Function at 0x62820
Capabilities:
Read file via mapping

Disassembly:
push 0x27c
push 0x62b48
call fcn.00062b64
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x238], ebx
xor esi, esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x230], esi
mov eax, dword [0x6c074]
cmp eax, 0xffffffff
je 0x658a7
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, dword [ebp - 0x268]
mov dword [ebp - 0x248], edi
cmp eax, esi
je 0x658b2
cmp edi, 0x40000000
jae 0x65c0c
cmp dword [ebp - 0x26c], esi
jne 0x65c0c
push dword [0x6c090]
call dword [sym.imp.USER32.dll_SetCursor]
cmp edi, esi
je 0x658bd
xor ebx, ebx
mov dword [ebp - 0x240], ebx
push esi
push edi
push esi
push 2
push esi
push dword [0x6c074]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x258], eax
cmp eax, esi
je 0x628f8
push edi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x240], ebx
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x6c074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x6c074], 0xffffffff
cmp ebx, esi
je 0x658d7
mov dword [ebp - 4], esi
mov dword [ebp - 0x23c], ebx
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x65a43
movzx eax, word [ebx]
cmp eax, 0xbbef
je 0x6590f
cmp eax, 0xfeff
jne 0x658eb
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov esi, edi
shr esi, 1
dec esi
mov dword [ebp - 0x228], esi
xor eax, eax
cmp dword [ebp - 0x234], eax
je 0x65951
push eax
push eax
push 0xb
push dword [0x6c028]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
call edi
push 0
push 0
push 0xb1
push dword [0x6c028]
call edi
push 0
push 0
push 0xb7
push dword [0x6c028]
call edi
push 2
lea eax, [esi + esi + 2]
push eax
push dword [0x6c098]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov dword [ebp - 0x250], eax
test eax, eax
je 0x65976
push eax
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x234], 0
je 0x65aeb
movzx ecx, word [ebx]
mov edx, 0xfeff
cmp cx, dx
jne 0x65ac7
lea ecx, [esi + esi]
push ecx
lea ecx, [ebx + 2]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x22c]
mov dword [0x6c00c], eax
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x24c]
cmp ebx, eax
je 0x62a1d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x254]
test eax, eax
je 0x62a5b
mov ecx, eax
test esi, esi
jbe 0x62a3f
mov edx, esi
nop
cmp word [ecx], 0
je 0x65b5a
inc ecx
inc ecx
dec edx
jne 0x62a30
xor ecx, ecx
mov word [eax + esi*2], cx
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2e
je 0x65b65
and dword [ebp - 0x244], 0
mov ebx, dword [ebp - 0x250]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov dword [0x6c098], ebx
push dword [ebp - 0x238]
push 0x104
push str.C:UsersAdministratorDesktop_R_E_A_D___T_H_I_S___43OT_.txt
call fcn.00062558
push dword [ebp - 0x238]
call fcn.00062456
xor ebx, ebx
mov dword [0x6c008], ebx
mov dword [0x6c030], 1
push ebx
push dword [0x6c098]
push 0xbc
push dword [0x6c028]
call edi
cmp dword [0x6c030], 2
je 0x65b9c
mov dword [0x6c030], ebx
push ebx
push ebx
push 0xc5
push dword [0x6c028]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x244], ebx
jne 0x65be2
xor esi, esi
inc esi
push esi
push ebx
push 0xbe
push 0x115
push dword [0x6c028]
call edi
push eax
push esi
push dword [0x6c020]
call dword [sym.imp.USER32.dll_SetScrollPos]
push ebx
push esi
push 0xb
push dword [0x6c028]
call edi
push esi
push ebx
push dword [0x6c028]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x6c028]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x6c094]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, esi
call fcn.00061a72
ret 8
push ebx
call fcn.00067bf6
jmp 0x65c39
push ebx
call fcn.00067bf6
jmp 0x65c26
lea ebx, [ebp - 0x24c]
mov dword [ebp - 0x240], ebx
xor eax, eax
mov word [ebp - 0x24c], ax
jmp 0x628f8
push dword [0x6c094]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [ebp - 0x238]
jmp 0x658a8
cmp eax, 0xfffe
jne 0x659ea
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x22c], 2
jmp 0x62950
cmp edi, 2
jbe 0x659ea
cmp byte [ebx + 2], 0xbf
jne 0x659ea
mov dword [ebp - 0x230], 0xfde9
push 3
pop eax
mov dword [ebp - 0x22c], eax
lea ecx, [ebx + 3]
mov dword [ebp - 0x23c], ecx
sub edi, eax
mov dword [ebp - 0x248], edi
mov esi, dword [ebp - 0x228]
jmp 0x6295b
push eax
push eax
push edi
push dword [ebp - 0x23c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x228], esi
xor eax, eax
jmp 0x62969
push dword [ebp - 0x238]
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.00062558
xor esi, esi
push esi
call fcn.0006800f
push dword [0x6c094]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x30
lea eax, [ebp - 0x224]
push eax
push dword [0x6c2cc]
push dword [0x6c2d0]
push dword [0x6c020]
call fcn.00067051
lea eax, [ebp - 0x24c]
cmp ebx, eax
je 0x659d2
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
push esi
push 0xb
push dword [0x6c028]
call edi
mov dword [ebp - 4], 0xfffffffe
jmp 0x65c39
push edi
push ebx
call fcn.0006991d
mov dword [ebp - 0x234], eax
cmp eax, esi
je 0x65a0e
mov dword [ebp - 0x22c], 1
mov esi, edi
shr esi, 1
jmp 0x62955
push edi
push ebx
call fcn.000698c7
test eax, eax
je 0x65a32
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x230], 0xfde9
jmp 0x65946
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x230], esi
jmp 0x65946
dec eax
je 0x65ab1
dec eax
je 0x65a85
dec eax
jne 0x65a32
mov dword [ebp - 0x230], 0xfde9
push 3
pop eax
mov dword [ebp - 0x22c], eax
cmp edi, 2
jbe 0x65946
mov ecx, 0xbbef
cmp word [ebx], cx
jne 0x65946
cmp byte [ebx + 2], 0xbf
je 0x65935
jmp 0x65946
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov eax, 0xfffe
mov esi, edi
shr esi, 1
mov dword [ebp - 0x228], esi
cmp word [ebx], ax
je 0x62954
jmp 0x6295b
xor eax, eax
inc eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], eax
mov eax, 0xfeff
jmp 0x65a99
mov edx, 0xfffe
cmp cx, dx
jne 0x65ae1
push esi
lea ecx, [ebx + 2]
push ecx
push eax
call fcn.00067a58
jmp 0x629fa
lea ecx, [esi + esi]
push ecx
push ebx
jmp 0x629f1
push esi
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x23c]
push 0
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
mov dword [ebp - 0x228], esi
jmp 0x629fa
push 0x20
pop ebx
mov word [ecx], bx
jmp 0x62a3a
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x4c
jne 0x62a54
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x4f
jne 0x62a54
cmp word [eax], 0x47
jne 0x62a54
mov dword [ebp - 0x244], 1
jmp 0x62a5b
push dword [0x6c094]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x6c030], ebx
push 0x30
push dword [ebp - 0x238]
push dword [0x6c2cc]
push dword [0x6c2d0]
push dword [0x6c020]
call fcn.00067051
push ebx
call fcn.0006800f
push ebx
push 1
push 0xb
push dword [0x6c028]
call edi
jmp 0x65c39
push esi
push esi
push 0xb1
push dword [0x6c028]
call edi
push ebx
push ebx
push 0xb7
push dword [0x6c028]
call edi
push 1
call fcn.0006978a
jmp 0x62ae6
push 0x30
push ebx
push dword [0x6c2cc]
push dword [0x6c2d0]
push dword [0x6c020]
call fcn.00067051
push dword [0x6c074]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x6c074], 0xffffffff
xor eax, eax
jmp 0x62b3f