Function at 0x5ad970
Capabilities:
Get file size
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x6aab00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0xffffffff
mov ecx, dword [ebx]
cmp eax, 0xc0000001
jg 0x5ad9e7
je 0x5ad9d7
cmp eax, 0x80000000
je 0x5ada13
cmp eax, 0xc0000000
jne 0x5ad9ee
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x44], 2
jmp 0x5ada21
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x44], 1
jmp 0x5ada21
cmp eax, 0xc0000002
je 0x5ada13
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], 0x11
push edi
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.005ad120
push 0x695564
lea edx, [ebp - 0x34]
push edx
call fcn.00551b4a
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x44], 4
cmp dword [ebp + 0x18], edi
jne 0x5ada7f
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5ada4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x4c]
call fcn.005ac1d0
push edi
lea ecx, [ebp - 0x4c]
jmp 0x5ad9fc
cmp dword [ebp - 0x38], edi
ja 0x5ada57
mov eax, dword [ebp - 0x3c]
cmp eax, 0xffffffff
jbe 0x5ada79
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], 0x12
call fcn.005ad120
push 0x695564
lea ecx, [ebp - 0x34]
push ecx
jmp 0x5ada0e
sub eax, dword [ebp + 0x10]
mov dword [ebp + 0x18], eax
mov edx, dword [ebp - 0x40]
mov ebx, dword [ebx]
push edi
push edi
push edi
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x38], eax
cmp eax, edi
jne 0x5adac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x3c]
call fcn.005ac1d0
mov ecx, esi
call fcn.005ac3a0
push edi
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.005ad120
push 0x695564
lea ecx, [ebp - 0x34]
push ecx
jmp 0x5ada0e
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x54]
mov ecx, dword [ebp + 0x10]
xor eax, eax
push eax
mov eax, dword [ebp + 0x14]
push ebx
push eax
push ecx
call fcn.00555290
xor ecx, ecx
push ecx
push ebx
push edx
mov edi, eax
push eax
imul edi, ebx
call fcn.00555250
mov ecx, edx
sar ecx, 0x1f
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
mov ebx, eax
sbb ebx, edx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x18]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], edx
test eax, eax
je 0x5adb28
sub eax, ecx
test edx, edx
je 0x5adb30
add ecx, edx
jmp 0x5adb32
xor ecx, ecx
push eax
mov eax, dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x44]
push edi
mov edi, dword [ebp - 0x38]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], eax
call edi
mov eax, dword [esi]
test eax, eax
jne 0x5adbab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x3c]
call fcn.005ac1d0
mov eax, dword [esi]
test eax, eax
je 0x5adb7d
sub eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi], 0
mov eax, dword [esi + 0x1c]
cmp eax, 0xffffffff
je 0x5adb8f
push eax
call edi
mov dword [esi + 0x1c], 0xffffffff
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x34]
call fcn.005ad120
push 0x695564
lea eax, [ebp - 0x34]
push eax
jmp 0x5ada0e
mov ecx, dword [esi + 0x10]
add ecx, eax
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054cec4
mov esp, ebp
pop ebp
ret 0x18