Function at 0x4630db
Capabilities:
Read file via mapping

Disassembly:
push 0x98
mov eax, 0x51c145
call fcn.004d8b28
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
xor edi, edi
lea ecx, [ebp - 0x34]
push str.Global_
mov dword [ebp - 4], edi
call fcn.00406fea
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00409442
pop ecx
push dword [eax]
push edi
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
mov dword [ebp - 0x38], edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00407189
test edi, edi
jne 0x463192
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x11d3
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x20]
call fcn.00406620
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
jmp 0x4635cf
push 0x2000000
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x60], esi
mov byte [ebp - 4], 5
test esi, esi
jne 0x463208
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x11d6
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x20]
call fcn.00406620
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46318b
mov edx, dword [esi]
lea ecx, [ebp - 0x20]
push 0x11db
call fcn.0045d2a3
pop ecx
mov byte [ebp - 4], 7
cmp dword [ebp - 0x20], 0
jge 0x46327f
cmp dword [ebp - 0x1c], 0
mov eax, 0x11db
cmovne eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004070e7
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 8
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4631ff
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x98]
call fcn.0045d071
lea eax, [esi + 4]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x24]
call fcn.00406fea
push ecx
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x14], esp
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004070e7
mov ecx, esp
lea edx, [ebp - 0x98]
add eax, 0x10
mov dword [ecx], eax
lea ecx, [ebp - 0x20]
call fcn.004b35dc
pop ecx
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x20], 0
jge 0x46334b
cmp dword [ebp - 0x1c], 0
mov eax, 0x11e1
cmovne eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004070e7
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xc
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x98]
call fcn.004635d5
jmp 0x463276
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00407189
cmp dword [ebp - 0x78], 0
jne 0x4633a1
cmp dword [ebp - 0x7c], 0xffffffff
jne 0x4633a1
cmp byte [ebp - 0x74], 0
jne 0x4633a1
push 0x11e4
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xd
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
jmp 0x463333
xor edi, edi
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x58]
call fcn.0045d0d2
and dword [ebp - 0x20], edi
lea ecx, [ebp - 0x18]
and dword [ebp - 0x1c], edi
call fcn.0040687a
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x4c]
call fcn.004032ed
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp byte [ebp - 0x81], 0
jne 0x46340e
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x30]
call fcn.00462eed
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x11
call fcn.004032ed
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov edi, dword [ebp - 0x34]
cmp dword [ebp - 0x4c], 0
jl 0x463442
push dword [esi]
lea eax, [ebp - 0x58]
push eax
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x30]
call fcn.004615b4
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x12
call fcn.004032ed
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x24]
call fcn.0040687a
push ecx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x13
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x20]
call fcn.004b36f2
pop ecx
pop ecx
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x20], 0
jge 0x4634fa
cmp dword [ebp - 0x1c], 0
mov eax, 0x11f5
cmovne eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push ecx
mov dword [ebp - 0x14], esp
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004070e7
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x15
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x58]
call fcn.0046360f
test edi, edi
je 0x4634e0
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [ebp - 0x98]
call fcn.004635d5
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x38]
jmp 0x463200
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x24]
lea ecx, [eax - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ecx + 4]
add ecx, ecx
cmp ecx, 0x2000000
jb 0x46355b
push 0x11f6
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x30]
call fcn.00406620
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x16
push eax
mov ecx, ebx
call fcn.0040121b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x14]
jmp 0x4634c8
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push esi
call fcn.004d99b0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
call fcn.00407189
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
jmp 0x4634cd
call fcn.004d8a8d
ret