Function at 0x41ce41
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x794
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
jne 0x41cad0
mov eax, 0x462
jmp 0x41d36c
cmp dword [ebp + 0x10], 0
jne 0x41cae4
mov eax, 0x463
jmp 0x41d36c
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x15c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x15c], 0xffffffff
jne 0x41cb83
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x788], eax
jmp 0x41cb57
mov eax, 0x468
jmp 0x41d36c
mov eax, 0x464
jmp 0x41d36c
mov eax, 0x462
jmp 0x41d36c
mov eax, 0x46c
jmp 0x41d36c
cmp dword [ebp - 0x788], 2
je 0x41cb34
cmp dword [ebp - 0x788], 3
je 0x41cb3e
cmp dword [ebp - 0x788], 0x20
je 0x41cb2a
jmp 0x41cb48
push 0x9f4
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x41cbc1
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x471
jmp 0x41d36c
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x164]
mov dword [ecx + 0x440], eax
mov eax, dword [ebp - 0x164]
mov byte [eax + 0x42a], 0x11
push 0x4c
mov eax, dword [ebp - 0x164]
push eax
push 0
call fcn.00411280
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41cc89
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
cmp dword [eax + 0x424], 6
jne 0x41cc57
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x467
jmp 0x41d36c
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x46a
jmp 0x41d36c
push 0
push pe_nt_image_headers32
push 1
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x160], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x160], 0xffffffff
jne 0x41d033
cmp dword [ebp - 8], 0xb7
je 0x41ccd8
cmp dword [ebp - 8], 0x50
jne 0x41cfa1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78c], eax
jmp 0x41cdcf
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x466
jmp 0x41d36c
push 0
push 0xe6
lea eax, [ebp - 0x778]
push eax
call sub.F3BIFUTC.dll_Ordinal_6
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x778]
push eax
push 2
push 4
push 0x3f1
push 0
call sub.F3BIFUTC.dll_Ordinal_5_1
add esp, 0x18
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 7
jne 0x41cdca
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x466
jmp 0x41d36c
jmp 0x41cdee
cmp dword [ebp - 0x78c], 0
je 0x41cce6
cmp dword [ebp - 0x78c], 1
je 0x41cdee
jmp 0x41cd37
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push pe_nt_image_headers32
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x160], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x160], 0xffffffff
jne 0x41cf9c
mov eax, dword [ebp - 8]
mov dword [ebp - 0x790], eax
jmp 0x41cea7
jmp 0x41cf9c
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x469
jmp 0x41d36c
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x463
jmp 0x41d36c
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x463
jmp 0x41d36c
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x46d
jmp 0x41d36c
cmp dword [ebp - 0x790], 0xb7
ja case.0x41cec5.5
mov eax, dword [ebp - 0x790]
xor ecx, ecx
mov cl, byte [eax + 0x41cee4]
jmp dword [ecx*4 + 0x41cecc]
jmp 0x41d033
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x794], eax
jmp 0x41d014
mov eax, 0x469
jmp 0x41d36c
mov eax, 0x463
jmp 0x41d36c
mov eax, 0x46d
jmp 0x41d36c
cmp dword [ebp - 0x794], 3
je 0x41cffb
cmp dword [ebp - 0x794], 0x20
je 0x41cff1
jmp 0x41d005
lea eax, [ebp - 0x780]
push eax
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x784], eax
push 0
lea eax, [ebp - 0x780]
push eax
mov eax, dword [ebp - 0x784]
push eax
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x41d0f0
push 0
push 0
push 0
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x470
jmp 0x41d36c
push 0
push 0
push 0
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0x9f4
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jne 0x41d183
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x471
jmp 0x41d36c
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x168]
mov dword [ecx + 0x440], eax
mov eax, dword [ebp - 0x168]
mov byte [eax + 0x42a], 0x11
push 0x4c
mov eax, dword [ebp - 0x168]
push eax
push 0
call fcn.00411280
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41d2bb
push 0x55
mov eax, dword [ebp - 0x164]
push eax
push 0
call fcn.00411280
add esp, 0xc
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x168]
cmp dword [eax + 0x424], 6
jne 0x41d261
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x467
jmp 0x41d36c
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x46b
jmp 0x41d36c
mov eax, dword [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x15c]
push eax
call fcn.0041d371
add esp, 8
mov dword [ebp - 4], eax
push 0x55
mov eax, dword [ebp - 0x164]
push eax
push 0
call fcn.00411280
add esp, 0xc
push 0x55
mov eax, dword [ebp - 0x168]
push eax
push 0
call fcn.00411280
add esp, 0xc
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x41d36c
pop edi
pop esi
pop ebx
leave
ret