Function at 0x4220e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e933
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x4b9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push ecx
push 4
call fcn.0044b710
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, 0x422920
mov dword [esi + 0x30], eax
mov ecx, esi
call fcn.00427ac0
xor ebx, ebx
mov dword [esi + 0x34], eax
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x422151
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x42279c
push 0x4a2b80
call fcn.0044c510
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.0041ae10
push str.AuxiliaryService.dat
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0041ae10
add esp, 8
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 3
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4221a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
mov byte [ebp - 4], 2
push 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.0041bd80
mov dword [ebp - 0x28], eax
push 0
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.0044be10
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
push 0x80
push 3
push 1
push SysReAllocString
push dword [ebp - 0x20]
call fcn.0041c970
test eax, eax
jns 0x422315
call fcn.004520f0
mov esi, eax
mov ecx, esi
call fcn.00451e90
cmp byte [0x4bd48f], 0
jne 0x42226c
mov ecx, 0xf0
call fcn.00452760
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x422261
sub esp, 8
xorps xmm0, xmm0
mov ecx, eax
movsd qword [esp], xmm0
push 0x4bd48f
sub esp, 0xc
push 0x181
push str.C:BuildAgentwork4d643bb3f4c71f96RemoteInstallerAuxiliaryServiceAuxiliaryService.cpp
push 0x28
call fcn.00451f60
jmp 0x422263
xor eax, eax
mov byte [ebp - 4], 5
mov dword [0x4be168], eax
mov ecx, esi
call fcn.00451ea0
mov ecx, dword [0x4be168]
lea ecx, [ecx + 0xd0]
call fcn.00451e90
mov eax, dword [0x4be168]
lea ecx, [ebp - 0x14]
push dword [ebp - 0x20]
mov eax, dword [eax]
mov esi, dword [eax + 0x48]
call fcn.0041ab30
mov byte [ebp - 4], 7
push dword [eax]
push str.Config_file___s__is_missed.
push dword [0x4be168]
call esi
mov edx, dword [ebp - 0x14]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 8
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4222cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [0x4be168]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4be168]
lea ecx, [ecx + 0xd0]
call fcn.00451ea0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4222fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
call fcn.004196e0
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov dword [ebp - 4], 9
jmp 0x422776
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x422338
call fcn.00417040
test eax, eax
js 0x4227a2
xor eax, eax
test eax, eax
js 0x4227a2
lea ecx, [ebp - 0x94]
call fcn.0041e4b0
push ebx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0xb
call fcn.0041cf50
mov edx, dword [ebp - 0x90]
mov ecx, dword [esi + 0x38]
add edx, 0xfffffff0
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x4223cf
lea eax, [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x4223be
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4223be
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xc
mov ecx, edi
mov edx, dword [ebp - 0x14]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4223b2
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov byte [ebp - 4], 0xb
mov dword [esi + 0x38], eax
jmp 0x4223cf
push dword [edx + 4]
lea ecx, [esi + 0x38]
push dword [ebp - 0x90]
call fcn.0041b820
mov edx, dword [ebp - 0x8c]
mov ecx, dword [esi + 0x3c]
add edx, 0xfffffff0
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x422441
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x422430
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x422430
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
mov ecx, edi
mov edx, dword [ebp - 0x18]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422424
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov byte [ebp - 4], 0xb
mov dword [esi + 0x3c], eax
jmp 0x422441
push dword [edx + 4]
lea ecx, [esi + 0x3c]
push dword [ebp - 0x8c]
call fcn.0041b820
mov edx, dword [ebp - 0x88]
mov ecx, dword [esi + 0x40]
add edx, 0xfffffff0
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x4224b3
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x4224a2
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4224a2
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xe
mov ecx, edi
mov edx, dword [ebp - 0x18]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422496
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov byte [ebp - 4], 0xb
mov dword [esi + 0x40], eax
jmp 0x4224b3
push dword [edx + 4]
lea ecx, [esi + 0x40]
push dword [ebp - 0x88]
call fcn.0041b820
mov edx, dword [ebp - 0x84]
mov ecx, dword [esi + 0x44]
add edx, 0xfffffff0
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x422525
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x422514
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x422514
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xf
mov ecx, edi
mov edx, dword [ebp - 0x18]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422508
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov byte [ebp - 4], 0xb
mov dword [esi + 0x44], eax
jmp 0x422525
push dword [edx + 4]
lea ecx, [esi + 0x44]
push dword [ebp - 0x84]
call fcn.0041b820
mov edx, dword [ebp - 0x80]
mov ecx, dword [esi + 0x48]
add edx, 0xfffffff0
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x422591
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x422583
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x422583
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x10
mov ecx, edi
mov edx, dword [ebp - 0x18]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x422577
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov byte [ebp - 4], 0xb
mov dword [esi + 0x48], eax
jmp 0x422591
push dword [edx + 4]
lea ecx, [esi + 0x48]
push dword [ebp - 0x80]
call fcn.0041b820
mov edx, dword [ebp - 0x7c]
mov ecx, dword [esi + 0x4c]
add edx, 0xfffffff0
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x4225fd
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x4225ef
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4225ef
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x11
mov ecx, edi
mov edx, dword [ebp - 0x18]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4225e3
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov byte [ebp - 4], 0xb
mov dword [esi + 0x4c], eax
jmp 0x4225fd
push dword [edx + 4]
lea ecx, [esi + 0x4c]
push dword [ebp - 0x7c]
call fcn.0041b820
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
mov dword [esi + 0x50], eax
add edx, 0xfffffff0
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x54], eax
mov ecx, dword [esi + 0x58]
sub ecx, 0x10
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x42267e
lea eax, [ecx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x422670
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x422670
mov ecx, edx
call fcn.0041b750
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x12
mov ecx, edi
mov edx, dword [ebp - 0x18]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42265b
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
add eax, 0x10
cmp dword [ebp - 0x6c], 0
mov dword [esi + 0x58], eax
setne al
mov byte [esi + 0x5c], al
jmp 0x422740
push dword [edx + 4]
lea ecx, [esi + 0x58]
push dword [ebp - 0x70]
call fcn.0041b820
cmp dword [ebp - 0x6c], 0
setne al
mov byte [esi + 0x5c], al
jmp 0x422740
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x42274f
push ebx
call esi
xor ebx, ebx
lea ecx, [ebp - 0x94]
call fcn.0041e690
test ebx, ebx
je 0x422761
push ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.004196e0
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov dword [ebp - 4], 0x15
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x422788
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.00416dd0
push eax
call fcn.00416dd0
int3