Function at 0x10b179a
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x111027c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x2c], 0
and dword [ebp - 0x3c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], edi
mov eax, dword [0x111024c]
mov esi, 0x111024c
cmp eax, esi
je 0x10b17fd
test byte [eax + 0x1c], 4
je 0x10b17fd
cmp byte [eax + 0x19], 4
jb 0x10b17fd
push 0x100b080
push 0xe5
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov ecx, dword [ebp - 0x40]
and dword [ebp - 0x54], 0
test ecx, ecx
je 0x10b1808
mov byte [ecx], 0
cmp dword [ebp - 0x48], 0
je 0x10b1820
push 0x200
push 0
push dword [ebp - 0x48]
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10b1878
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov ecx, dword [0x111024c]
cmp ecx, esi
je 0x10b186c
test byte [ecx + 0x1c], 4
je 0x10b186c
cmp byte [ecx + 0x19], 2
jb 0x10b186c
push eax
push dword [ebx]
push 0x100b080
push 0xe6
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01083f04
mov ecx, dword [0x111024c]
mov dword [ebp - 0x2c], 8
jmp 0x10b1f01
mov esi, 0x10000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x10b18a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov dword [ebp - 0x2c], 3
jmp 0x10b1ee6
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x10b18c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov dword [ebp - 0x2c], 8
jmp 0x10b1ee6
and dword [ebp - 0x5c], 0
and dword [ebp - 0x58], 0
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b18fe
test byte [eax + 0x1c], 4
je 0x10b18fe
cmp byte [eax + 0x19], 5
jb 0x10b18fe
push 0x100b080
push 0xe7
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x38]
push dword [ebx]
call fcn.010a0190
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10b196d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov ecx, dword [0x111024c]
cmp ecx, 0x111024c
je 0x10b1961
test byte [ecx + 0x1c], 4
je 0x10b1961
cmp byte [ecx + 0x19], 2
jb 0x10b1961
push eax
push 0x100b080
push 0xe8
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01019fa8
mov ecx, dword [0x111024c]
mov dword [ebp - 0x2c], 4
jmp 0x10b1eec
cmp dword [ebp - 0x3c], esi
je 0x10b19b5
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b19a3
test byte [eax + 0x1c], 4
je 0x10b19a3
cmp byte [eax + 0x19], 2
jb 0x10b19a3
push esi
push dword [ebp - 0x3c]
push 0x100b080
push 0xe9
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01083f04
mov dword [edi], 0x45d
mov dword [ebp - 0x2c], 4
jmp 0x10b1ee6
push 0x10
push 0x100ab30
push dword [ebp - 0x38]
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp eax, 0x10
je 0x10b1edc
push 0
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x38]
mov ecx, ebx
call fcn.010b04aa
test al, al
jne 0x10b1a29
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1a17
test byte [eax + 0x1c], 4
je 0x10b1a17
cmp byte [eax + 0x19], 2
jb 0x10b1a17
push 0x100b080
push 0xea
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov dword [edi], 0x570
mov dword [ebp - 0x2c], 9
jmp 0x10b1ee6
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
xor eax, eax
cmp byte [ebp - 0x25], al
sete al
dec eax
and eax, 0xfffffe00
add eax, 0x400
mov dword [ebp - 0x40], eax
xor eax, eax
cmp esi, eax
jl 0x10b1e9c
jg 0x10b1a5a
cmp edi, dword [ebp - 0x40]
jb 0x10b1e9c
push 0
push 0x200
push esi
push edi
call fcn.01103160
or eax, edx
jne 0x10b1e9c
sub edi, dword [ebp - 0x40]
sbb esi, eax
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], esi
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1aaa
test byte [eax + 0x1c], 4
je 0x10b1aaa
cmp byte [eax + 0x19], 5
jb 0x10b1aaa
push edi
push esi
push 0x100b080
push 0xec
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01083f04
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x64]
push eax
push edi
push esi
push dword [ebx]
call fcn.010a0190
push 1
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10b1ae3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
jmp 0x10b19a9
cmp dword [ebp - 0x3c], edi
je 0x10b1b2b
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b1d
test byte [eax + 0x1c], 4
je 0x10b1b1d
cmp byte [eax + 0x19], 2
jb 0x10b1b1d
push 0x400
push dword [ebp - 0x3c]
push 0x100b080
push 0xed
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01083f04
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x45d
jmp 0x10b19a9
push 0
lea eax, [ebp - 0x2d]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
mov ecx, ebx
call fcn.010b04aa
test al, al
jne 0x10b1ba9
cmp byte [ebp - 0x25], al
je 0x10b1b6e
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1b9b
cmp byte [eax + 0x19], 2
jb 0x10b1b9b
push 0x100b080
push 0xee
jmp 0x10b1b90
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1b9b
cmp byte [eax + 0x19], 2
jb 0x10b1b9b
push 0x100b080
push 0xef
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x570
jmp 0x10b1a1d
cmp byte [ebp - 0x25], 0
jne 0x10b1bf3
push 0
lea eax, [ebp - 0x2d]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x44]
push eax
add esi, 0x200
push esi
mov ecx, ebx
call fcn.010b04aa
test al, al
jne 0x10b1bf3
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1b9b
cmp byte [eax + 0x19], 2
jb 0x10b1b9b
push 0x100b080
push 0xf0
jmp 0x10b1b90
push 4
pop ecx
lea edi, [ebp - 0x24]
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x10b1d1a
mov eax, dword [0x111024c]
mov esi, 0x111024c
cmp eax, esi
je 0x10b1c35
test byte [eax + 0x1c], 4
je 0x10b1c35
cmp byte [eax + 0x19], 2
jb 0x10b1c35
push 0x100b080
push 0xf1
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov eax, dword [ebp - 0x34]
mov dword [eax], 0x570
mov dword [ebp - 0x2c], 9
mov ecx, dword [0x111024c]
cmp ecx, esi
je 0x10b1eec
test byte [ecx + 0x1c], 4
je 0x10b1caf
cmp byte [ecx + 0x19], 2
jb 0x10b1caf
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 0x100b080
push 0xf2
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104ba69
mov ecx, dword [0x111024c]
cmp ecx, esi
je 0x10b1eec
test byte [ecx + 0x1c], 4
je 0x10b1eec
cmp byte [ecx + 0x19], 2
jb 0x10b1eec
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, byte [ebp - 0x19]
push eax
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 0x100b080
push 0xf3
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104ba69
jmp 0x10b1ee6
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x40]
cmp dword [ebp - 0x50], edi
jne 0x10b1d2e
cmp dword [ebp - 0x4c], esi
je 0x10b1dd6
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1d67
cmp byte [eax + 0x19], 2
jb 0x10b1d67
mov ebx, 0x100b080
push ebx
push 0xf4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101894a
mov eax, dword [0x111024c]
jmp 0x10b1d6c
mov ebx, 0x100b080
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1d9b
cmp byte [eax + 0x19], 2
jb 0x10b1d9b
push esi
push edi
push ebx
push 0xf5
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010194e4
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1b9b
cmp byte [eax + 0x19], 2
jb 0x10b1b9b
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push ebx
push 0xf6
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010194e4
jmp 0x10b1b9b
mov bl, byte [ebp - 0x2d]
cmp byte [ebp - 0x25], bl
je 0x10b1e89
mov ecx, dword [0x111024c]
mov edi, 0x111024c
cmp ecx, edi
je 0x10b1b9b
test byte [ecx + 0x1c], 4
je 0x10b1e1f
cmp byte [ecx + 0x19], 2
jb 0x10b1e1f
mov esi, 0x100b080
push esi
push 0xf7
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101894a
mov ecx, dword [0x111024c]
jmp 0x10b1e24
mov esi, 0x100b080
cmp ecx, edi
je 0x10b1b9b
test byte [ecx + 0x1c], 4
je 0x10b1e55
cmp byte [ecx + 0x19], 2
jb 0x10b1e55
movzx eax, bl
cdq
push edx
push eax
push esi
push 0xf8
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010194e4
mov ecx, dword [0x111024c]
cmp ecx, edi
je 0x10b1b9b
test byte [ecx + 0x1c], 4
je 0x10b1b9b
cmp byte [ecx + 0x19], 2
jb 0x10b1b9b
movzx eax, byte [ebp - 0x25]
cdq
push edx
push eax
push esi
push 0xf9
push dword [ecx + 0x14]
push dword [ecx + 0x10]
jmp 0x10b1dcc
mov edi, dword [ebp - 0x48]
test edi, edi
je 0x10b1ee6
mov esi, dword [ebp - 0x38]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
jmp 0x10b1ee6
mov eax, dword [0x111024c]
cmp eax, 0x111024c
je 0x10b1b9b
test byte [eax + 0x1c], 4
je 0x10b1b9b
cmp byte [eax + 0x19], 2
jb 0x10b1b9b
push edi
push esi
push 0x100b080
push 0xeb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01083f04
jmp 0x10b1b9b
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x10b1ee6
mov byte [eax], 1
mov ecx, dword [0x111024c]
cmp dword [ebp - 0x38], 0
je 0x10b1f01
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [0x111024c]
cmp dword [ebp - 0x54], 0
pop edi
pop esi
pop ebx
je 0x10b1f19
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x111024c]
cmp ecx, 0x111024c
je 0x10b1f42
test byte [ecx + 0x1c], 4
je 0x10b1f42
cmp byte [ecx + 0x19], 4
jb 0x10b1f42
push 0x100b080
push 0xfa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101894a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0106f798
leave
ret 0xc