Function at 0xffebf23
Capabilities:
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1dc
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp + 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp + 0x4c]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x16c]
push eax
push dword [ebp + 0x78]
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
mov dword [ebp + 0x78], eax
jne 0xffebf6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0xffec20d
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp + 0x44], eax
jne 0xffebf8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0xffec1f6
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x64], esi
jne 0xffebfae
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xffec1dd
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x48]
push eax
push 0xffd5fb8
or esi, 1
push esi
call fcn.0ffebe67
cmp eax, ebx
jne 0xffec1dd
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x60]
push eax
push 0xffd5fb0
push esi
call fcn.0ffebe67
cmp eax, ebx
jne 0xffec1dd
mov edx, dword [ebp + 0x5c]
cmp edx, 8
jb 0xffec1e1
mov esi, dword [ebp + 0x48]
mov ebx, dword [esi + 4]
xor eax, eax
cmp dword [esi], 0x100
lea edi, [ebp + 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x40], ebx
jne 0xffec1e1
cmp ebx, dword [ebp + 0x7c]
ja 0xffec1e1
lea eax, [edx - 8]
cmp eax, 8
jne 0xffec1e1
xor eax, eax
push 0x24
pop ecx
lea edi, [ebp - 0xe4]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x64]
lea ecx, [ebx + eax + 4]
mov eax, dword [ebp + 0x60]
cmp eax, esi
jbe 0xffec06f
mov ebx, esi
mov edi, eax
sub edi, esi
mov esi, dword [ebp + 0x64]
sub ebx, ecx
sub esi, eax
mov eax, dword [ebp + 0x68]
lea ecx, [ebp + 0x2c]
sub esi, eax
mov dword [ebp + 0x60], ecx
sub edi, edx
add esi, dword [ebp + 0x7c]
lea ecx, [ebp - 0xe4]
mov dword [ebp + 0x7c], edx
mov dword [ebp + 0x5c], ecx
mov dword [ebp + 0x68], eax
jmp 0xffec09c
mov edi, esi
mov esi, dword [ebp + 0x64]
sub esi, dword [ebp + 0x48]
sub edi, eax
mov ebx, eax
mov eax, dword [ebp + 0x68]
sub ebx, ecx
sub edi, eax
sub esi, edx
add esi, dword [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
lea ecx, [ebp - 0xe4]
lea eax, [ebp + 0x2c]
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x68], edx
push 0xffd5c58
lea eax, [ebp - 0x54]
push eax
call fcn.0ffe5890
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0x40]
push dword [ebp + 0x78]
call fcn.0ffebeb4
test eax, eax
jne 0xffec1dd
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
push 4
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0ffebdc3
push 1
push 0
push 4
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0xffebfa3
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp + 0x78]
call fcn.0ffebeb4
test eax, eax
jne 0xffec1dd
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x7c]
lea eax, [ebp - 0x54]
push dword [ebp + 0x60]
push eax
call fcn.0ffebdc3
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
call ebx
test eax, eax
je 0xffebfa3
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp + 0x78]
call fcn.0ffebeb4
test eax, eax
jne 0xffec1dd
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x54]
push dword [ebp + 0x5c]
push eax
call fcn.0ffebdc3
push 1
push 0
push dword [ebp + 0x68]
push dword [ebp + 0x78]
call ebx
test eax, eax
je 0xffebfa3
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push dword [ebp + 0x78]
call fcn.0ffebeb4
test eax, eax
jne 0xffec1dd
mov edi, dword [ebp + 0x48]
push 8
pop ecx
add edi, ecx
lea esi, [ebp + 0x54]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0xffec1d4
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb eax, eax
and eax, 0x80090020
mov esi, eax
jmp 0xffec1e6
mov esi, 0x80090020
xor ebx, ebx
cmp dword [ebp + 0x64], ebx
je 0xffec1f6
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp + 0x44], ebx
je 0xffec204
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8