Function at 0x719caf33
Capabilities:
Read file via mapping

Disassembly:
push eax
call dword [sym.imp._CKERNEL.DLL_UnmapViewOfFile]
push dword [0x719f7230]
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
jmp 0x719cb025
push eax
push edi
push dword [0x719f7224]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
mov dword [ebx + 0x68], edi
mov dword [ebx + 0x6c], edi
mov dword [ebx + 0x70], edi
jmp 0x719caf89
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x719f7264]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, 0x719f74f8
push esi
mov dword [ebp - 4], eax
mov dword [ebx + 0x68], edi
mov dword [ebx + 0x6c], edi
mov dword [ebx + 0x70], edi
mov dword [ebx + 0x74], edi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
mov eax, dword [0x719f7514]
cmp eax, edi
je 0x719d315a
mov cl, byte [ebx + 0x28]
and cl, 1
mov byte [ebp - 0x4d], cl
mov esi, dword [eax]
mov eax, dword [ebx + 0x68]
cmp eax, edi
mov dword [ebp - 0x58], esi
jne 0x719c8b43
cmp byte [ebp - 0x4d], 0
jne 0x719d3168
cmp dword [0x719f721c], esi
sete al
test al, al
jne 0x719cb03d
push 0x12
xor eax, eax
cmp byte [ebp - 0x4d], al
pop ecx
lea edi, [ebp - 0x4c]
rep stosd dword es:[edi], eax
mov word [ebp - 0x4a], 0x48
mov word [ebp - 0x4c], 0x30
mov dword [ebp - 0x34], 0x624d7357
jne 0x719d317d
mov dword [ebp - 0x30], 1
lea eax, [ebp - 0x4c]
push eax
push eax
push dword [0x719f722c]
call dword [sym.imp._Cntl.DLL_NtRequestWaitReplyPort]
test eax, eax
jne 0x719d31e8
xor edi, edi
cmp dword [ebp - 0x2c], edi
jne 0x719d31e8
push edi
push edi
push edi
push 4
push dword [ebp - 0x30]
call dword [sym.imp._CKERNEL.DLL_MapViewOfFile]
cmp eax, edi
mov dword [ebp - 0x54], eax
je 0x719d31c4
cmp byte [ebp - 0x4d], 0
jne 0x719d318d
mov eax, dword [0x719f7228]
cmp eax, edi
jne 0x719c8979
mov eax, dword [ebp - 0x30]
mov dword [0x719f7230], eax
mov eax, dword [ebp - 0x54]
mov dword [0x719f721c], esi
mov dword [0x719f7228], eax
xor edi, edi
cmp byte [ebp - 0x4d], 0
mov eax, dword [0x719f7510]
jne 0x719cb04d
mov eax, dword [0x719f7228]
mov eax, dword [eax]
cmp eax, edi
mov dword [ebx + 0x70], eax
jbe 0x719cb0b5
cmp byte [ebp - 0x4d], 0
mov eax, dword [0x719f7510]
jne 0x719cb066
mov eax, dword [0x719f7228]
mov esi, dword [eax + 4]
push esi
push 8
push dword [0x719f7224]
call dword [sym.imp._CKERNEL.DLL_HeapAlloc]
cmp eax, edi
mov dword [ebx + 0x68], eax
je 0x719d31cd
cmp byte [ebp - 0x4d], 0
mov edx, dword [0x719f7510]
jne 0x719cb095
mov edx, dword [0x719f7228]
mov ecx, esi
mov edi, eax
mov eax, ecx
shr ecx, 2
lea esi, [edx + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x68]
mov esi, dword [ebp - 0x58]
mov dword [ebx + 0x6c], eax
xor edi, edi
mov dword [ebx + 0x24], esi
mov eax, dword [0x719f7514]
cmp esi, dword [eax]
jne 0x719caf79
push 0x719f74f8
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push edi
call dword [sym.imp._CKERNEL.DLL_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.719c15f6
leave
ret 8
push esi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push 0x276b
jmp 0x719d31da
cmp byte [ebp + 0xc], 0
jne 0x719cafa4
cmp dword [0x719f7518], esi
jmp 0x719caf99
cmp byte [ebp + 0xc], al
setne al
inc eax
inc eax
mov dword [ebp - 0x30], eax
jmp 0x719cafd1
mov eax, dword [0x719f7510]
cmp eax, edi
je 0x719d31a9
push eax
call dword [sym.imp._CKERNEL.DLL_UnmapViewOfFile]
push dword [0x719f751c]
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
mov eax, dword [ebp - 0x30]
mov dword [0x719f751c], eax
mov eax, dword [ebp - 0x54]
mov dword [0x719f7518], esi
mov dword [0x719f7510], eax
jmp 0x719cb03b
push dword [ebp - 0x30]
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
push 0x719f74f8
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push 8
call dword [sym.imp._CKERNEL.DLL_SetLastError]
or eax, 0xffffffff
jmp 0x719cb0d9
push 0x719f74f8
jmp 0x719d315b