Function at 0x646102fa
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
xor edi, edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x64610337
test byte [eax + 0x1c], 2
je 0x64610337
cmp byte [eax + 0x19], 5
jb 0x64610337
push dword [eax + 0x14]
mov edx, 0x64602ff8
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.64604423
lea eax, [ebp - 0xc]
mov ecx, 0x654
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call fcn.6460cdda
mov esi, eax
test esi, esi
jne 0x6461035d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x646105f8
push 0x654
push 0
push esi
call sub.msvcrt.dll_memset
pop ecx
push 0
push 3
push ecx
push 1
mov edx, 0x80000000
mov ecx, ebx
call fcn.6460fc33
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x64610350
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x634], eax
cmp eax, 0xffffffff
je 0x64610350
cmp eax, 8
ja 0x646103a6
push 0x57
pop edi
jmp 0x646105fc
xor eax, eax
push eax
push eax
push eax
push 0x8000002
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x64610350
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
je 0x64610350
push ebx
lea ecx, [esi + 0x18]
mov edx, 0x104
call fcn.646042a0
mov ebx, eax
test ebx, ebx
jns 0x64610438
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x6461041b
test byte [ecx + 0x1c], 2
je 0x6461041b
cmp byte [ecx + 0x19], 2
jb 0x6461041b
push ebx
push dword [ecx + 0x14]
mov edx, 0x64602ff8
push dword [ecx + 0x10]
push 0xd
pop ecx
call fcn.64604441
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x64610431
movzx edi, bx
jmp 0x646105f8
mov edi, ebx
jmp 0x646105f8
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov dword [esi + 0x220], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x224], eax
mov eax, 0x4949
cmp word [esi + 0x220], ax
jne 0x646105f5
cmp word [esi + 0x222], 0x2a
jne 0x646105f5
mov ebx, dword [esi + 0x224]
test ebx, ebx
je 0x646105b9
mov edx, esi
mov ecx, ebx
call fcn.646102be
test eax, eax
je 0x646105b9
mov ecx, dword [ebp - 0xc]
jmp 0x6461049b
cmp dword [ecx + 8], ebx
mov ecx, dword [ecx]
je 0x64610589
lea eax, [ebp - 0xc]
cmp ecx, eax
jne 0x64610490
push 0xc
pop ecx
call fcn.6460cdda
test eax, eax
je 0x646105c0
mov dword [eax + 8], ebx
lea edx, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], edx
mov edx, esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 8], eax
mov ecx, dword [esi + 8]
movzx eax, word [ecx + ebx]
imul eax, eax, 0xc
add eax, ecx
mov ebx, dword [eax + ebx + 2]
mov ecx, ebx
call fcn.646102be
test eax, eax
je 0x646105b9
inc dword [esi + 0x330]
test ebx, ebx
jne 0x6461048b
mov eax, dword [esi + 0x224]
inc ebx
push ecx
mov edx, ebx
mov dword [esi + 0x338], eax
mov ecx, esi
mov dword [esi + 0x620], ebx
call fcn.64622f07
test eax, eax
je 0x646105b9
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x330]
push 0x288
push 0
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x5f0]
mov dword [ecx], eax
mov eax, dword [esi + 0x5f4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x61c]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x620]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x648]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x340]
mov dword [ecx + 0x14], eax
lea ecx, [esi + 0x348]
lea eax, [esi + 0x420]
mov dword [esi + 0x5d4], ecx
push ecx
mov dword [esi + 0x5d0], eax
mov dword [esi + 0x5d8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x64610644
push 0xb
pop edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646105fc
test byte [eax + 0x1c], 2
je 0x646105fc
cmp byte [eax + 0x19], 2
jb 0x646105fc
push dword [eax + 0x14]
mov edx, 0x64602ff8
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.64604423
jmp 0x646105fc
push 0xb
jmp 0x646103a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646105f8
test byte [eax + 0x1c], 2
je 0x646105f8
cmp byte [eax + 0x19], 2
jb 0x646105f8
push dword [eax + 0x14]
mov edx, 0x64602ff8
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.64604423
jmp 0x646105f8
push 0xb
pop edi
test edi, edi
je 0x64610644
test esi, esi
je 0x64610644
cmp dword [esi], 0
je 0x6461063b
cmp dword [esi], 0xffffffff
je 0x6461063b
cmp dword [esi + 8], 0
je 0x6461061d
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [esi + 8], 0
cmp dword [esi + 4], 0
je 0x64610630
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
mov ecx, esi
call fcn.6460ce5b
xor esi, esi
mov ebx, dword [ebp - 0xc]
jmp 0x64610663
mov edx, dword [ebx]
mov ecx, ebx
mov ebx, edx
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
and dword [ecx], 0
and dword [ecx + 4], 0
call fcn.6460ce5b
lea eax, [ebp - 0xc]
cmp ebx, eax
jne 0x64610649
test edi, edi
je 0x64610675
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8