + 4]
jmp 0x41eaa1
mov esi, dword [ecx - 8]
mov eax, dword [ecx - 4]
sub esi, edi
sbb eax, ebx
mov edx, esi
shrd edx, eax, 0xf
shr eax, 0xf
and esi, 0x7fff
mov dword [ebp - 0xc], edx
jne 0x41eac0
mov esi, 0x8000
jmp 0x41eac4
inc edx
mov dword [ebp - 0xc], edx
test edx, edx
je 0x41eb54
mov eax, dword [ebp - 0x10]
push 0
push 0
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x41ec36
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ec58
cmp esi, dword [ebp - 0x18]
jne 0x41ec7a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41eb24
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
push esi
push ecx
push edx
call eax
test eax, eax
je 0x41ec9f
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x41eb3e
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x1c]
push esi
push ecx
push edx
call eax
test eax, eax
je 0x41ecab
add edi, esi
adc ebx, 0
dec dword [ebp - 0xc]
mov esi, 0x8000
jne 0x41eacc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x41ec17
mov esi, dword [ecx]
test esi, esi
je 0x41ec2a
cmp dword [ecx + 8], 0
jne 0x41ebc3
push 0
push 0
push ebx
push edi
mov edi, dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x41ec36
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, edi
call fcn.0041df70
test eax, eax
je 0x41ecf8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
test eax, eax
je 0x41ebcb
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x1c]
push edx
push ebx
push ecx
call eax
test eax, eax
jne 0x41ebc8
push str._rT
push 0x38b
jmp 0x41ece6
mov ebx, dword [ebp - 8]
jmp 0x41ebcb
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41ec0a
cmp dword [ecx + 4], 0
je 0x41ec0a
mov ecx, dword [ecx]
cmp ecx, 0x8000
ja 0x41ecb7
push ecx
push 0
push ebx
call fcn.00427d80
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
add esp, 0xc
push eax
push ebx
push ecx
call esi
test eax, eax
je 0x41ecdc
mov ecx, dword [ebp - 4]
mov edi, dword [ecx]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
add edi, dword [ecx - 8]
adc ebx, dword [ecx - 4]
inc eax
add ecx, 0x18
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ecx
cmp eax, dword [ebp + 0xc]
jbe 0x41ea8d
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.SetFilePointerEx__
push 0xf9
push str.QHImageHlp.c
xor edx, edx
call fcn.00421a10
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ReadFile__
push 0xfc
push str.QHImageHlp.c
xor edx, edx
call fcn.00421a10
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x440924
push 0xfe
mov edx, 1
push str.QHImageHlp.c
call fcn.00421b40
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._rT
push 0x374
jmp 0x41ece6
push str._rT
push 0x379
jmp 0x41ece6
push 0x4409f4
push 0x392
mov edx, 8
push str.QHImageHlp.c
call fcn.00421b40
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str._rT
push 0x395
mov edx, 0x11
push str.QHImageHlp.c
call fcn.00421b40
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret