Function at 0x646101bf
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
xor edi, edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646101fc
test byte [eax + 0x1c], 2
je 0x646101fc
cmp byte [eax + 0x19], 5
jb 0x646101fc
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.64604453
lea eax, [ebp - 0xc]
mov ecx, 0x654
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
call fcn.6460cd43
mov esi, eax
test esi, esi
jne 0x64610222
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x646104bd
push 0x654
push 0
push esi
call sub.msvcrt.dll_memset
pop ecx
push 0
push 3
push ecx
push 1
mov edx, 0x80000000
mov ecx, ebx
call fcn.6460fb29
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x64610215
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x634], eax
cmp eax, 0xffffffff
je 0x64610215
cmp eax, 8
ja 0x6461026b
push 0x57
pop edi
jmp 0x646104c1
xor eax, eax
push eax
push eax
push eax
push 0x8000002
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x64610215
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
je 0x64610215
push ebx
lea ecx, [esi + 0x18]
mov edx, 0x104
call fcn.646042d0
mov ebx, eax
test ebx, ebx
jns 0x646102fd
mov ecx, dword [0x64617004]
cmp ecx, 0x64617004
je 0x646102e0
test byte [ecx + 0x1c], 2
je 0x646102e0
cmp byte [ecx + 0x19], 2
jb 0x646102e0
push ebx
push dword [ecx + 0x14]
mov edx, 0x64603008
push dword [ecx + 0x10]
push 0xd
pop ecx
call fcn.64604471
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x646102f6
movzx edi, bx
jmp 0x646104bd
mov edi, ebx
jmp 0x646104bd
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov dword [esi + 0x220], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x224], eax
mov eax, 0x4949
cmp word [esi + 0x220], ax
jne 0x646104ba
cmp word [esi + 0x222], 0x2a
jne 0x646104ba
mov ebx, dword [esi + 0x224]
test ebx, ebx
je 0x6461047e
mov edx, esi
mov ecx, ebx
call fcn.64610181
test eax, eax
je 0x6461047e
mov ecx, dword [ebp - 0xc]
jmp 0x64610360
cmp dword [ecx + 8], ebx
mov ecx, dword [ecx]
je 0x6461044e
lea eax, [ebp - 0xc]
cmp ecx, eax
jne 0x64610355
push 0xc
pop ecx
call fcn.6460cd43
test eax, eax
je 0x64610485
mov dword [eax + 8], ebx
lea edx, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], edx
mov edx, esi
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [ebp - 8], eax
mov ecx, dword [esi + 8]
movzx eax, word [ecx + ebx]
imul eax, eax, 0xc
add eax, ecx
mov ebx, dword [eax + ebx + 2]
mov ecx, ebx
call fcn.64610181
test eax, eax
je 0x6461047e
inc dword [esi + 0x330]
test ebx, ebx
jne 0x64610350
mov eax, dword [esi + 0x224]
inc ebx
push ecx
mov edx, ebx
mov dword [esi + 0x338], eax
mov ecx, esi
mov dword [esi + 0x620], ebx
call fcn.646105fc
test eax, eax
je 0x6461047e
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x330]
push 0x288
push 0
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x5f0]
mov dword [ecx], eax
mov eax, dword [esi + 0x5f4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x61c]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x620]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x648]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x340]
mov dword [ecx + 0x14], eax
lea ecx, [esi + 0x348]
lea eax, [esi + 0x420]
mov dword [esi + 0x5d4], ecx
push ecx
mov dword [esi + 0x5d0], eax
mov dword [esi + 0x5d8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x64610509
push 0xb
pop edi
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646104c1
test byte [eax + 0x1c], 2
je 0x646104c1
cmp byte [eax + 0x19], 2
jb 0x646104c1
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.64604453
jmp 0x646104c1
push 0xb
jmp 0x64610265
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x64617004]
cmp eax, 0x64617004
je 0x646104bd
test byte [eax + 0x1c], 2
je 0x646104bd
cmp byte [eax + 0x19], 2
jb 0x646104bd
push dword [eax + 0x14]
mov edx, 0x64603008
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.64604453
jmp 0x646104bd
push 0xb
pop edi
test edi, edi
je 0x64610509
test esi, esi
je 0x64610509
cmp dword [esi], 0
je 0x64610500
cmp dword [esi], 0xffffffff
je 0x64610500
cmp dword [esi + 8], 0
je 0x646104e2
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [esi + 8], 0
cmp dword [esi + 4], 0
je 0x646104f5
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
mov ecx, esi
call fcn.6460cda9
xor esi, esi
mov ebx, dword [ebp - 0xc]
jmp 0x64610528
mov edx, dword [ebx]
mov ecx, ebx
mov ebx, edx
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
and dword [ecx], 0
and dword [ecx + 4], 0
call fcn.6460cda9
lea eax, [ebp - 0xc]
cmp ebx, eax
jne 0x6461050e
test edi, edi
je 0x6461053a
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8