Function at 0x411e70
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x41e791
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], ecx
xor ecx, ecx
cmp eax, ecx
je 0x411e9b
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x58]
cmp eax, ecx
je 0x411ea8
mov dword [eax], ecx
mov dword [eax + 4], ecx
push ebx
mov ebx, dword [esp + 0x54]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x411eb9
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov eax, dword [esp + 0x64]
cmp eax, ecx
je 0x411ec6
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x70]
cmp eax, ecx
je 0x411ed0
mov dword [eax], ecx
push 0x7d000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [esp + 0x60]
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
push 1
push 0
push 0
push ecx
mov ebp, eax
call fcn.0041ad60
xor ecx, ecx
add eax, ebp
adc edx, ecx
sub eax, 0x914
mov ebp, ecx
sbb edx, ebp
js 0x411f22
jg 0x411f18
cmp eax, ebp
jbe 0x411f22
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
jmp 0x411f2a
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ebp
push edx
push eax
push edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
call fcn.00407150
add esp, 0x10
lea ecx, [esp + 0x10]
push ebp
push ecx
push 0x914
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
jbe 0x412424
lea eax, [ecx - 4]
xor edi, edi
cmp eax, ebp
jle 0x412424
cmp dword [edi + esi], 0xfa010000
je 0x411f89
inc edi
cmp edi, eax
jl 0x411f76
jmp 0x412424
mov dword [esp + 0x28], edi
add edi, 4
cmp edi, eax
mov dword [esp + 0x20], 1
jge 0x412424
cmp dword [edi + esi], 0xff010000
jne 0x411fb5
mov edx, ecx
sub edx, edi
sub edx, 4
cmp edx, 0x10
jae 0x411fbf
inc edi
cmp edi, eax
jl 0x411fa0
jmp 0x412424
xor eax, eax
xor ecx, ecx
mov al, byte [edi + esi + 4]
mov cl, byte [edi + esi + 5]
shl eax, 8
add eax, ecx
xor edx, edx
mov dl, byte [edi + esi + 6]
xor ecx, ecx
mov cl, byte [edi + esi + 7]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x64]
cmp ecx, ebp
mov dword [esp + 0x14], eax
je 0x412040
xor edx, edx
xor ecx, ecx
mov dl, byte [edi + esi + 8]
mov cl, byte [edi + esi + 9]
shl edx, 8
add edx, ecx
xor ecx, ecx
mov cl, byte [edi + esi + 0xa]
push 1
shl edx, 8
add edx, ecx
xor ecx, ecx
mov cl, byte [edi + esi + 0xb]
push ebp
shl edx, 8
add edx, ecx
push ebp
mov ebx, edx
push eax
mov dword [esp + 0x34], ebx
xor ebx, ebx
call fcn.0041ad60
mov ecx, dword [esp + 0x24]
add ecx, eax
mov eax, dword [esp + 0x64]
adc ebx, edx
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov ebx, dword [esp + 0x60]
xor eax, eax
xor edx, edx
mov al, byte [edi + esi + 0xc]
mov dl, byte [edi + esi + 0xd]
shl eax, 8
add eax, edx
xor ecx, ecx
mov cl, byte [edi + esi + 0xe]
xor edx, edx
mov dl, byte [edi + esi + 0xf]
shl eax, 8
add eax, ecx
xor ecx, ecx
shl eax, 8
add eax, edx
xor edx, edx
mov dword [esp + 0x14], eax
mov cl, byte [edi + esi + 0x10]
mov dl, byte [edi + esi + 0x11]
mov ebp, ecx
shl ebp, 8
add ebp, edx
xor ecx, ecx
mov cl, byte [edi + esi + 0x12]
xor edx, edx
mov dl, byte [edi + esi + 0x13]
shl ebp, 8
add ebp, ecx
shl ebp, 8
add ebp, edx
test ebx, ebx
je 0x4120af
push 1
push 0
push 0
push eax
call fcn.0041ad60
xor ecx, ecx
add eax, ebp
adc edx, ecx
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov edx, dword [esp + 0x18]
mov edi, 1
mov dword [esp + 0x24], edi
mov eax, dword [edx + 0x181c]
cmp eax, edi
je 0x4120fb
cmp eax, 3
je 0x4120fb
cmp eax, 2
je 0x4120d9
cmp eax, 4
jne 0x412442
push 0xe270
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x60], eax
test eax, eax
mov dword [esp + 0x54], edi
je 0x412121
mov ecx, eax
call fcn.00404160
jmp 0x412123
push 0xe250
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x60], eax
test eax, eax
mov dword [esp + 0x54], 0
je 0x412121
mov ecx, eax
call fcn.004025b0
jmp 0x412123
xor eax, eax
mov ebx, eax
or edi, 0xffffffff
test ebx, ebx
mov dword [esp + 0x54], edi
je 0x412442
mov eax, dword [esp + 0x64]
push 0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esp + 0x60]
push ecx
push edx
push eax
call fcn.00407150
mov edx, dword [ebx]
add esp, 0x10
mov ecx, ebx
call dword [edx + 4]
push 0x2c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x64], eax
test eax, eax
mov dword [esp + 0x54], 2
je 0x41217c
push 0x34
mov ecx, eax
call fcn.004071a0
mov ebp, eax
jmp 0x41217e
xor ebp, ebp
test ebp, ebp
mov dword [esp + 0x54], edi
je 0x412442
mov dword [esp + 0x64], 0
mov ecx, dword [esp + 0x5c]
lea eax, [esp + 0x10]
push 0
push eax
push 0x914
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4122bb
mov edx, dword [ebx]
push eax
push esi
mov ecx, ebx
call dword [edx + 0xc]
mov eax, dword [ebx]
push esi
push 0
mov ecx, ebx
call dword [eax + 0x18]
mov edi, eax
test edi, edi
je 0x412192
mov ecx, dword [esp + 0x64]
add ecx, edi
test edi, edi
mov dword [esp + 0x64], ecx
jle 0x4121bf
mov ecx, ebp
call fcn.00407370
lea ecx, [eax + edi]
cmp ecx, 0x1a
jge 0x4121f7
push edi
push esi
mov ecx, ebp
call fcn.00407460
jmp 0x4121bf
mov edx, 0x1a
mov ecx, ebp
sub edx, eax
push edx
push esi
call fcn.00407460
mov ecx, ebp
call fcn.00407370
sub eax, 4
mov ecx, ebp
push eax
call fcn.00407360
push eax
call fcn.00402570
add esp, 8
mov ecx, ebp
mov edi, eax
push 8
call fcn.004072d0
cmp al, 1
mov byte [esp + 0x38], al
jle 0x412243
mov eax, dword [esp + 0x70]
test eax, eax
je 0x412243
mov dword [eax], 1
push 8
mov ecx, ebp
call fcn.004072d0
cmp byte [esp + 0x38], 1
jl 0x41225f
cmp al, 1
jl 0x41225f
mov dword [esp + 0x1c], 1
push 0x20
mov ecx, ebp
call fcn.004072d0
push 0x20
mov ecx, ebp
call fcn.004072d0
push 0x20
mov ecx, ebp
call fcn.004072d0
push 0x20
mov ecx, ebp
call fcn.004072d0
push 0x20
mov ecx, ebp
call fcn.004072d0
push 0x20
mov ecx, ebp
call fcn.004072d0
cmp edi, eax
je 0x4122bb
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x1a78]
test ecx, ecx
je 0x4122bb
mov eax, dword [eax + 0x1a7c]
push eax
push 0x423f38
call fcn.0040b080
add esp, 8
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x20]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x412422
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x5c]
cdq
add eax, ebp
push 0
adc edx, ebx
push edx
push eax
push edi
call fcn.00407150
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x914
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
xor edi, edi
lea eax, [ecx - 4]
test eax, eax
jle 0x412422
cmp dword [edi + esi], 0xff010000
jne 0x412332
mov edx, ecx
sub edx, edi
sub edx, 4
cmp edx, 0x20
jae 0x41233c
inc edi
cmp edi, eax
jl 0x41231d
jmp 0x412422
xor ecx, ecx
xor eax, eax
mov cl, byte [edi + esi + 0x14]
mov al, byte [edi + esi + 0x15]
shl ecx, 8
add eax, ecx
xor edx, edx
mov dl, byte [edi + esi + 0x16]
xor ecx, ecx
mov cl, byte [edi + esi + 0x17]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x68]
test ecx, ecx
mov dword [esp + 0x14], eax
je 0x4123b1
xor edx, edx
xor ecx, ecx
mov dl, byte [edi + esi + 0x18]
mov cl, byte [edi + esi + 0x19]
shl edx, 8
add edx, ecx
xor ecx, ecx
mov cl, byte [edi + esi + 0x1a]
xor ebp, ebp
shl edx, 8
add edx, ecx
xor ecx, ecx
mov cl, byte [edi + esi + 0x1b]
push 1
shl edx, 8
push ebp
add edx, ecx
push ebp
push eax
mov ebx, edx
call fcn.0041ad60
add ebx, eax
mov eax, dword [esp + 0x68]
adc ebp, edx
mov dword [eax], ebx
mov dword [eax + 4], ebp
xor eax, eax
xor edx, edx
mov al, byte [edi + esi + 0x1c]
mov dl, byte [edi + esi + 0x1d]
shl eax, 8
mov ebx, dword [esp + 0x6c]
add eax, edx
xor ecx, ecx
xor edx, edx
mov cl, byte [edi + esi + 0x1e]
mov dl, byte [edi + esi + 0x1f]
shl eax, 8
add eax, ecx
shl eax, 8
add eax, edx
test ebx, ebx
mov dword [esp + 0x14], eax
je 0x412422
xor ecx, ecx
xor edx, edx
mov cl, byte [edi + esi + 0x20]
mov dl, byte [edi + esi + 0x21]
shl ecx, 8
add ecx, edx
xor edx, edx
mov dl, byte [edi + esi + 0x22]
xor ebp, ebp
shl ecx, 8
add ecx, edx
xor edx, edx
mov dl, byte [edi + esi + 0x23]
push 1
shl ecx, 8
push ebp
add ecx, edx
push ebp
push eax
mov edi, ecx
call fcn.0041ad60
add edi, eax
adc ebp, edx
mov dword [ebx], edi
mov dword [ebx + 4], ebp
xor ebp, ebp
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x24]
add esp, 4
cmp eax, ebp
je 0x41244b
cmp dword [esp + 0x24], ebp
je 0x41244b
mov eax, 1
jmp 0x41244d
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 0x18