Function at 0xbd9ee6
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc95728
push 0xbe2b14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x1048
call fcn.00be1990
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x103c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x105c], 0
xor eax, eax
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x1054], eax
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x1038], 0
cmp dword [ebp + 8], 0xffff
jb 0xbd9fb7
cmp dword [ebp + 8], 0x80000000
ja 0xbd9fb7
cmp dword [ebp + 0xc], 0
jne 0xbd9fc1
mov eax, 0x30000200
jmp 0xbda267
call fcn.00bd9c30
cmp eax, 1
je 0xbd9fd5
mov eax, 0x30000201
jmp 0xbda267
mov dword [ebp - 4], 0
push 0
call dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0xbd9ff9
mov dword [ebp - 0x1034], 0x30000202
jmp 0xbda204
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0xbda02e
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0xbda02e
mov dword [ebp - 0x1034], 0x30000203
jmp 0xbda204
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0xffffffff
jne 0xbda068
mov dword [ebp - 0x1034], 0x30000204
jmp 0xbda204
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0x1040]
push ecx
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0xbda097
mov dword [ebp - 0x1034], 0x30000204
jmp 0xbda204
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [ebp - 0x1044], eax
cmp dword [ebp - 0x1044], 0
jne 0xbda0c7
mov dword [ebp - 0x1034], 0x30000205
jmp 0xbda204
lea eax, [ebp - 0x105c]
push eax
mov ecx, dword [ebp - 0x1044]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00bd9c8a
cmp eax, 1
je 0xbda0f6
mov dword [ebp - 0x1034], 0x30000206
jmp 0xbda204
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1058]
mov edx, dword [ebp - 0x1044]
add edx, dword [ecx + 0x14]
mov eax, dword [ebp + 8]
and eax, 0xfffff000
sub eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1058]
sub eax, dword [ecx + 0xc]
add edx, eax
mov dword [ebp - 0x1038], edx
mov edx, dword [ebp - 0x1050]
push edx
mov eax, dword [ebp - 0x1054]
push eax
mov ecx, dword [ebp - 0x1038]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x102c]
push eax
call fcn.00bda4bb
cmp eax, 1
je 0xbda161
mov dword [ebp - 0x1034], 0x30000207
jmp 0xbda1e1
mov dword [ebp - 0x1060], 0
mov ecx, dword [ebp - 0x1048]
push ecx
mov edx, dword [ebp - 0x104c]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00bda27a
mov dword [ebp - 0x1060], eax
mov edx, dword [ebp - 0x105c]
push edx
mov eax, dword [ebp - 0x1060]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x102c]
push edx
call fcn.00bda304
cmp eax, 1
je 0xbda1bb
mov dword [ebp - 0x1034], 0x30000208
jmp 0xbda1e1
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x102c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00bda3b9
test eax, eax
jne 0xbda1e1
mov dword [ebp - 0x1034], 0x3000020a
mov dword [ebp - 4], 0
jmp 0xbda204
mov dword [ebp - 4], 0xffffffff
call fcn.00bda212
jmp 0xbda261
mov eax, dword [ebp - 0x1034]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc