Function at 0x48fb90
Capabilities:
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebx + 0xa0], edi
mov eax, dword [ebx + 8]
cmp eax, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], edi
je 0x48fbcd
call fcn.004904a0
cmp dword [ebp + 0xc], edi
jne 0x48fbd7
mov dword [ebx + 0x20], edi
jmp 0x48fbde
mov dword [ebx + 0x20], 1
lea ecx, [ebx + 0x24]
call fcn.004961a0
push 0x10000
call fcn.0049fa90
add esp, 4
cmp eax, edi
mov dword [ebx + 0x7c], eax
jne 0x48fc0f
push 0x5400b8
push edi
push 0x53
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x10
mov esi, dword [ebp + 8]
push edi
push 0x80
push 3
push edi
push 1
push closesocket
push esi
call dword [0x54299c]
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
jne 0x48fc47
push esi
push str.CreateFile__s__
push edi
push 0x56
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x14
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x48fc6e
push str.GetFileSizeEx__
push edi
push 0x57
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x10
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x9c], edi
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x88], edi
lea esi, [ebx + 0xa4]
mov dword [ebx + 0x8c], edi
lea ecx, [ebp - 0x14]
mov dword [ebx + 0x80], edi
push edi
mov word [esi], di
mov edx, dword [ebx + 8]
push ecx
push 2
push esi
push edx
call dword [0x542984]
cmp eax, edi
jne 0x48fcd0
mov eax, dword [ebp + 8]
push eax
push str.ReadFile__s__
push edi
push 0x63
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x14
cmp word [esi], 0x5a4d
je 0x48fced
push str.DOS
push 1
push 0x64
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f8b0
add esp, 0x10
mov edx, dword [ebx + 0x20]
xor ecx, ecx
push edx
xor eax, eax
push 0x40
push ecx
push eax
push esi
mov ecx, ebx
call fcn.00491d50
cmp eax, edi
jne 0x48fd0a
call fcn.0049fa20
mov eax, dword [ebx + 0xe0]
mov ecx, dword [ebx + 0x14]
add eax, 4
cmp edi, ecx
jl 0x48fd41
jg 0x48fd21
cmp eax, dword [ebx + 0x10]
jbe 0x48fd41
push 0x53ffec
push 1
push 0x6e
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
mov dword [ebx + 0xa0], 2
call fcn.0049f8b0
add esp, 0x10
mov eax, dword [ebx + 0xe0]
lea ecx, [ebp - 0x18]
cdq
mov esi, eax
mov eax, dword [ebx + 0x20]
mov edi, edx
push eax
push 4
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00491d50
test eax, eax
jne 0x48fd68
call fcn.0049fa20
mov ecx, dword [ebp - 0x18]
mov eax, ecx
and eax, 0xffff
sub eax, 0x454c
je 0x48fdc6
sub eax, 2
je 0x48fdb1
sub eax, 2
je 0x48fd9b
push 0x53ffec
push 1
mov dword [ebx + 0xa0], 2
push 0x86
jmp 0x48fdd9
cmp ecx, 0x4550
je 0x48fde6
push 0x53ffe0
push 1
push 0x82
jmp 0x48fdd9
push 0x53ffcc
push 1
mov dword [ebx + 0xa0], 3
push 0x7a
jmp 0x48fdd9
push 0x53ffb8
push 1
mov dword [ebx + 0xa0], 4
push 0x7e
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f8b0
add esp, 0x10
mov dword [ebx + 0xa0], 6
mov edx, dword [ebx + 0x20]
add esi, 4
push edx
adc edi, 0
push 0x14
lea eax, [ebx + 0xe4]
push edi
push esi
push eax
mov ecx, ebx
call fcn.00491d50
test eax, eax
jne 0x48fe15
call fcn.0049fa20
mov ax, word [ebx + 0xe4]
add esi, 0x14
adc edi, 0
cmp ax, 0x14c
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
je 0x48fe5d
cmp ax, 0x200
je 0x48fe5d
cmp ax, 0x8664
je 0x48fe5d
push 0x53ff98
push 1
push 0x94
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
mov dword [ebx + 0xa0], 5
call fcn.0049f8b0
add esp, 0x10
mov ecx, dword [ebx + 0x20]
lea eax, [ebx + 0xf8]
push ecx
push 2
push edi
push esi
push eax
mov ecx, ebx
call fcn.00491d50
test eax, eax
jne 0x48fe7c
call fcn.0049fa20
mov ax, word [ebx + 0xf8]
cmp ax, 0x10b
jne 0x4900e0
xor eax, eax
mov ax, word [ebx + 0xf4]
cmp eax, 0xe0
mov dword [ebp - 0x14], eax
jbe 0x48fea8
mov eax, 0xe0
mov dword [ebp - 0x14], eax
mov edx, dword [ebx + 0x20]
lea ecx, [ebx + 0x2a4]
push edx
push eax
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00491d50
test eax, eax
jne 0x48fec6
call fcn.0049fa20
lea eax, [ebx + 0x2a4]
mov dword [ebx + 0x210], eax
add eax, 0x60
mov dword [ebx + 0x218], eax
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x5c]
mov dword [ebx + 0xfc], ecx
mov edx, dword [ebx + 0x210]
mov eax, dword [edx + 0x10]
mov dword [ebx + 0x100], eax
mov ecx, dword [ebx + 0x210]
mov edx, dword [ecx + 0x20]
mov dword [ebx + 0x104], edx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x10c], ecx
mov edx, dword [ebx + 0x210]
mov eax, dword [edx + 0x24]
mov dword [ebx + 0x108], eax
mov ecx, dword [ebx + 0x210]
mov edx, dword [ecx + 4]
mov dword [ebx + 0x110], edx
mov eax, dword [ebx + 0x210]
xor edx, edx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x118], ecx
mov dword [ebx + 0x11c], edx
mov eax, dword [ebx + 0x210]
mov cx, word [eax]
mov word [ebx + 0x120], cx
mov eax, dword [ebx + 0x210]
mov cl, byte [eax + 2]
mov byte [ebx + 0x122], cl
mov eax, dword [ebx + 0x210]
mov cl, byte [eax + 3]
mov byte [ebx + 0x123], cl
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 4]
mov dword [ebx + 0x124], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 8]
mov dword [ebx + 0x128], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0x12c], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x130], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x134], ecx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x138], ecx
mov dword [ebx + 0x13c], edx
mov eax, dword [ebx + 0x210]
mov ecx, dword [eax + 0x20]
mov dword [ebx + 0x140], ecx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x144], ecx
mov cx, word [eax + 0x28]
mov word [ebx + 0x148], cx
mov cx, word [eax + 0x2a]
mov word [ebx + 0x14a], cx
mov cx, word [eax + 0x2c]
mov word [ebx + 0x14c], cx
mov cx, word [eax + 0x2e]
mov word [ebx + 0x14e], cx
mov cx, word [eax + 0x30]
mov word [ebx + 0x150], cx
mov cx, word [eax + 0x32]
mov word [ebx + 0x152], cx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x154], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x158], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x15c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x160], ecx
mov cx, word [eax + 0x44]
mov word [ebx + 0x164], cx
mov cx, word [eax + 0x46]
mov word [ebx + 0x166], cx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x168], ecx
mov dword [ebx + 0x16c], edx
mov ecx, dword [eax + 0x4c]
lea esi, [eax + 0x60]
mov dword [ebx + 0x170], ecx
mov dword [ebx + 0x174], edx
mov ecx, dword [eax + 0x50]
lea edi, [ebx + 0x190]
mov dword [ebx + 0x178], ecx
mov dword [ebx + 0x17c], edx
mov ecx, dword [eax + 0x54]
mov dword [ebp - 0x24], edx
mov dword [ebx + 0x180], ecx
mov dword [ebx + 0x184], edx
mov ecx, dword [eax + 0x58]
mov dword [ebx + 0x188], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebx + 0x18c], ecx
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x24]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
jmp 0x4901bd
cmp ax, 0x20b
jne 0x4901a4
xor eax, eax
mov ax, word [ebx + 0xf4]
cmp eax, 0xf0
mov dword [ebp - 0x14], eax
jbe 0x490105
mov eax, 0xf0
mov dword [ebp - 0x14], eax
mov edx, dword [ebx + 0x20]
lea ecx, [ebx + 0x2a4]
push edx
push eax
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00491d50
test eax, eax
jne 0x490123
call fcn.0049fa20
lea eax, [ebx + 0x2a4]
lea edi, [ebx + 0x120]
mov dword [ebx + 0x214], eax
mov esi, eax
lea ecx, [eax + 0x70]
mov dword [ebp - 0x24], 0
mov dword [ebx + 0x218], ecx
mov edx, dword [eax + 0x6c]
mov dword [ebx + 0xfc], edx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x100], ecx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x104], edx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x10c], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x108], edx
mov ecx, dword [eax + 4]
mov dword [ebx + 0x110], ecx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x118], edx
mov ecx, dword [eax + 0x1c]
mov dword [ebx + 0x11c], ecx
mov ecx, 0x3c
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 0x24]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
jmp 0x4901bd
push 0x53ff80
push 1
push 0xde
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f8b0
add esp, 0x10
mov ecx, dword [ebx + 0xfc]
mov eax, 0x10
cmp ecx, eax
jbe 0x4901d2
mov dword [ebx + 0xfc], eax
xor eax, eax
mov ecx, ebx
mov ax, word [ebx + 0xf4]
cdq
add esi, eax
adc edi, edx
call fcn.004927c0
test eax, eax
jne 0x4901f0
call fcn.0049fa20
xor eax, eax
mov ax, word [ebx + 0xe6]
mov dword [ebx + 0x394], eax
lea eax, [eax + eax*4]
shl eax, 3
push eax
call fcn.0049fa90
add esp, 4
mov dword [ebx + 0x398], eax
test eax, eax
jne 0x490230
push 0x5400b8
push eax
push 0xe7
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x10
mov eax, dword [ebx + 0x394]
mov ecx, dword [ebx + 0x20]
push ecx
mov ecx, ebx
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x398]
shl edx, 3
push edx
push edi
push esi
push eax
call fcn.00491d50
test eax, eax
jne 0x49025a
call fcn.0049fa20
mov eax, dword [ebx + 0x394]
lea ecx, [eax + eax*4]
shl ecx, 3
add esi, ecx
mov ecx, ebx
adc edi, 0
call fcn.00492430
test eax, eax
jne 0x49027b
call fcn.0049fa20
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov edx, ecx
push eax
add edx, esi
mov esi, eax
adc esi, edi
sub edx, 1
sbb esi, 0
push ecx
push esi
push edx
call sub.ntdll.dll__alldiv
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x28]
push ecx
push edx
push eax
call sub.ntdll.dll__allmul
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
mov edx, dword [ebx + 0x394]
shl edx, 2
push edx
call fcn.0049fa90
add esp, 4
mov dword [ebx + 0x39c], eax
test eax, eax
jne 0x4902e1
push 0x5400b8
push eax
push 0xef
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x10
mov ecx, dword [ebx + 0x394]
mov edi, dword [ebx + 0x39c]
shl ecx, 2
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor esi, esi
rep stosb byte es:[edi], al
mov dword [ebp + 8], esi
cmp esi, dword [ebx + 0x394]
jae 0x4903a8
mov ecx, dword [ebx + 0x398]
lea eax, [esi + esi*4]
push 8
lea edx, [ecx + eax*8]
lea eax, [ebp - 0x3c]
push edx
push eax
call dword [sym.imp.ntdll.dll_strncpy]
lea edi, [ebp - 0x3c]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x34], 0
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0049fa90
mov ecx, dword [ebx + 0x39c]
add esp, 0x10
mov dword [ecx + esi*4], eax
mov edx, dword [ebx + 0x39c]
cmp dword [edx + esi*4], 0
jne 0x490371
push 0x5400b8
push 0
push 0xf9
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x10
lea edi, [ebp - 0x3c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebx + 0x39c]
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 8]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov edi, dword [edi + eax*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov esi, eax
jmp 0x490305
mov eax, dword [ebx + 0x394]
shl eax, 2
push eax
call fcn.0049fa90
xor esi, esi
add esp, 4
cmp eax, esi
mov dword [ebx + 0x3a0], eax
jne 0x4903de
push 0x5400b8
push esi
push 0xff
push str.D:_root.ddev360C360PubSrc360BaseQHPEParser.cpp
call fcn.0049f120
add esp, 0x10
mov ecx, ebx
call fcn.00492320
mov ecx, dword [ebx + 0x394]
mov edx, dword [ebx + 0x3a0]
mov eax, dword [edx + ecx*4 - 4]
mov ecx, dword [ebx + 0x398]
lea eax, [eax + eax*4]
mov edx, dword [ecx + eax*8 + 0x14]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x10]
xor eax, eax
add edx, ecx
mov ecx, dword [ebx + 0x10]
sub ecx, edx
mov edx, dword [ebx + 0x14]
sbb edx, eax
mov dword [ebx + 0x3a8], ecx
mov eax, edx
mov dword [ebx + 0x3ac], edx
cmp eax, esi
jg 0x49043e
jl 0x490432
cmp dword [ebx + 0x3a8], esi
jae 0x49043e
mov dword [ebx + 0x3a8], esi
mov dword [ebx + 0x3ac], esi
mov esi, 1
mov dword [ebx + 0xa0], esi
jmp 0x490465
test esi, esi
mov dword [ebp - 4], 0xffffffff
jne 0x490477
mov ecx, ebx
call fcn.004904a0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8