Function at 0x4153a5
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490184
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x4aeb00]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf0], ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp - 0xf0]
add ecx, 0x18
call fcn.0040c680
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x415215
jmp 0x4157a6
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x415238
cmp dword [ebp - 0x50], 0
jl 0x41523d
jg 0x415238
cmp dword [ebp - 0x54], 0x100000
jbe 0x41523d
jmp 0x4157a6
mov edx, dword [ebp - 0x54]
push edx
call fcn.0045ed18
add esp, 4
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41525d
jmp 0x4157a6
push 0
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41527e
jmp 0x4157a6
mov edx, dword [ebp - 0xf0]
mov eax, dword [edx + 0x24]
push eax
push str.mid:_s
call fcn.00449ce0
add esp, 8
push 0
mov ecx, dword [ebp - 0xf0]
add ecx, 0x24
call fcn.0040c680
push eax
lea ecx, [ebp - 0xe4]
call fcn.00418fa0
mov dword [ebp - 0xf4], eax
mov ecx, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xf8]
call fcn.00419000
push eax
lea ecx, [ebp - 0x44]
call fcn.00417040
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe4]
call fcn.00418fd0
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00449bd0
add esp, 0x18
test eax, eax
jne 0x415325
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0042e8d0
jmp 0x4157a6
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [eax], 3
jne 0x41533c
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 4], 2
je 0x415350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0042e8d0
jmp 0x4157a6
call fcn.00417080
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x18]
add edx, 0x18
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x20], eax
jae 0x41578f
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
je 0x41578f
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x1b
ja case.0x41539e.12
mov ecx, dword [ebp - 0xfc]
jmp dword [ecx*4 + 0x415810]
push 0xcb0
mov edx, dword [ebp - 0x20]
push edx
push 0xcb0
mov eax, dword [ebp - 0x58]
add eax, 0x5164
push eax
call fcn.004603e3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
add ecx, 0xcb0
mov dword [ebp - 0x20], ecx
jmp 0x41578a
push 0xbe8
mov edx, dword [ebp - 0x20]
push edx
push 0xbe8
mov eax, dword [ebp - 0x58]
add eax, 0x6c5c
push eax
call fcn.004603e3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
add ecx, 0xbe8
mov dword [ebp - 0x20], ecx
jmp 0x41578a
push 0x594
mov edx, dword [ebp - 0x20]
push edx
push 0x594
mov eax, dword [ebp - 0x58]
add eax, 0x66c8
push eax
call fcn.004603e3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
add ecx, 0x594
mov dword [ebp - 0x20], ecx
jmp 0x41578a
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x58]
add ecx, 0x7884
call fcn.004175f0
mov eax, dword [ebp - 0x20]
add eax, 0x7ec
mov dword [ebp - 0x20], eax
jmp 0x41578a
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x78b4
call fcn.00417a10
mov edx, dword [ebp - 0x20]
add edx, 0x8b8
mov dword [ebp - 0x20], edx
jmp 0x41578a
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jne 0x4154a3
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x785c
call fcn.004173e0
mov edx, dword [ebp - 0x20]
add edx, 0x728
mov dword [ebp - 0x20], edx
jmp 0x4154d5
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 1
jne 0x4154d1
push 0x10
mov ecx, dword [ebp - 0x20]
push ecx
push 0x10
mov edx, dword [ebp - 0x58]
add edx, 0x7874
push edx
call fcn.004603e3
add esp, 0x10
mov eax, dword [ebp - 0x20]
add eax, 0x10
mov dword [ebp - 0x20], eax
jmp 0x4154d5
mov byte [ebp - 0x11], 0
jmp 0x41578a
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x7844
call fcn.004171d0
mov edx, dword [ebp - 0x20]
add edx, 0x720
mov dword [ebp - 0x20], edx
jmp 0x41578a
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c04
call fcn.00417c20
mov ecx, dword [ebp - 0x20]
add ecx, 0x264
mov dword [ebp - 0x20], ecx
jmp 0x41578a
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c34
call fcn.00418040
mov eax, dword [ebp - 0x20]
add eax, 0xd0
mov dword [ebp - 0x20], eax
jmp 0x41578a
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c1c
call fcn.00417e30
mov edx, dword [ebp - 0x20]
add edx, 0xd4
mov dword [ebp - 0x20], edx
jmp 0x41578a
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c4c
call fcn.00418250
mov ecx, dword [ebp - 0x20]
add ecx, 0x198
mov dword [ebp - 0x20], ecx
jmp 0x41578a
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c64
call fcn.00418460
mov eax, dword [ebp - 0x20]
add eax, 0xd0
mov dword [ebp - 0x20], eax
jmp 0x41578a
push 0x338
mov ecx, dword [ebp - 0x20]
push ecx
push 0x338
mov edx, dword [ebp - 0x58]
add edx, 0x78cc
push edx
call fcn.004603e3
add esp, 0x10
mov eax, dword [ebp - 0x20]
add eax, 0x338
mov dword [ebp - 0x20], eax
jmp 0x41578a
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x9310
call fcn.00418a90
mov edx, dword [ebp - 0x20]
add edx, 0x58c
mov dword [ebp - 0x20], edx
jmp 0x41578a
push 0x8b4
mov eax, dword [ebp - 0x20]
push eax
push 0x8b4
mov ecx, dword [ebp - 0x58]
add ecx, 0x5e14
push ecx
call fcn.004603e3
add esp, 0x10
mov edx, dword [ebp - 0x20]
add edx, 0x8b4
mov dword [ebp - 0x20], edx
jmp 0x41578a
push 0x424
mov eax, dword [ebp - 0x20]
push eax
push 0x424
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c94
push ecx
call fcn.004603e3
add esp, 0x10
mov edx, dword [ebp - 0x20]
add edx, 0x424
mov dword [ebp - 0x20], edx
jmp 0x41578a
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x9328
call fcn.00418ca0
mov ecx, dword [ebp - 0x20]
add ecx, 0x58c
mov dword [ebp - 0x20], ecx
jmp 0x41578a
push 0x8b4
mov edx, dword [ebp - 0x20]
push edx
push 0x8b4
mov eax, dword [ebp - 0x58]
add eax, 0x5e14
push eax
call fcn.004603e3
add esp, 0x10
mov ecx, dword [ebp - 0x20]
add ecx, 0x8b4
mov dword [ebp - 0x20], ecx
jmp 0x41578a
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x58]
add ecx, 0x7c7c
call fcn.00418670
mov eax, dword [ebp - 0x20]
add eax, 0xd0
mov dword [ebp - 0x20], eax
jmp 0x41578a
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x58]
add ecx, 0x789c
call fcn.00417800
mov edx, dword [ebp - 0x20]
add edx, 0x4b4
mov dword [ebp - 0x20], edx
jmp 0x41578a
push 0x1218
mov eax, dword [ebp - 0x20]
push eax
push 0x1218
mov ecx, dword [ebp - 0x58]
add ecx, 0x80b8
push ecx
call fcn.004603e3
add esp, 0x10
mov edx, dword [ebp - 0x20]
add edx, 0x1218
mov dword [ebp - 0x20], edx
jmp 0x41578a
push 0x28
mov eax, dword [ebp - 0x20]
push eax
push 0x28
mov ecx, dword [ebp - 0x58]
add ecx, 0x92d0
push ecx
call fcn.004603e3
add esp, 0x10
mov edx, dword [ebp - 0x20]
add edx, 0x28
mov dword [ebp - 0x20], edx
jmp 0x41578a
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x92f8
call fcn.00418880
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
mov dword [ebp - 0x20], ecx
jmp 0x41578a
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x58]
add ecx, 0x9340
call fcn.00418eb0
mov eax, dword [ebp - 0x20]
add eax, 0x1560
mov dword [ebp - 0x20], eax
jmp 0x41578a
mov byte [ebp - 0x11], 0
jmp 0x415365
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.0042e8d0
xor ecx, ecx
jne 0x41520a
cmp dword [ebp - 0x10], 0
je 0x4157c4
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0xe8]
push eax
call fcn.004608f4
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x4157e2
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xec]
push edx
call fcn.004608f4
add esp, 4
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4157f2
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0045fcea
mov esp, ebp
pop ebp
ret