Function at 0x10004c32
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
mov dword [ebp - 0x10], 0
jmp 0x10004c62
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, dword [section..data]
cmp eax, 0xbb8
jbe 0x10004c5a
jmp 0x10004c7d
push 1
call dword [sym.imp.kernel32.dll_Sleep]
cmp dword [section..data], 0
je 0x10004c7d
cmp dword [0x1000b014], 0
jne 0x10004c7d
cmp dword [0x1000b030], 0
je 0x10004c45
cmp dword [0x1000b030], 0
jne 0x1000509a
mov dword [0x1000b030], 1
cmp dword [0x1000b014], 0
jne 0x10004eea
push 0x10058818
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.kernel32.dll_lstrcpy]
jmp 0x10004cc1
push 0x10004cb5
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.kernel32.dll_lstrcat]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1000509a
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0
jle 0x10004eb2
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
or eax, eax
je 0x10004edc
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
or eax, eax
je 0x10004ea7
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x18]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
or eax, eax
je 0x10004e9e
mov dword [ebp - 0x1c], eax
push 4
push 0x1000
push 0x1000
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
or eax, eax
je 0x10004e95
mov dword [ebp - 0x20], eax
push 0
push 0
push 0x1004
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0
jle 0x10004e7f
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x10004e11
push dword [ebp - 0x20]
push 0
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call fcn.10004957
push 0
push 0xc7
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
cmp byte [ebp - 0xe8], 0
je 0x10004e10
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xc]
call fcn.10004bd6
cmp eax, 0xffffffff
je 0x10004e10
push eax
push ebx
push 0x100f
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10004db8
xor ebx, ebx
jmp 0x10004e73
push dword [ebp - 0x20]
push 0
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call fcn.10004957
push 0
push 0xc7
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
cmp byte [ebp - 0xe8], 0
je 0x10004e72
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xc]
call fcn.10004bd6
cmp eax, 0xffffffff
je 0x10004e72
push eax
push ebx
push 0x100f
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10004e1a
mov dword [ebp - 0x10], 1
push 0x4000
push 0x1000
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_VirtualFreeEx]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x10004edc
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_GetWindowLongA]
test eax, 0x100
jne 0x10004edc
or eax, 0x100
push eax
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SetWindowLongA]
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1000509a
mov eax, dword [0x1000b014]
mov edx, dword [eax + 4]
or edx, edx
jne 0x10004f00
jmp 0x10004ca1
cmp edx, 0xffffffff
jne 0x10004f0a
jmp 0x1000509a
cmp edx, 0xfffffffe
jne 0x10004f42
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_GetWindowLongA]
test eax, 0x100
jne 0x1000509a
or eax, 0x100
push eax
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SetWindowLongA]
mov dword [ebp - 0x10], 1
jmp 0x1000509a
add eax, 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x18]
push 0
push 0x1f0fff
call dword [sym.imp.kernel32.dll_OpenProcess]
or eax, eax
je 0x1000509a
mov dword [ebp - 0x1c], eax
push 4
push 0x1000
push 0x1000
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
or eax, eax
je 0x10005091
mov dword [ebp - 0x20], eax
push 0
push 0
push 0x1004
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
cmp eax, 0
jle 0x1000507b
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x1000500d
push dword [ebp - 0x20]
push 0
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call fcn.10004957
push 0
push 0xc7
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
cmp byte [ebp - 0xe8], 0
je 0x1000500c
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xc]
call fcn.10004bd6
cmp eax, 0xffffffff
je 0x1000500c
push eax
push ebx
push 0x100f
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10004fb4
xor ebx, ebx
jmp 0x1000506f
push dword [ebp - 0x20]
push 0
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call fcn.10004957
push 0
push 0xc7
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
cmp byte [ebp - 0xe8], 0
je 0x1000506e
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xc]
call fcn.10004bd6
cmp eax, 0xffffffff
je 0x1000506e
push eax
push ebx
push 0x100f
push dword [ebp + 0xc]
call dword [sym.imp.user32.dll_SendMessageA]
inc ebx
cmp ebx, dword [ebp - 0x14]
jb 0x10005016
mov dword [ebp - 0x10], 1
push 0x4000
push 0x1000
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_VirtualFreeEx]
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret 8