Function at 0x40b82c
Capabilities:
Get file size
Get file version info
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a472
mov eax, dword fs:[0]
push eax
mov eax, 0x8025c
call fcn.00411ac0
mov eax, dword [0x43d06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x80260], edi
mov dword [ebp - 0x80248], edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x80248], edi
mov dword [ebp - 0x80244], eax
mov dword [ebp - 0x80240], eax
mov dword [ebp - 4], eax
call fcn.0040a6c1
push eax
lea ecx, [ebp - 0x8023c]
call fcn.0040a4ec
mov byte [ebp - 4], 1
call fcn.0040a6c1
push eax
lea ecx, [ebp - 0x80254]
call fcn.0040a4ec
push esi
lea eax, [ebp - 0x8023c]
mov byte [ebp - 4], 2
push 0x4371f0
push eax
call fcn.00409da4
xor eax, eax
add esp, 0xc
cmp dword [ebx + 4], eax
je 0x40b965
push eax
push esi
mov dword [ebp - 0x80258], eax
mov dword [ebp - 0x80248], 0x34
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x40b95f
push edi
call fcn.00410960
pop ecx
push eax
push edi
push 0
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x40b958
lea eax, [ebp - 0x80248]
push eax
lea eax, [ebp - 0x80258]
push eax
push 0x436a34
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x40b958
mov ecx, dword [ebp - 0x80258]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x80254]
push 0x437204
push eax
call fcn.00409da4
add esp, 0x18
push edi
call fcn.0041095b
pop ecx
mov edi, dword [ebp - 0x80260]
sub esp, 0xc
push 3
push ecx
push 0x80000000
push esi
lea ecx, [ebp - 0x80244]
call fcn.0040a7aa
cmp eax, 1
jne 0x40b9be
mov esi, 0x43722c
mov ecx, esi
call fcn.00409ee5
push eax
push esi
lea ecx, [ebp - 0x8023c]
call fcn.0040d73b
push 0
push 0x64
push 0x500
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, dword [ebp - 0x8023c]
lea ecx, [esi - 0x10]
call fcn.0040a285
jmp 0x40bdcf
lea eax, [ebp - 0x80248]
push eax
push dword [ebp - 0x80244]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x8024c], esi
cmp esi, 0xffffffff
jne 0x40b9f1
call fcn.0040da10
test eax, eax
js 0x40bb2d
mov esi, dword [ebp - 0x8024c]
mov eax, dword [ebp - 0x80248]
push eax
push esi
mov dword [ebp - 0x80248], eax
lea eax, [ebp - 0x8023c]
push 0x437240
push eax
call fcn.0040c8f0
xor edi, edi
add esp, 0x10
cmp dword [ebx + 4], edi
je 0x40ba2f
mov eax, dword [ebp - 0x80254]
lea ecx, [ebp - 0x8023c]
push dword [eax - 0xc]
push eax
call fcn.0040d73b
cmp dword [ebx + 8], edi
je 0x40baaf
lea eax, [ebp - 0x80268]
push eax
push edi
push edi
push dword [ebp - 0x80244]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x40baaf
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x8025c]
push eax
lea eax, [ebp - 0x80268]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x8025c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x22]
push eax
movzx eax, word [ebp - 0x24]
push eax
lea eax, [ebp - 0x8023c]
push 0x437260
push eax
call fcn.0040c8f0
add esp, 0x20
xor edi, edi
xorps xmm0, xmm0
mov dword [ebp - 0x80258], edi
lea ecx, [ebp - 0x80238]
movlpd qword [ebp - 0x1c], xmm0
call fcn.00401269
cmp dword [ebx + 0x10], edi
je 0x40bad8
lea ecx, [ebp - 0x801cc]
call fcn.00407d19
push 0x80000
lea eax, [ebp - 0x80050]
push edi
push eax
call fcn.00412480
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x80264], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x80250], edi
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0x80250]
push eax
push 0x80000
lea eax, [ebp - 0x80050]
push eax
push dword [ebp - 0x80244]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40bb3e
call fcn.0040da10
jmp 0x40bb40
mov eax, dword [ebp - 0x80240]
mov esi, dword [ebp - 0x80244]
jmp 0x40b9f7
mov eax, edi
test eax, eax
jne 0x40bc16
mov edi, dword [ebp - 0x80250]
test edi, edi
je 0x40bc14
cmp dword [ebx + 0xc], eax
je 0x40bb74
push edi
lea eax, [ebp - 0x80050]
push eax
lea ecx, [ebp - 0x80238]
call fcn.00401290
mov edi, dword [ebp - 0x80250]
cmp dword [ebx + 0x10], 0
je 0x40bb93
push edi
lea edx, [ebp - 0x80050]
lea ecx, [ebp - 0x801cc]
call fcn.004085de
mov edi, dword [ebp - 0x80250]
pop ecx
cmp dword [ebx + 0x14], 0
je 0x40bbb2
mov ecx, dword [ebp - 0x80258]
lea edx, [ebp - 0x80050]
push edi
call fcn.00407bc9
pop ecx
mov dword [ebp - 0x80258], eax
push 0x80000
lea eax, [ebp - 0x80050]
push 0
push eax
call fcn.00412480
add esp, 0xc
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x80264]
adc edi, 0
mov eax, edi
mov dword [ebp - 0x80264], edi
push 0x64
pop edi
push dword [ebp - 0x80248]
mul edi
push esi
mov ecx, eax
mov eax, dword [ebp - 0x18]
mul edi
add ecx, edx
push ecx
push eax
call fcn.00411450
inc eax
cmp eax, edi
cmovg eax, edi
xor edi, edi
push edi
push eax
push 0x500
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40bb02
xor edi, edi
cmp dword [ebx + 0xc], edi
je 0x40bcc0
lea eax, [ebp - 0x80068]
push eax
lea ecx, [ebp - 0x80238]
call fcn.00401b0b
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 0x10
jb 0x40bc3d
mov eax, dword [eax]
lea ecx, [ebp - 0x80168]
push 3
mov dword [ebp - 0x8016c], ecx
lea ecx, [ebp - 0x8016c]
push eax
call fcn.00407726
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
push dword [ebp - 0x8016c]
call fcn.0040d911
lea eax, [ebp - 0x80168]
cmp dword [ebp - 0x8016c], eax
je 0x40bc83
push dword [ebp - 0x8016c]
call fcn.00415fcb
pop ecx
lea ecx, [ebp - 0x80068]
mov byte [ebp - 4], 7
call fcn.004021d7
lea ecx, [ebp - 0x18]
call fcn.0040c69c
push dword [ebp - 0x18]
lea eax, [ebp - 0x8023c]
push str.MD5
push eax
call fcn.0040c8f0
mov byte [ebp - 4], 2
add esp, 0xc
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.0040a792
cmp dword [ebx + 0x10], edi
je 0x40bd83
lea edx, [ebp - 0x80064]
lea ecx, [ebp - 0x801cc]
call fcn.004086ec
mov esi, str.0123456789ABCDEF
lea edi, [ebp - 0x24]
push 0x29
lea eax, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
xor edi, edi
push esi
push eax
call fcn.00412480
add esp, 0xc
cmp esi, 0x29
jae 0x40bd28
movzx ecx, byte [ebp + edi - 0x80064]
mov eax, ecx
and ecx, 0xf
shr eax, 4
inc edi
mov al, byte [ebp + eax - 0x24]
mov byte [ebp + esi - 0x50], al
mov al, byte [ebp + ecx - 0x24]
mov byte [ebp + esi - 0x4f], al
add esi, 2
cmp edi, 0x14
jb 0x40bcfa
lea eax, [ebp - 0x80168]
mov dword [ebp - 0x8016c], eax
lea ecx, [ebp - 0x8016c]
push 3
lea eax, [ebp - 0x50]
push eax
call fcn.00407726
mov byte [ebp - 4], 8
lea eax, [ebp - 0x8023c]
push dword [ebp - 0x8016c]
push 0x4372c8
push eax
call fcn.0040c8f0
lea eax, [ebp - 0x80168]
mov byte [ebp - 4], 2
add esp, 0xc
cmp dword [ebp - 0x8016c], eax
je 0x40bd81
push dword [ebp - 0x8016c]
call fcn.00415fcb
pop ecx
xor edi, edi
cmp dword [ebx + 0x14], edi
je 0x40bda2
push dword [ebp - 0x80258]
lea eax, [ebp - 0x8023c]
push 0x4372e4
push eax
call fcn.0040c8f0
add esp, 0xc
mov esi, 0x437300
mov ecx, esi
call fcn.00409ee5
push eax
push esi
lea ecx, [ebp - 0x8023c]
call fcn.0040d73b
mov esi, dword [ebp - 0x8023c]
lea ecx, [esi - 0x10]
call fcn.0040a285
mov edi, dword [ebp - 0x80260]
mov ecx, dword [ebp - 0x80254]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.0040a792
lea ecx, [esi - 0x10]
call fcn.0040a792
cmp dword [ebp - 0x80244], 0
je 0x40bdff
push dword [ebp - 0x80244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004108e9
leave
ret