Function at 0x5e54a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x40], edi
test edi, edi
je 0x5e5745
cmp edi, 0xffffffff
je 0x5e5745
push ebx
push esi
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov dword [ebp - 0x48], esi
test esi, esi
jne 0x5e550a
or esi, 0xffffffff
jmp 0x5e5714
cmp esi, 0xffffffff
je 0x5e5714
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x3c], ebx
test ebx, ebx
je 0x5e570e
push 0x1c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
xorps xmm0, xmm0
push eax
push ebx
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x5e555a
mov eax, dword [ebp - 0x18]
jmp 0x5e5563
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
call dword [sym.imp.dbghelp.dll_ImageNtHeader]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x5e56e7
push ebx
push dword [ebp - 0x2c]
mov edx, 0xf8
mov ecx, eax
call fcn.005dda80
test al, al
je 0x5e56e7
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0x4550
jne 0x5e56e7
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push ebx
call dword [sym.imp.dbghelp.dll_ImageDirectoryEntryToData]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x5e56e7
push ebx
push dword [ebp - 0x2c]
mov edx, 0x28
mov ecx, eax
call fcn.005dda80
test al, al
je 0x5e56e7
mov edx, dword [ebp - 0x34]
push 0
push dword [edx + 0x20]
push ebx
push dword [ebp - 0x38]
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov ecx, eax
mov dword [ebp - 0x44], ecx
test ecx, ecx
je 0x5e56e7
mov eax, dword [ebp - 0x34]
push ebx
push dword [ebp - 0x2c]
mov eax, dword [eax + 0x18]
lea edx, [eax*4]
call fcn.005dda80
test al, al
je 0x5e56e7
mov edx, dword [ebp - 0x34]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], ecx
cmp dword [edx + 0x18], eax
jbe 0x5e56e4
mov esi, ebx
xor edi, edi
nop word [eax + eax]
mov eax, dword [ebp - 0x44]
push 0
push dword [eax + ecx*4]
push esi
push dword [ebp - 0x38]
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov ebx, eax
test ebx, ebx
je 0x5e56d5
mov edx, dword [ebp - 0x2c]
mov ecx, ebx
push esi
call fcn.005dda50
cmp eax, 0xa
jb 0x5e56c2
cmp byte [ebx], 0x44
jne 0x5e56c2
cmp byte [ebx + 1], 0x6c
jne 0x5e56c2
cmp byte [ebx + 2], 0x6c
jne 0x5e56c2
cmp dword [ebp - 0x28], 0
jne 0x5e569b
push 7
lea ecx, [ebx + 3]
mov edx, 0x6249e0
call fcn.005e5460
test al, al
je 0x5e569b
mov dword [ebp - 0x28], 1
jmp 0x5e56be
test edi, edi
jne 0x5e56b8
push 0xe
lea ecx, [ebx + 3]
mov edx, str.RegisterServer
call fcn.005e5460
test al, al
mov eax, 2
cmovne edi, eax
cmp dword [ebp - 0x28], 0
je 0x5e56c2
test edi, edi
jne 0x5e56d5
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, dword [eax + 0x18]
jb 0x5e5640
mov esi, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], edi
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x28], eax
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push edi
call ebx
mov eax, dword [ebp - 0x28]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
cmp esi, 0xffffffff
je 0x5e572e
mov dword [ebp - 0x28], 0
test esi, esi
je 0x5e572e
push esi
call ebx
push edi
call ebx
mov eax, dword [ebp - 0x28]
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret