Function at 0x5668a0
Capabilities:
Access peb ldr_data
Delete file
Get common file path
Get process heap flags
Get process heap force flags
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x148
mov ecx, dword [0x8e0658]
test ecx, ecx
je 0x567938
mov eax, dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x6015e0
mov dword [ebp - 0x128], eax
call eax
sub esp, 0x1c
mov edi, eax
call fcn.0057d110
mov esi, dword fs:[0x18]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x544
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateFile_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1000
call dword [sym.imp.kernel32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SetEndOfFile]
mov eax, dword [sym.imp.kernel32.dll_CreateFileMappingA]
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [ebp - 0x12c], edi
mov dword [esp], edi
mov dword [ebp - 0x118], eax
call eax
sub esp, 0x18
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x549
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov eax, dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov edi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [ebp - 0x130], ebx
mov dword [esp], ebx
call eax
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x54c
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x6015e0
mov ecx, dword [ebp - 0x128]
call ecx
sub esp, 0x1c
mov dword [ebp - 0x114], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x550
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateFile_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp dword [ebp - 0x114], 0xffffffff
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x114]
mov dword [esp], ecx
mov eax, dword [ebp - 0x118]
call eax
sub esp, 0x18
mov dword [ebp - 0x124], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x553
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__lu_n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x124]
xor eax, eax
test edx, edx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov edx, dword [ebp - 0x124]
mov dword [esp], edx
mov dword [ebp - 0x11c], edi
call edi
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x555
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [0x8e0658]
sub esp, 8
mov dword [ebp - 0x120], eax
call fcn.0057d110
mov ecx, dword [ebp - 0x120]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x557
xor eax, eax
cmp ecx, 0xc00000d4
sete al
mov dword [esp + 8], ecx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov ecx, dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov dword [esp], edi
mov dword [ebp - 0x120], ecx
call ecx
sub esp, 4
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov edx, dword [ebp - 0x130]
mov dword [esp], edx
mov eax, dword [ebp - 0x11c]
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x55b
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [0x8e0658]
sub esp, 8
mov dword [ebp - 0x134], eax
call fcn.0057d110
mov ecx, dword [ebp - 0x134]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x55d
xor eax, eax
cmp ecx, 0xc00000d4
sete al
mov dword [esp + 8], ecx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], edi
mov edx, dword [ebp - 0x120]
call edx
mov edx, dword [ebp - 0x124]
sub esp, 4
mov dword [esp], edx
mov edx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x124], edx
call edx
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov edi, dword [ebp - 0x12c]
mov dword [esp], edi
mov ecx, dword [ebp - 0x118]
call ecx
sub esp, 0x18
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x562
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [ebp - 0x134], edi
mov dword [esp], edi
mov eax, dword [ebp - 0x11c]
call eax
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x564
mov eax, dword [esi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test edi, edi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [0x8e0658]
sub esp, 8
mov dword [ebp - 0x138], eax
call fcn.0057d110
mov edx, dword [ebp - 0x138]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x566
xor eax, eax
cmp edx, 0xc00000d4
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], edi
mov edx, dword [ebp - 0x120]
call edx
mov edi, dword [ebp - 0x134]
sub esp, 4
mov dword [esp], edi
mov esi, dword [ebp - 0x124]
call esi
mov ecx, dword [ebp - 0x114]
sub esp, 4
mov dword [esp], ecx
call esi
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], ebx
call dword [0x8e0658]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x56c
mov eax, 1
test esi, esi
jne 0x567918
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
lea eax, [ebx + 0x1e]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [0x8e0658]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x570
mov eax, 1
test esi, esi
jne 0x5678f8
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
mov eax, dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov esi, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
mov dword [ebp - 0x114], eax
call eax
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x574
xor eax, eax
cmp esi, 0xc00000d4
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], ebx
mov dword [esp + 4], 0xdeadbeef
call dword [0x8e0658]
sub esp, 8
mov esi, eax
call fcn.0057d110
cmp esi, 0xc0000018
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x577
sete al
cmp esi, 0xc0000141
sete dl
mov dword [esp + 8], esi
or eax, edx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
movzx eax, al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], ebx
mov dword [esp + 4], 0
call dword [0x8e0658]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x57b
xor eax, eax
cmp esi, 0xc0000141
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov edi, dword fs:[0x18]
call fcn.0055ab70
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [0x8e0658]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x57e
xor eax, eax
cmp esi, 0xc0000018
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x8e0658]
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x581
xor eax, eax
cmp esi, 0xc0000141
sete al
mov dword [esp + 8], esi
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x10000
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x584
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.VirtualAlloc_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [0x8e0658]
sub esp, 8
mov dword [ebp - 0x134], eax
call fcn.0057d110
mov edx, dword [ebp - 0x134]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x586
xor eax, eax
cmp edx, 0xc0000018
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], esi
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_VirtualFree]
sub esp, 0xc
mov dword [esp], ebx
mov ecx, dword [ebp - 0x120]
call ecx
mov ecx, dword [ebp - 0x130]
sub esp, 4
mov dword [esp], ecx
mov ebx, dword [ebp - 0x124]
call ebx
mov ecx, dword [ebp - 0x12c]
sub esp, 4
mov dword [esp], ecx
call ebx
mov esi, dword [0x8e0658]
sub esp, 4
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov ebx, eax
mov dword [esp], 0x5ff50b
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x58f
xor eax, eax
cmp ebx, 0xc00000d4
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
mov esi, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov ebx, eax
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x592
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
mov esi, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov ebx, eax
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
add ebx, 0x1000
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x595
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
lea ecx, [ebp - 0x110]
mov dword [esp + 4], 0x104
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x110]
sub esp, 8
mov dword [esp], ecx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x110]
mov edx, 0x6c
add eax, ecx
mov word [eax + 0xc], dx
mov dword [eax], 0x72656b5c
mov dword [eax + 4], 0x336c656e
mov dword [eax + 8], 0x6c642e32
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ecx
mov ecx, dword [ebp - 0x128]
call ecx
sub esp, 0x1c
mov ebx, eax
mov dword [ebp - 0x12c], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x59a
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateFile_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x118]
call ecx
sub esp, 0x18
mov esi, eax
mov dword [ebp - 0x130], eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x59d
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], esi
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov ecx, dword [ebp - 0x11c]
call ecx
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x59f
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov ebx, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
mov edi, dword [ebp - 0x114]
call edi
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], esi
call ebx
sub esp, 8
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5a1
xor eax, eax
cmp ebx, 0xc00000d4
sete al
mov dword [esp + 8], ebx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov ebx, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
call edi
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
mov ecx, dword [0x8f0770]
sub esp, 8
mov ebx, eax
mov dword [ebp - 0x134], ecx
call fcn.0057d110
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [ecx + ecx]
mov ecx, dword [ebp - 0x134]
test ecx, ecx
setne cl
movzx ecx, cl
or edx, ecx
mov dword [eax + 0x10], edx
jmp 0x5674f5
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5a4
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x5674c0
mov dword [esp], esi
mov esi, dword [ebp - 0x120]
call esi
mov eax, dword [ebp - 0x130]
sub esp, 4
mov dword [esp], eax
mov edi, dword [ebp - 0x124]
call edi
sub esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x12c]
mov edi, dword fs:[0x18]
mov dword [esp], eax
mov ecx, dword [ebp - 0x118]
call ecx
sub esp, 0x18
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5a9
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [ebp - 0x130], ebx
mov dword [esp], ebx
mov edx, dword [ebp - 0x11c]
call edx
sub esp, 0x14
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5ab
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
setne al
mov dword [esp], eax
call fcn.0055ab70
mov esi, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5ad
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
mov esi, dword [0x8e0658]
mov dword [esp], 0x5ff4e6
mov eax, dword [ebp - 0x114]
call eax
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
sub esp, 8
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5af
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
call fcn.0055ab70
lea eax, [ebp - 0x110]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
mov eax, dword [ebp - 0x128]
call eax
sub esp, 0x1c
mov esi, eax
call fcn.0057d110
cmp esi, 0xffffffff
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5b2
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateFile_error__lu_n
mov dword [esp + 8], eax
setne al
movzx eax, al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 4], 0
mov dword [ebp - 0x114], esi
mov dword [esp], esi
mov ecx, dword [ebp - 0x118]
call ecx
sub esp, 0x18
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5b4
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.CreateFileMapping_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [ebp - 0x118], esi
mov dword [esp], esi
mov edx, dword [ebp - 0x11c]
call edx
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5b6
mov eax, dword [edi + 0x34]
mov dword [esp + 4], str.MapViewOfFile_FILE_MAP_READ_error__lu_n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
setne al
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [0x8e0658]
sub esp, 8
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov edx, dword [ebp - 0x11c]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5b8
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [0x8e0658]
sub esp, 8
mov dword [ebp - 0x11c], eax
call fcn.0057d110
mov edx, dword [ebp - 0x11c]
mov dword [eax], 0x5fd7d7
mov dword [eax + 4], 0x5ba
xor eax, eax
test edx, edx
sete al
mov dword [esp + 8], edx
mov dword [esp + 4], str.NtAreMappedFilesTheSame_returned__lx_n
mov dword [esp], eax
call fcn.0055ab70
mov dword [esp], esi
mov esi, dword [ebp - 0x120]
call esi
mov ecx, dword [ebp - 0x118]
sub esp, 4
mov dword [esp], ecx
mov edi, dword [ebp - 0x124]
call edi
mov eax, dword [ebp - 0x114]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
mov dword [esp], ebx
call esi
mov ebx, dword [ebp - 0x130]
sub esp, 4
mov dword [esp], ebx
call edi
mov eax, dword [ebp - 0x12c]
sub esp, 4
mov dword [esp], eax
call edi
sub esp, 4
mov dword [esp], 0x6015e0
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x8f0770]
test ecx, ecx
sete dl
xor eax, eax
cmp esi, 0xc00000d4
sete al
and eax, edx
jmp 0x566ea6
mov edi, dword [0x8f0770]
test edi, edi
sete dl
xor eax, eax
cmp esi, 0xc00000d4
sete al
and eax, edx
jmp 0x566e5e
mov eax, 0x53e
call fcn.0055a4a0
mov dword [esp], str.NtAreMappedFilesTheSame_not_available_n
call fcn.0055ab40
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret