Function at 0x10001000
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x154
push esi
push edi
xor esi, esi
push esi
push esi
push 4
push esi
push 3
push 0xc0000000
push dword [ecx + 0xc]
mov dword [ebp + 0x60], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10001255
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x1004060c
push 0xb0b8b6c0
call fcn.1000f13a
push eax
push esi
push esi
push 0x8000004
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
push esi
push 6
push eax
mov dword [ebp + 0x74], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp + 0x70], eax
jne 0x10001082
push dword [ebp + 0x74]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
jmp 0x10001255
push ebx
push eax
lea ecx, [ebp - 0x4c]
call fcn.1000c2e8
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
push 7
pop edi
push esi
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x58], edi
call fcn.10024037
push esi
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x3c], edi
call fcn.10024037
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x20], edi
call fcn.10024037
xor edi, edi
inc edi
push edi
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xdc]
call fcn.1000f086
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.100054a6
pop ecx
pop ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
neg al
sbb eax, eax
not eax
test ecx, eax
je 0x10001213
push 0x3b
pop eax
mov dword [ebp + 0x6c], 0xd
mov dword [ebp + 0x68], 0xa
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x5c], eax
push edi
push esi
lea eax, [ebp + 0x6c]
push eax
lea ecx, [ebp + 0x40]
call fcn.10017d27
cmp eax, 0xffffffff
jne 0x10001139
push edi
push esi
lea eax, [ebp + 0x68]
push eax
lea ecx, [ebp + 0x40]
call fcn.10017d27
cmp eax, 0xffffffff
je 0x10001146
push 0xffffffffffffffff
push eax
lea ecx, [ebp + 0x40]
call fcn.10020a60
jmp 0x10001113
push edi
push esi
lea eax, [ebp + 0x64]
push eax
lea ecx, [ebp + 0x40]
call fcn.10017d27
push eax
push esi
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0x14]
call fcn.1001a68c
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0x24]
call fcn.100152a6
push esi
push edi
lea ecx, [ebp - 0x14]
call fcn.100221da
push 0xffffffffffffffff
push edi
push esi
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp + 0x40]
call fcn.10017d27
inc eax
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0x14]
call fcn.1001a68c
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.100152a6
push esi
push edi
lea ecx, [ebp - 0x14]
call fcn.100221da
cmp dword [ebp + 0x38], esi
je 0x100011e7
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x30]
call fcn.10012cf2
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.10012cf2
mov ecx, dword [ebp + 0x60]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10019de6
lea ecx, [ebp - 0x30]
call fcn.10008b01
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.100054a6
pop ecx
pop ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
neg al
sbb eax, eax
not eax
test ecx, eax
jne 0x10001113
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp + 0x74]
call ebx
lea ecx, [ebp - 0xdc]
call fcn.100036ab
push esi
push edi
lea ecx, [ebp + 8]
call fcn.100221da
push esi
push edi
lea ecx, [ebp + 0x24]
call fcn.100221da
push esi
push edi
lea ecx, [ebp + 0x40]
call fcn.100221da
push esi
push edi
lea ecx, [ebp - 0x4c]
call fcn.100221da
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret