Function at 0x6461023f
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
xor edi, edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461027c
test byte [eax + 0x1c], 2
je 0x6461027c
cmp byte [eax + 0x19], 5
jb 0x6461027c
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.64604453
lea eax, [ebp - 0xc]
mov ecx, 0x654
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call fcn.6460cdc3
mov esi, eax
test esi, esi
jne 0x646102a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x6461053d
push 0x654
push 0
push esi
call sub.msvcrt.dll_memset
pop ecx
push 0
push 3
push ecx
push 1
mov edx, 0x80000000
mov ecx, ebx
call fcn.6460fba9
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x64610295
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x634], eax
cmp eax, 0xffffffff
je 0x64610295
cmp eax, 8
ja 0x646102eb
push 0x57
pop edi
jmp 0x64610541
xor eax, eax
push eax
push eax
push eax
push 0x8000002
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x64610295
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
je 0x64610295
push ebx
lea ecx, [esi + 0x18]
mov edx, 0x104
call fcn.646042d0
mov ebx, eax
test ebx, ebx
jns 0x6461037d
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x64610360
test byte [ecx + 0x1c], 2
je 0x64610360
cmp byte [ecx + 0x19], 2
jb 0x64610360
push ebx
push dword [ecx + 0x14]
mov edx, 0x64602f00
push dword [ecx + 0x10]
push 0xd
pop ecx
call fcn.64604471
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x64610376
movzx edi, bx
jmp 0x6461053d
mov edi, ebx
jmp 0x6461053d
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov dword [esi + 0x220], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x224], eax
mov eax, 0x4949
cmp word [esi + 0x220], ax
jne 0x6461053a
cmp word [esi + 0x222], 0x2a
jne 0x6461053a
mov ebx, dword [esi + 0x224]
test ebx, ebx
je 0x646104fe
mov edx, esi
mov ecx, ebx
call fcn.64610201
test eax, eax
je 0x646104fe
mov ecx, dword [ebp - 0xc]
jmp 0x646103e0
cmp dword [ecx + 8], ebx
mov ecx, dword [ecx]
je 0x646104ce
lea eax, [ebp - 0xc]
cmp ecx, eax
jne 0x646103d5
push 0xc
pop ecx
call fcn.6460cdc3
test eax, eax
je 0x64610505
mov dword [eax + 8], ebx
lea edx, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], edx
mov edx, esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 8], eax
mov ecx, dword [esi + 8]
movzx eax, word [ecx + ebx]
imul eax, eax, 0xc
add eax, ecx
mov ebx, dword [eax + ebx + 2]
mov ecx, ebx
call fcn.64610201
test eax, eax
je 0x646104fe
inc dword [esi + 0x330]
test ebx, ebx
jne 0x646103d0
mov eax, dword [esi + 0x224]
inc ebx
push ebx
mov edx, ebx
mov dword [esi + 0x338], eax
mov ecx, esi
mov dword [esi + 0x620], ebx
call fcn.64622d6b
test eax, eax
je 0x646104fe
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x330]
push 0x288
push 0
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x5f0]
mov dword [ecx], eax
mov eax, dword [esi + 0x5f4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x61c]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x620]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x648]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x340]
mov dword [ecx + 0x14], eax
lea ecx, [esi + 0x348]
lea eax, [esi + 0x420]
mov dword [esi + 0x5d4], ecx
push ecx
mov dword [esi + 0x5d0], eax
mov dword [esi + 0x5d8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x64610589
push 0xb
pop edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64610541
test byte [eax + 0x1c], 2
je 0x64610541
cmp byte [eax + 0x19], 2
jb 0x64610541
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.64604453
jmp 0x64610541
push 0xb
jmp 0x646102e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x6461053d
test byte [eax + 0x1c], 2
je 0x6461053d
cmp byte [eax + 0x19], 2
jb 0x6461053d
push dword [eax + 0x14]
mov edx, 0x64602f00
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.64604453
jmp 0x6461053d
push 0xb
pop edi
test edi, edi
je 0x64610589
test esi, esi
je 0x64610589
cmp dword [esi], 0
je 0x64610580
cmp dword [esi], 0xffffffff
je 0x64610580
cmp dword [esi + 8], 0
je 0x64610562
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [esi + 8], 0
cmp dword [esi + 4], 0
je 0x64610575
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
mov ecx, esi
call fcn.6460ce29
xor esi, esi
mov ebx, dword [ebp - 0xc]
jmp 0x646105a8
mov edx, dword [ebx]
mov ecx, ebx
mov ebx, edx
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
and dword [ecx], 0
and dword [ecx + 4], 0
call fcn.6460ce29
lea eax, [ebp - 0xc]
cmp ebx, eax
jne 0x6461058e
test edi, edi
je 0x646105ba
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8