Function at 0x4de970
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1d8
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x78], r8
mov byte [rbp + 0x57], r9b
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x208], rdx
mov rcx, qword [rbp + 0x208]
call fcn.00410210
nop
xor rax, rax
mov byte [rbp + 0x77], al
cmp qword [rbp + 0x208], 0
je 0x4df7c0
mov rax, qword [rbp + 0x48]
test rax, rax
jne 0x4dedaf
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x120]
mov rax, qword [rbp + 0x220]
mov rbx, qword [rax]
call qword [rbx + 0x3f0]
movzx rax, byte [rbp + 0x57]
test al, al
jne 0x4ded87
mov ecx, 0xfa
call fcn.004ac300
test al, al
je 0x4deaf8
xor rcx, rcx
call sub.user32.dll_MessageBeep
jmp 0x4df7c0
lea rcx, [0x004df9f8]
mov rdx, qword [rbp + 0x120]
mov r8d, 1
mov r9d, 0x7fffffff
mov rax, qword [0x00bb7940]
call qword [rax]
test eax, eax
jle 0x4deb5c
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0x120]
call fcn.004a99d0
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0xf8]
call fcn.00410750
lea rcx, [rbp + 0x118]
mov rdx, qword [rbp + 0x120]
call fcn.004282b0
jmp 0x4deb71
lea rcx, [rbp + 0x118]
mov edx, 0x10
mov r8b, 1
call fcn.004acd90
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0x120]
call fcn.00428260
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0xf0]
call fcn.00410750
lea rcx, [rbp + 0x120]
lea rdx, [0x004dfa08]
call fcn.00412180
lea rcx, [rbp + 0x120]
mov edx, 0x105
call fcn.004120a0
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0x110]
mov rax, qword [rbp + 0x220]
mov rbx, qword [rax]
call qword [rbx + 0x558]
lea rcx, [rbp + 0x144]
mov edx, 0x88
call fcn.00421ad0
mov dword [rbp + 0x144], 0x88
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x14c], rax
mov dword [rbp + 0x170], 1
mov dword [rbp + 0x17c], 0x104
mov dword [rbp + 0x1a4], 0x8004
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4decb1
mov rcx, qword [rbp + 0x120]
call fcn.00411e10
mov qword [rbp + 0x174], rax
mov rcx, qword [rbp + 0x118]
call fcn.00411e10
mov qword [rbp + 0x194], rax
mov rcx, qword [rbp + 0x110]
call fcn.00411e10
mov qword [rbp + 0x19c], rax
lea rax, [0x004dfa0c]
mov qword [rbp + 0x15c], rax
lea rax, [0x004dfa26]
mov qword [rbp + 0x1ac], rax
lea rcx, [rbp + 0x144]
call sub.comdlg32.dll_GetSaveFileNameW
test eax, eax
je 0x4df7c0
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x174]
call fcn.00411eb0
jmp 0x4dedbf
lea rcx, [rbp + 0x138]
mov rdx, qword [rbp + 0x120]
xor r8, r8
call fcn.00411660
lea rcx, [rbp + 0x130]
mov rdx, qword [rbp + 0x118]
xor r8, r8
call fcn.00411660
lea rcx, [rbp + 0x128]
mov rdx, qword [rbp + 0x110]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x138]
call fcn.00411320
mov qword [rbp + 0x174], rax
mov rcx, qword [rbp + 0x130]
call fcn.00411320
mov qword [rbp + 0x194], rax
mov rcx, qword [rbp + 0x128]
call fcn.00411320
mov qword [rbp + 0x19c], rax
lea rax, [0x004dfa30]
mov qword [rbp + 0x15c], rax
lea rax, [0x004dfa3d]
mov qword [rbp + 0x1ac], rax
lea rcx, [rbp + 0x144]
call sub.comdlg32.dll_GetSaveFileNameA
test eax, eax
je 0x4df7c0
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x174]
xor r8, r8
call fcn.00410cf0
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0xe8]
call fcn.00411f60
jmp 0x4dedbf
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x120]
call fcn.004a99d0
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0xe0]
call fcn.00410750
jmp 0x4dedbf
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x48]
call fcn.00410750
mov rcx, rbp
mov rdx, qword [rbp + 0x120]
call fcn.004de520
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4dee1a
mov rcx, qword [rbp + 0x120]
call fcn.00411e10
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x58], rax
jmp 0x4dee6d
lea rcx, [rbp + 0xd8]
mov rdx, qword [rbp + 0x120]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xd8]
call fcn.00411320
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
cmp rax, 0xffffffffffffffff
jne 0x4df034
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0xd0]
mov rax, qword [rbp + 0x220]
mov rbx, qword [rax]
call qword [rbx + 0x3f0]
lea rcx, [0x004df9f8]
mov rdx, qword [rbp + 0xd0]
mov r8d, 1
mov r9d, 0x7fffffff
mov rax, qword [0x00bb7940]
call qword [rax]
test eax, eax
jne 0x4df034
lea rcx, [rbp + 0xb8]
xor rdx, rdx
call fcn.004a98b0
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0xb8]
call fcn.00428260
lea rcx, [rbp + 0xc8]
mov rdx, qword [rbp + 0xc0]
call fcn.004a9980
mov rcx, qword [rbp + 0x220]
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0x220]
mov rbx, qword [rax]
call qword [rbx + 0x3f0]
lea rcx, [rbp + 0x120]
mov edx, 4
lea r8, [0x004dfa50]
mov r9, qword [rbp + 0xc8]
lea rax, [0x004df9f8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x28], rax
call fcn.00412390
xor rcx, rcx
lea rdx, [rbp + 0x120]
lea r8, [0x004dfa7c]
lea r9, [0x004dfaa4]
lea rax, [0x004dfac8]
mov qword [rsp + 0x20], rax
lea rax, [0x004dfaec]
mov qword [rsp + 0x28], rax
call fcn.004ad250
mov rcx, rbp
mov rdx, qword [rbp + 0x120]
call fcn.004de520
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4defe1
mov rcx, qword [rbp + 0x120]
call fcn.00411e10
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov qword [rbp + 0x58], rax
jmp 0x4df034
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x120]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xa8]
call fcn.00411320
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileA
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
cmp rax, 0xffffffffffffffff
je 0x4df7bf
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x400]
test al, al
je 0x4df6e2
mov rcx, qword [rbp + 0x58]
xor rdx, rdx
call sub.kernel32.dll_GetFileSize
mov dword [rbp + 0x1cc], eax
lea rcx, [rbp + 0x120]
call fcn.00410080
cmp dword [rbp + 0x1cc], 0
jbe 0x4df1a5
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x208]
lea r8, [0x004dfb18]
call fcn.004de240
mov rcx, qword [rbp + 0x120]
call fcn.004108a0
cmp eax, 0x1f
jne 0x4df199
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x208]
lea r8, [0x004dfb40]
call fcn.004de240
cmp qword [rbp + 0xa0], 0
je 0x4df115
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x420]
mov byte [rbp + 0x87], al
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x440]
jmp 0x4df149
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x430]
mov byte [rbp + 0x87], al
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x450]
movzx rcx, byte [rbp + 0x87]
test cl, cl
jne 0x4df163
lea rcx, [rbp + 0x120]
call fcn.00410080
jmp 0x4df1a5
sub al, 1
cmp al, 0xff
je 0x4df171
test al, al
jne 0x4df1a5
jmp 0x4df185
lea rcx, [rbp + 0x120]
mov edx, 9
call fcn.004120a0
jmp 0x4df1a5
lea rcx, [rbp + 0x120]
mov edx, 0x14
call fcn.004120a0
jmp 0x4df1a5
lea rcx, [rbp + 0x120]
call fcn.00410080
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x410]
test eax, eax
jbe 0x4df1df
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x410]
cmp dword [rbp + 0x1cc], eax
ja 0x4df1e4
xor rax, rax
jmp 0x4df1e6
mov al, 1
mov byte [rbp + 0x87], al
movzx rax, byte [rbp + 0x87]
test al, al
jne 0x4df206
cmp qword [rbp + 0x120], 0
je 0x4df6cd
mov rcx, qword [rbp + 0x58]
xor rdx, rdx
mov r8d, 4
xor r9, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_CreateFileMappingW
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x4df6cd
mov rcx, qword [rbp + 0x60]
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
test rax, rax
je 0x4df6c4
cmp qword [rbp + 0x120], 0
je 0x4df5e2
lea rcx, [rbp + 0x138]
mov rdx, qword [rbp + 0x120]
call fcn.00427ef0
mov ebx, dword [rbp + 0x1cc]
lea rcx, [rbp + 0x98]
lea rdx, [0x004dfb6c]
mov r8, qword [rbp + 0x138]
call fcn.00410f60
mov rcx, qword [rbp + 0x98]
call fcn.00411320
mov rsi, rax
mov rcx, qword [rbp + 0x138]
call fcn.004108b0
mov rcx, rsi
mov rdx, qword [rbp + 0x68]
mov r8d, eax
add r8d, 2
mov r9d, dword [rbp + 0x1cc]
mov byte [rsp + 0x20], 0
sub ebx, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x30], 0
mov rax, qword [0x00bb7120]
call qword [rax]
mov ebx, eax
test ebx, ebx
jl 0x4df5d8
lea rcx, [0x004dfb6f]
mov rdx, qword [rbp + 0x68]
mov r8d, 0xb
mov r9d, dword [rbp + 0x1cc]
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x30], 0
mov rax, qword [0x00bb7120]
call qword [rax]
mov esi, eax
test esi, esi
jge 0x4df379
lea rcx, [0x004dfb7b]
mov rdx, qword [rbp + 0x68]
mov r8d, 9
mov r9d, dword [rbp + 0x1cc]
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov rax, qword [0x00bb7120]
call qword [rax]
mov esi, eax
jmp 0x4df37c
add esi, 2
test esi, esi
jl 0x4df5d8
lea rcx, [0x004dfb6f]
mov rdx, qword [rbp + 0x68]
mov r8d, 0xb
mov r9d, dword [rbp + 0x1cc]
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x30], 0x7fffffff
mov rax, qword [0x00bb7120]
call qword [rax]
mov edi, eax
test edi, edi
jge 0x4df3c5
mov edi, dword [rbp + 0x1cc]
jmp 0x4df3c8
add edi, 2
lea rcx, [rbp + 0x130]
movsxd rax, esi
mov rdx, qword [rbp + 0x68]
lea rdx, [rdx + rax]
mov r8d, edi
sub r8d, esi
xor r9, r9
call fcn.004103f0
lea rcx, [rbp + 0x118]
mov rdx, qword [rbp + 0x130]
call fcn.00427bf0
mov rcx, rbp
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfb94]
call fcn.004de8c0
test al, al
je 0x4df5d8
mov rcx, rbp
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfbb8]
call fcn.004de8c0
test al, al
je 0x4df5d8
mov rcx, rbp
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfb40]
call fcn.004de8c0
test al, al
je 0x4df5d8
mov rcx, rbp
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfbe4]
call fcn.004de8c0
test al, al
je 0x4df5d8
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0x118]
lea r8, [0x004dfbe4]
call fcn.004de240
cmp qword [rbp + 0x90], 0
jne 0x4df4fd
mov rcx, rbp
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfc00]
call fcn.004de8c0
test al, al
je 0x4df5d8
mov rcx, rbp
mov rdx, qword [rbp + 0x118]
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfc2c]
call fcn.004de8c0
test al, al
je 0x4df5d8
lea rcx, [rbp + 0x120]
mov rdx, qword [rbp + 0x118]
lea r8, [0x004dfc5c]
call fcn.004de240
cmp qword [rbp + 0x120], 0
je 0x4df552
mov rcx, qword [rbp + 0x120]
call fcn.00411e10
mov rbx, rax
mov rcx, qword [rbp + 0x120]
call fcn.004108a0
xor rcx, rcx
mov rdx, rbx
mov r8d, eax
mov rax, qword [0x00bb8280]
call qword [rax]
mov ebx, eax
jmp 0x4df558
mov ebx, 1
lea rcx, [rbp + 0x88]
mov edx, ebx
add edx, 1
mov r8d, 1
mov r9w, 0x30
call fcn.00425b10
mov rcx, rbp
lea rdx, [rbp + 0x208]
lea r8, [0x004dfc5c]
lea r9, [0x004dfb18]
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x20], rax
call fcn.004de700
cmp edi, dword [rbp + 0x1cc]
jae 0x4df5ce
movsxd rax, edi
mov rcx, qword [rbp + 0x68]
lea rcx, [rcx + rax]
movsxd rax, esi
mov rdx, qword [rbp + 0x68]
lea rdx, [rdx + rax]
mov r8d, dword [rbp + 0x1cc]
sub r8d, edi
mov r8d, r8d
call fcn.00408cc0
sub edi, esi
sub dword [rbp + 0x1cc], edi
jmp 0x4df5e1
cmp ebx, 0xffffffff
jne 0x4df294
nop
movzx rax, byte [rbp + 0x87]
test al, al
je 0x4df6bb
mov rcx, qword [rbp + 0x58]
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
xor rbx, rbx
lea rcx, [0x004dfb6f]
mov rdx, qword [rbp + 0x68]
mov r8d, 0xb
mov r9d, dword [rbp + 0x1cc]
mov byte [rsp + 0x20], 0
add ebx, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x30], 0x7fffffff
mov rax, qword [0x00bb7120]
call qword [rax]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4df692
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x410]
mov esi, eax
mov rcx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax + 0x410]
mov ecx, dword [rbp + 0x1cc]
sub ecx, ebx
mov r8d, 4
xor edx, edx
div r8d
sub esi, eax
cmp ecx, esi
jae 0x4df607
cmp ebx, 0xffffffff
je 0x4df6bb
add ebx, 2
sub dword [rbp + 0x1cc], ebx
movsxd rbx, ebx
mov rax, qword [rbp + 0x68]
lea rcx, [rax + rbx]
mov rdx, qword [rbp + 0x68]
mov r8d, dword [rbp + 0x1cc]
call fcn.00408cc0
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_UnmapViewOfFile
mov rcx, qword [rbp + 0x60]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x1cc]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
lea rcx, [rbp + 0x208]
mov edx, 3
mov r8, qword [rbp + 0x208]
lea r9, [0x004dfc74]
lea rax, [0x004dfc74]
mov qword [rsp + 0x20], rax
call fcn.00412390
lea rcx, [rbp + 0x138]
mov rdx, qword [rbp + 0x208]
call fcn.00427ef0
mov rcx, qword [rbp + 0x138]
call fcn.004108b0
mov rcx, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x138]
mov r8d, eax
lea r9, [rbp + 0x1cc]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
mov byte [rbp + 0x77], al
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_SetEndOfFile
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp + 0x48]
test rax, rax
jne 0x4df7bf
movzx rax, byte [rbp + 0x57]
test al, al
je 0x4df7bf
lea rcx, [rbp + 0x108]
call fcn.00415f60
mov rcx, qword [rbp + 0x220]
lea rdx, [0x004dfc7a]
mov r8, rax
mov rax, qword [rbp + 0x220]
mov rax, qword [rax]
call qword [rax]
test eax, eax
jne 0x4df7bf
mov rcx, qword [rbp + 0x108]
mov dl, 1
mov rax, qword [rbp + 0x108]
mov rbx, qword [rax]
call qword [rbx + 0x48]
nop
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x98]
call fcn.004100d0
lea rcx, [rbp + 0xa0]
call fcn.00410080
lea rcx, [rbp + 0xa8]
call fcn.004100d0
lea rcx, [rbp + 0xb0]
mov edx, 5
call fcn.00410160
lea rcx, [rbp + 0xd8]
call fcn.004100d0
lea rcx, [rbp + 0xe0]
call fcn.00410080
lea rcx, [rbp + 0xe8]
call fcn.004100d0
lea rcx, [rbp + 0xf0]
mov edx, 2
call fcn.00410160
lea rcx, [rbp + 0x108]
call fcn.00415f60
lea rcx, [rbp + 0x110]
mov edx, 3
call fcn.00410160
lea rcx, [rbp + 0x128]
mov edx, 3
call fcn.00410190
lea rcx, [rbp + 0x208]
call fcn.00410080
movzx rax, byte [rbp + 0x77]
lea rsp, [rbp + 0x1d8]
pop rbx
pop rsi
pop rdi
pop rbp
ret