Function at 0x101128b1
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
inc ebx
mov ecx, dword [edi + 0x1c]
call fcn.1010d880
mov esi, eax
test esi, esi
je 0x10112ab3
and dword [esp + 0xc], 0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0xc]
jne 0x101128e0
sub ecx, edx
sar ecx, 1
inc ecx
lea ecx, [esi + ecx*2]
call fcn.1010d880
test eax, eax
je 0x101129c9
mov ecx, dword [edi + 0x1c]
xor eax, eax
mov dword [esp + 0x20], eax
mov esi, eax
mov dword [esp + 0x24], eax
call fcn.1010d880
mov edi, eax
test edi, edi
je 0x101129c1
xor eax, eax
push eax
push 0x100080
push 3
push eax
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x1011299b
xor edx, edx
lea ecx, [esp + 0x18]
push ecx
push edx
push edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x1011298b
test esi, esi
je 0x10112977
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x1011298f
mov eax, dword [esp + 0x18]
mov esi, edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
jmp 0x1011298f
xor eax, eax
mov ebx, eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1011299f
xor eax, eax
mov ebx, eax
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0xc]
jne 0x101129a4
sub ecx, edx
sar ecx, 1
inc ecx
lea ecx, [edi + ecx*2]
test ebx, ebx
jne 0x10112911
test ebx, ebx
je 0x10112ab3
test esi, esi
je 0x10112ab3
xor eax, eax
push eax
push 0x100080
push 3
push eax
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x10112a45
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x10112a37
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10112a37
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x10112a4f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0xc], 0xffffffff
jmp 0x10112a49
mov edi, dword [esp + 0x14]
xor eax, eax
mov esi, eax
jmp 0x10112a51
xor eax, eax
test esi, esi
je 0x10112ab1
cmp edi, 2
jb 0x10112a79
cmp byte [esi], 0xff
jne 0x10112a79
cmp byte [esi + 1], 0xfe
jne 0x10112a79
shr edi, 1
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 2]
lea edx, [edi - 1]
call fcn.101124e5
jmp 0x10112a87
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.101126e6
mov ecx, dword [ebp + 8]
xor ebx, ebx
test eax, eax
setne bl
test ecx, ecx
je 0x10112a99
mov dword [ecx], eax
jmp 0x10112aa4
test eax, eax
je 0x10112aa4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.1010bf24
jmp 0x10112ab3
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8