Function at 0x1006a540
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x1012c0ab
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x1d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1fc]
mov edi, ecx
mov esi, edx
call fcn.10069bc0
test al, al
je 0x1006a5b0
mov dword [esp + 0x1c], str.CreateShareble
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.1006ea90
mov ecx, eax
mov eax, str.CreateShareble
call fcn.1006eed0
xor ebx, ebx
mov dword [esp + 0x1f4], ebx
cmp dword [edi + 4], ebx
je 0x1006a604
push str._rYeR
push ebp
call fcn.10061a50
add esp, 8
mov byte [esp + 0x1b], al
mov dword [esp + 0x1f4], 0xffffffff
call fcn.10069bc0
test al, al
je 0x1006a5fb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.1006ea90
cmp byte [eax], 0
je 0x1006a5fb
call fcn.1006ef70
mov al, byte [esp + 0x1b]
jmp 0x1006a8b9
cmp esi, ebx
je 0x1006a6c1
push 6
push str.Local_
push esi
lea ebx, [esp + 0x2c]
call fcn.100d2c37
add esp, 0xc
test eax, eax
je 0x1006a64e
push str.Local_
mov eax, ebx
push 0xe2
push eax
call fcn.100d10c5
add esp, 0xc
push 0xc2
push esi
mov ecx, ebx
push 0xe2
push ecx
call fcn.100d4af3
jmp 0x1006a663
push 0xc8
push esi
lea edx, [esp + 0x28]
push 0xe2
push edx
call fcn.100cfea8
xor eax, eax
add esp, 0x10
mov word [esp + 0x1b0], ax
cmp byte [esp + 0x204], al
je 0x1006a698
call fcn.100680e0
add eax, 0x4be
je 0x1006a698
push eax
lea ecx, [esp + 0x24]
push 0xe2
push ecx
call fcn.100d1048
add esp, 0xc
cmp byte [esp + 0x208], 0
je 0x1006a6c1
call fcn.100680e0
add eax, 0x49c
je 0x1006a6c1
push eax
lea edx, [esp + 0x24]
push 0xe2
push edx
call fcn.100d1048
add esp, 0xc
xor esi, esi
test ebx, ebx
je 0x1006a771
push ebx
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x1006a771
mov dword [edi + 0xc], 2
mov ecx, dword [esp + 0x20c]
push ecx
push 0
push 0
push 6
push esi
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x1006a88c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x1006a727
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1006a73c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov ecx, ebp
call fcn.100619a0
mov edi, esi
mov esi, eax
call fcn.100621c0
mov ecx, ebp
call fcn.100619a0
test ebx, ebx
jne 0x1006a83f
push 0x10146fb8
push 0x1013c7e4
mov edx, eax
call fcn.10062cd0
add esp, 8
jmp 0x1006a7b6
cmp byte [esp + 0x200], 0
je 0x1006a805
mov eax, dword [esp + 0x20c]
push ebx
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x1006a7e7
test ebx, ebx
jne 0x1006a7d1
push 0x10146f48
mov ebx, ebp
call fcn.10062190
mov ecx, eax
call fcn.100622f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1f4], 0xffffffff
call fcn.10069b90
xor al, al
jmp 0x1006a8b9
push ebx
push 0x10146f64
mov ebx, ebp
call fcn.10062190
mov ecx, eax
call fcn.100622f0
jmp 0x1006a7af
mov dword [edi + 0xc], 1
test ebx, ebx
je 0x1006a805
push 6
push esi
call fcn.10065270
push 6
push esi
call fcn.100652c0
add esp, 0x10
test esi, esi
jne 0x1006a6e7
cmp byte [esp + 0x200], 0
jne 0x1006a6e7
test ebx, ebx
jne 0x1006a826
push 0x10146f80
jmp 0x1006a7a8
push ebx
push 0x10146f9c
mov ebx, ebp
call fcn.10062190
mov ecx, eax
call fcn.100622f0
jmp 0x1006a7af
mov esi, eax
push 0x10146fdc
push 0x1013c7e4
mov edx, esi
call fcn.10062cd0
push ebx
push 0x1013c7e4
mov edx, esi
call fcn.10062cd0
push 0x10147000
push 0x1013c7e4
mov edx, esi
call fcn.10062cd0
mov edx, dword [esp + 0x224]
push edx
push 0x10145b10
mov edx, esi
call fcn.10062cd0
add esp, 0x20
jmp 0x1006a7b6
mov dword [esp + 0x1f4], 0xffffffff
call fcn.10069bc0
test al, al
je 0x1006a8b7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.1006ea90
cmp byte [eax], 0
je 0x1006a8b7
call fcn.1006ef70
mov al, 1
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.100cf604
add esp, 0x1e4
ret 0x14