Function at 0x61d4c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
xor ecx, ecx
push ebp
push 0x61d6f2
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
push 0x61d730
push 0
push 2
call sub.kernel32.dll_OpenFileMappingA
mov dword [ebp - 0x30], eax
mov byte [ebp - 5], 0
cmp dword [ebp - 0x30], 0
je 0x61d6e8
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x61d6df
xor ecx, ecx
push ebp
push 0x61d6cc
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x34]
mov eax, dword [edx]
cmp eax, 0x1c9d3f
je 0x61d569
cmp eax, 0x1c9d4a
je 0x61d569
cmp eax, 0x1c9d54
je 0x61d569
cmp eax, 0x1c9d55
je 0x61d569
cmp eax, 0x1c9d56
je 0x61d569
cmp eax, 0x1c9d5e
jne 0x61d6c2
cmp eax, 0x1c9d55
je 0x61d577
cmp eax, 0x1c9d56
jne 0x61d582
mov ecx, dword [0x670b24]
cmp byte [ecx], 0
jne 0x61d586
xor ecx, ecx
jmp 0x61d588
mov cl, 1
mov byte [ebp - 0x27], cl
cmp eax, 0x1c9d4a
jne 0x61d59d
mov ecx, dword [0x670b24]
cmp byte [ecx], 0
jne 0x61d5a1
xor ecx, ecx
jmp 0x61d5a3
mov cl, 1
mov byte [ebp - 5], cl
cmp eax, 0x1c9d54
je 0x61d5b8
cmp eax, 0x1c9d55
je 0x61d5b8
xor ecx, ecx
jmp 0x61d5ba
mov cl, 1
mov byte [ebp - 0x26], cl
cmp eax, 0x1c9d5e
sete byte [ebp - 0x25]
add edx, 4
mov eax, dword [edx]
mov dword [ebp - 0x15], eax
add edx, 4
mov eax, dword [edx]
mov dword [ebp - 0x11], eax
add edx, 4
mov eax, dword [edx]
mov dword [ebp - 0xd], eax
add edx, 4
mov eax, dword [edx]
mov dword [ebp - 9], eax
add edx, 4
mov esi, dword [edx]
add edx, 4
mov edi, dword [edx]
test esi, esi
jle 0x61d6c2
add ebx, 0x1c
xor eax, eax
push ebp
push 0x61d6bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b968]
call fcn.00403cf4
mov dword [ebp - 0x1c], eax
mov eax, esi
cdq
push edx
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004202c0
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 4]
mov eax, ebx
mov ecx, esi
call fcn.00402cac
add ebx, esi
test edi, edi
jle 0x61d667
mov dl, 1
mov eax, dword [0x41b968]
call fcn.00403cf4
mov dword [ebp - 0x20], eax
mov eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 0x20]
call fcn.004202c0
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 4]
mov eax, ebx
mov ecx, edi
call fcn.00402cac
jmp 0x61d66c
xor eax, eax
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x26]
or al, byte [ebp - 0x25]
jne 0x61d68a
test edi, edi
jg 0x61d68a
call fcn.00652d90
test al, al
jne 0x61d68a
call fcn.00652e10
test al, al
je 0x61d691
push ebp
call fcn.0061d0b4
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d6c2
cmp dword [ebp - 0x1c], 0
je 0x61d6ac
lea eax, [ebp - 0x1c]
call fcn.004107e4
cmp dword [ebp - 0x20], 0
je 0x61d6ba
lea eax, [ebp - 0x20]
call fcn.004107e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d6d6
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d6fc
xor eax, eax
push ebp
push 0x61d71c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x24]
call fcn.0061ec44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d726
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret