Function at 0x4bb910
Capabilities:
Get file size
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x862c46
push eax
mov dword fs:[0], esp
sub esp, 0x830
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x850]
xor ebx, ebx
cmp edi, ebx
mov ebp, ecx
je 0x4bc495
cmp word [edi], bx
je 0x4bc495
push 0xffffffffffffffff
lea ecx, [esp + 0x38]
call fcn.00469e90
lea eax, [esp + 0x4c]
mov dword [esp + 0x848], ebx
push eax
push ebx
push ebx
push edi
mov dword [esp + 0x5c], ebx
call fcn.006791b0
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 0x5c], eax
jne 0x4bb981
push 0x597
push 1
jmp 0x4bb9aa
push ebx
push ebx
push 3
push ebx
push 7
push SysReAllocString
push edi
mov dword [esp + 0x48], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x28], esi
jne 0x4bb9cb
push 0x5a8
push 3
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x34]
mov dword [esp + 0x848], 0xffffffff
call fcn.00469ec0
jmp 0x4bc4a4
push edi
lea ecx, [ebp + 0x58]
call fcn.006181a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push ebx
push esi
mov dword [esp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x5c], 4
jne 0x4bbe60
mov dword [esp + 0x2c], 1
lea edx, [esp + 0x84]
push 1
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x88]
push edx
mov dword [esp + 0x88], ebx
push ebx
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x80], eax
cmp eax, ecx
jne 0x4bba4f
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
je 0x4bc13e
mov ecx, 0xdb
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x24c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
stosb byte es:[edi], al
call fcn.00636b60
lea ecx, [esp + 0x10]
mov byte [esp + 0x848], 1
call fcn.00636b60
lea ecx, [esp + 0x18]
push ebx
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x254]
push edx
push eax
push esi
mov byte [esp + 0x85c], 2
call fcn.00679580
add esp, 0x14
test eax, eax
je 0x4bbdff
lea ecx, [esp + 0x10]
call fcn.00637450
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x3c], edi
je 0x4bbad0
mov eax, dword [edi + 0x10]
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp + 0x60], ecx
mov eax, dword [esp + 0x274]
mov edx, dword [esp + 0x278]
lea ecx, [esp + 0x58]
push 1
push ecx
push eax
push esi
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x20], ebx
jne 0x4bbb37
lea edi, [ebp + 0x4c]
mov ecx, edi
call fcn.00637030
push 0xffffffffffffffff
push 0x370
mov ecx, edi
call fcn.00636d40
mov ecx, edi
call fcn.00637450
cmp eax, ebx
je 0x4bbe26
mov ecx, 0xdc
lea esi, [esp + 0x24c]
mov edi, eax
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x9c], ebx
mov edx, dword [edi + 0x40]
push str._OEAX_
lea ecx, [esp + 0x4c]
mov dword [esp + 0xa4], edx
call fcn.00617650
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x27c]
push eax
push ecx
mov byte [esp + 0x850], 3
call fcn.005fc4b7
add esp, 8
cmp eax, ebx
jne 0x4bbc6a
mov edx, dword [esp + 0x850]
push edx
call fcn.00516c30
add esp, 4
lea ecx, [esp + 0x14]
push eax
call fcn.00617650
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x850], 4
call fcn.004ba600
add esp, 8
lea edx, [esp + 0x14]
lea ecx, [esp + 0x1c]
push edx
mov byte [esp + 0x84c], 5
call fcn.00617440
mov eax, dword [esp + 0x24]
mov byte [esp + 0x848], 6
push eax
call fcn.004ba6d0
add esp, 4
test eax, eax
je 0x4bbc20
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, dword [ecx - 8]
mov edi, dword [edx - 8]
sub eax, edi
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0061a690
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x84c], 7
call fcn.00618070
lea ecx, [esp + 0x38]
mov byte [esp + 0x848], 6
call fcn.00617ec0
mov ecx, dword [esp + 0x1c]
push 0x77
lea edx, [esp + 0x280]
push ecx
push edx
call fcn.005fc3ce
add esp, 0xc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x848], 5
call fcn.00617ec0
lea ecx, [esp + 0x24]
mov byte [esp + 0x848], 4
call fcn.00617ec0
lea ecx, [esp + 0x14]
mov byte [esp + 0x848], 3
call fcn.00617ec0
lea ecx, [esp + 0x18]
call fcn.00636d30
test eax, eax
jne 0x4bbd1b
mov ecx, 0x1d
lea edi, [esp + 0x1d5]
mov byte [esp + 0x1d4], al
push 0xffffffffffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x248]
mov ecx, dword [esp + 0x244]
add eax, ecx
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x24c]
lea ecx, [eax + edx*2]
lea edx, [ecx + ecx + 0x7a]
lea ecx, [esp + 0x1c]
push edx
call fcn.00636d40
lea ecx, [esp + 0x18]
call fcn.00636d30
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00637470
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
cmp dword [0x9dce80], ebx
je 0x4bbd4e
lea ecx, [esp + 0x18]
call fcn.00636d30
push eax
lea eax, [esp + 0x280]
push eax
push str.COEAFileMgr::Open_File__s__src_no_SDProp__make_here_size__d_
push str.Outgo
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
cmp dword [0x9dce80], ebx
je 0x4bbd4e
lea ecx, [esp + 0x18]
call fcn.00636d30
lea ecx, [esp + 0x27c]
push eax
push ecx
push str.COEAFileMgr::Open_File__s__arrSDProp.GetSize__d_
push str.Outgo
push 0xffffffffffffffff
push 0x9dc5ec
call fcn.006600d0
add esp, 0x18
mov edi, dword [ebp + 0x20]
lea esi, [ebp + 0x18]
push 0xffffffffffffffff
mov ecx, esi
lea edx, [edi + 1]
push edx
call fcn.004bf370
mov ecx, dword [esi + 4]
lea edi, [edi + edi*8]
shl edi, 5
add edi, ecx
mov ecx, 0x48
lea esi, [esp + 0x24c]
push 0xffffffffffffffff
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
lea edi, [ebp + 4]
mov ecx, edi
lea eax, [esi + 1]
push eax
call fcn.004bf1f0
mov eax, dword [edi + 4]
lea ecx, [esi + esi*2]
lea edx, [esi + ecx*4]
mov ecx, 0xd
lea esi, [esp + 0x80]
lea edi, [eax + edx*4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [ebp + 0x44]
call fcn.006370b0
lea edx, [esp + 0x10]
lea ecx, [ebp + 0x48]
push edx
call fcn.006370b0
lea ecx, [esp + 0x48]
mov byte [esp + 0x848], 2
call fcn.00617ec0
lea ecx, [esp + 0x10]
mov byte [esp + 0x848], 1
call fcn.00636c90
lea ecx, [esp + 0x18]
mov byte [esp + 0x848], 0
call fcn.00636c90
mov esi, dword [esp + 0x28]
xor ebx, ebx
jmp 0x4bba04
lea ecx, [esp + 0x10]
mov byte [esp + 0x848], 1
call fcn.00636c90
lea ecx, [esp + 0x18]
mov byte [esp + 0x848], 0
call fcn.00636c90
jmp 0x4bc13e
push 0x5d9
push 3
call fcn.004b8630
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x848], 1
call fcn.00636c90
lea ecx, [esp + 0x18]
mov byte [esp + 0x848], 0
call fcn.00636c90
jmp 0x4bc15c
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x84]
mov dword [esp + 0x80], ebx
rep stosd dword es:[edi], eax
mov ecx, 0x47
lea edi, [esp + 0xb5]
mov byte [esp + 0xb4], al
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push esi
call fcn.006790d0
add esp, 0x10
test eax, eax
je 0x4bc25b
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4bc25b
push eax
call fcn.008325b4
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4bc245
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x38], 0
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
push eax
push ecx
push ebx
push esi
call fcn.006790d0
add esp, 0x10
test eax, eax
je 0x4bc0ad
lea esi, [ebp + 0x4c]
mov ecx, esi
call fcn.00637030
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
mov ecx, esi
call fcn.00636d40
mov ecx, esi
call fcn.00637450
test eax, eax
je 0x4bc0b4
mov ecx, dword [esp + 0x10]
mov edi, eax
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x58], eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xd0], eax
mov dword [esp + 0xc8], eax
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0xc4], ecx
mov edx, dword [ebx + 0x14]
mov dword [esp + 0xcc], edx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xd8], ecx
mov ecx, dword [esp + 0x44]
mov edx, ebx
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe0], eax
mov eax, dword [edx]
mov dword [esp + 0xb4], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0xb8], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0xbc], eax
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x850]
push edx
mov dword [esp + 0xc4], ecx
call fcn.00516c30
add esp, 4
lea ecx, [esp + 0x14]
push eax
call fcn.00617650
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x850], 8
call fcn.004ba600
add esp, 8
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
push edx
mov byte [esp + 0x84c], 9
call fcn.00617440
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x848], 0xa
push eax
call fcn.004ba6d0
add esp, 4
test eax, eax
je 0x4bc061
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
mov edi, dword [edx - 8]
sub eax, edi
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0061a690
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x84c], 0xb
call fcn.00618070
lea ecx, [esp + 0x3c]
mov byte [esp + 0x848], 0xa
call fcn.00617ec0
mov ecx, dword [esp + 0x24]
push 0x77
lea edx, [esp + 0xe8]
push ecx
push edx
call fcn.005fc3ce
add esp, 0xc
lea ecx, [esp + 0x24]
mov byte [esp + 0x848], 9
call fcn.00617ec0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x848], 8
call fcn.00617ec0
lea ecx, [esp + 0x14]
mov byte [esp + 0x848], 0
call fcn.00617ec0
jmp 0x4bc0c3
push 0x621
jmp 0x4bc0b9
push 0x62a
push 3
call fcn.004b8630
add esp, 8
push ebx
call fcn.008325dd
mov esi, dword [ebp + 0xc]
lea edi, [ebp + 4]
add esp, 4
mov ecx, edi
lea eax, [esi + 1]
mov dword [esp + 0x2c], 1
push 0xffffffffffffffff
push eax
mov dword [esp + 0xa4], 0
call fcn.004bf1f0
mov eax, dword [edi + 4]
lea ecx, [esi + esi*2]
push 0xffffffffffffffff
lea edx, [esi + ecx*4]
mov ecx, 0xd
lea esi, [esp + 0x84]
lea edi, [eax + edx*4]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x20]
lea esi, [ebp + 0x18]
lea ecx, [edi + 1]
push ecx
mov ecx, esi
call fcn.004bf370
mov eax, dword [esi + 4]
lea edi, [edi + edi*8]
shl edi, 5
add edi, eax
mov ecx, 0x48
lea esi, [esp + 0xb4]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x28]
mov ecx, ebp
call fcn.004bc670
test eax, eax
jne 0x4bc15c
push 0x65d
push 3
call fcn.004b8630
add esp, 8
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x5c], method.CCommandLineInfo.virtual_0
mov dword [esp + 0x60], ebx
mov dword [esp + 0x6c], ebx
lea ecx, [esp + 0x70]
mov byte [esp + 0x848], 0xc
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], ebx
call fcn.0061ebd0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x78]
mov byte [esp + 0x850], 0xd
call fcn.0061eca0
mov edx, dword [0x8ab26c]
mov dword [esp + 0x30], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], ebx
lea ebx, [ebp + 0x2c]
xor edi, edi
push 0xffffffffffffffff
push edi
mov ecx, ebx
mov byte [esp + 0x850], 0xe
call fcn.0061eca0
lea ecx, [ebp + 0x3c]
call fcn.00617be0
mov dword [ebp + 0x40], edi
mov dword [ebp + 0x68], edi
mov dword [esp + 0x5bc], edi
xor eax, eax
mov ecx, 0xa0
lea edi, [esp + 0x5c0]
push eax
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
lea ecx, [esp + 0x5c4]
push eax
push 0
lea edx, [esp + 0x50]
push ecx
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x78]
push ecx
push edx
push esi
call fcn.004b72f0
add esp, 0x28
test eax, eax
je 0x4bc26f
lea eax, [esp + 0x70]
mov ecx, ebx
push eax
call fcn.0061eef0
lea ecx, [esp + 0x30]
push ecx
lea ecx, [ebp + 0x3c]
call fcn.00618070
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
mov dword [ebp + 0x40], edx
mov dword [ebp + 0x68], eax
jmp 0x4bc298
push 0x617
push 3
call fcn.004b8630
add esp, 8
xor ebx, ebx
jmp 0x4bc15c
push 0x610
push 3
call fcn.004b8630
add esp, 8
jmp 0x4bc15c
mov ecx, ebp
xor edi, edi
call fcn.004bc670
test eax, eax
jle 0x4bc298
mov eax, dword [ebx + 4]
push 0x9b5220
push eax
mov ecx, ebx
call fcn.0061f240
mov ecx, ebp
inc edi
call fcn.004bc670
cmp edi, eax
jl 0x4bc27c
cmp dword [esp + 0x5bc], 1
jne 0x4bc355
mov ecx, 0xa1
lea esi, [esp + 0x5bc]
mov edi, 0x9bf970
push 0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x2c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xdb
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x24c], 0
rep stosd dword es:[edi], eax
push 0
push 0
stosw word es:[edi], ax
lea ecx, [esp + 0x254]
push 0
push ecx
push esi
stosb byte es:[edi], al
call fcn.00679580
add esp, 0x14
test eax, eax
je 0x4bc351
lea edx, [esp + 0x3f4]
push 0x31
push edx
push 0x9bfc00
call fcn.005fc3ce
mov eax, dword [esp + 0x3f0]
mov ecx, dword [esp + 0x3a8]
mov edx, dword [esp + 0x3ac]
mov dword [0x9bfbf4], eax
lea eax, [esp + 0x450]
push 0x31
push eax
push 0x9bfc64
mov dword [0x9bfbf8], ecx
mov dword [0x9bfbfc], edx
call fcn.005fc3ce
add esp, 0x18
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4bc3c7
mov ecx, ebp
call fcn.004bc4d0
lea ecx, [esp + 0x30]
mov byte [esp + 0x848], 0xd
call fcn.00617ec0
lea ecx, [esp + 0x70]
mov byte [esp + 0x848], 0xc
call fcn.0061ebe0
mov dword [esp + 0x5c], 0x893fcc
mov eax, dword [esp + 0x60]
mov byte [esp + 0x848], 0xf
test eax, eax
je 0x4bc3ae
push eax
call fcn.008325dd
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x848], 0xffffffff
call fcn.00469ec0
jmp 0x4bc4a4
mov eax, dword [ebp + 0x50]
test eax, eax
jne 0x4bc430
lea ecx, [esp + 0x20]
push ecx
call fcn.004b83e0
add esp, 4
push str.OEATemp_
lea ecx, [esp + 0x24]
mov byte [esp + 0x84c], 0x10
call fcn.00618b00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x850]
push eax
push edx
call fcn.00516c30
add esp, 4
lea ecx, [ebp + 0x54]
push eax
mov eax, dword [esp + 0x28]
push eax
push str._s_s_08X_
push ecx
call fcn.0061aed0
add esp, 0x14
lea ecx, [esp + 0x20]
mov byte [esp + 0x848], 0xe
call fcn.00617ec0
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
mov dword [ebp + 0x64], edx
mov byte [esp + 0x848], 0xd
call fcn.00617ec0
lea ecx, [esp + 0x70]
mov byte [esp + 0x848], 0xc
call fcn.0061ebe0
mov dword [esp + 0x5c], 0x893fcc
mov eax, dword [esp + 0x60]
mov byte [esp + 0x848], 0x11
test eax, eax
je 0x4bc47a
push eax
call fcn.008325dd
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x848], 0xffffffff
call fcn.00469ec0
mov eax, 1
jmp 0x4bc4a6
push 0x58c
push 1
call fcn.004b8630
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x840]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x83c
ret 4