Function at 0x1004ff20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102dc125
push eax
mov dword fs:[0], esp
sub esp, 0x810
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1004ff8d
mov ecx, 0x103c1be8
mov dword [ebp - 0x18], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x1004ff7c
push edi
push 0x102fe041
push 0x102fe041
push str.file___NULL
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
cmp dword [edi], 0xffffffff
jne 0x10050042
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov dword [eax], 8
lea eax, [ebp - 0x41c]
push dword [edi + 0x54]
push str.Win32_Execute____s
push eax
call fcn.1005aa70
add esp, 0x14
mov edx, 0x1005b140
mov esi, eax
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
test esi, esi
mov edx, 8
push 1
mov ecx, dword [eax + 8]
mov eax, 0x102fe041
cmovne eax, esi
push eax
call fcn.1004dc60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10050264
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov edi, eax
add esp, 8
mov ecx, dword [edi + 8]
cmp ecx, esi
je 0x1005002c
call fcn.1004dfa0
mov dword [edi + 8], esi
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x10050092
mov ecx, 0x103c1be8
mov dword [ebp - 0x18], 0x103c1be8
call fcn.100536a0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
cmp eax, 1
jne 0x10050081
push esi
push 0x102fe041
push 0x102fe041
push str.amount___NULL
call fcn.1004d850
add esp, 0x10
mov ecx, 0x103c1be8
mov dword [ebp - 4], 0xffffffff
call fcn.100536b0
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10050196
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
mov dword [esi], ecx
test eax, eax
jne 0x10050196
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x26
jne 0x100501a9
lea eax, [ebp - 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100501a9
mov eax, dword [ebx + 0xc]
xor ecx, ecx
or ecx, dword [ebx + 8]
cmp eax, dword [ebp - 0x14]
jg 0x100501a9
jl 0x10050101
cmp ecx, dword [ebp - 0x18]
ja 0x100501a9
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov dword [eax], 7
lea eax, [ebp - 0x41c]
push dword [edi + 0x54]
push str.Win32_Read___End_of_File____s
push eax
call fcn.1005aa70
add esp, 0x14
mov edx, 0x1005b140
mov esi, eax
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
test esi, esi
mov edx, 7
push 1
mov ecx, dword [eax + 8]
mov eax, 0x102fe041
cmovne eax, esi
push eax
call fcn.1004dc60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10050196
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov edi, eax
add esp, 8
mov ecx, dword [edi + 8]
cmp ecx, esi
je 0x10050193
call fcn.1004dfa0
mov dword [edi + 8], esi
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call esi
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
mov esi, eax
call fcn.10056e50
add esp, 8
mov edx, 0x1005b140
mov dword [eax + 4], esi
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
mov dword [eax], 5
lea eax, [ebp - 0x81c]
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [edi + 0x54]
push esi
push str.Win32_Read___d_____s__u__u
push eax
call fcn.1005aa70
add esp, 0x20
mov edx, 0x1005b140
mov esi, eax
push 0x1005b0e0
push ecx
mov ecx, 0x103be954
call fcn.10056e50
test esi, esi
mov edx, 5
push 1
mov ecx, dword [eax + 8]
mov eax, 0x102fe041
cmovne eax, esi
push eax
call fcn.1004dc60
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10050264
push 0x1005b0e0
push ecx
mov edx, 0x1005b140
mov ecx, 0x103be954
call fcn.10056e50
mov esi, eax
add esp, 8
mov ecx, dword [esi + 8]
cmp ecx, edi
je 0x10050261
call fcn.1004dfa0
mov dword [esi + 8], edi
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret