Function at 0x30011ba5
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
cmp dword [esi + 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
jg 0x30011be3
mov dword [0x3002ed24], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x3002ed04], ebx
je 0x30011bf2
mov dword [esi + 0x20], 1
mov ecx, dword [esi + 0x38]
cmp ecx, ebx
jne 0x30011bfe
cmp dword [esi + 0x34], ebx
je 0x30011c0f
cmp dword [esi + 0x1c], ebx
jne 0x30011bda
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x30011c0f
cmp word [eax], bx
jne 0x30011bda
cmp ecx, ebx
je 0x30011c3e
mov eax, dword [esi]
cmp eax, ebx
je 0x30011c1d
cmp byte [eax], bl
jne 0x30011bda
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x30011c28
cmp byte [eax], bl
jne 0x30011bda
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x30011c34
cmp word [eax], bx
jne 0x30011bda
cmp dword [esi + 0x20], ebx
jne 0x30011bda
cmp dword [esi + 0x24], ebx
jne 0x30011bda
mov ecx, dword [esi]
cmp ecx, ebx
je 0x30011cb6
cmp byte [ecx], bl
je 0x30011cb6
mov al, byte [ecx]
cmp al, bl
je 0x30011c7f
mov edi, ecx
cmp al, 0x3b
je 0x30011c5c
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x30011c50
cmp byte [edi], bl
jne 0x30011c6e
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.30010ebb
mov ecx, edi
jmp 0x30011c48
lea eax, [ebp - 0x10]
mov byte [edi], bl
push eax
push ecx
call fcn.30010ebb
lea ecx, [edi + 1]
jmp 0x30011c48
push dword [ebp - 0x10]
call fcn.30010e00
cmp eax, ebx
mov dword [ebp - 8], eax
jle 0x30011cb6
inc dword [ebp - 8]
push 0x106
push dword [ebp - 8]
call fcn.30024221
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x30011cb3
push dword [ebp - 8]
push eax
push dword [ebp - 0x10]
call fcn.30010e40
jmp 0x30011cb6
mov dword [ebp - 8], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x30011ccb
cmp byte [eax], bl
je 0x30011ccb
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.30010860
cmp dword [esi + 0x1c], ebx
je 0x30011ce0
cmp dword [0x3002ed10], ebx
jne 0x30011ce0
mov eax, dword [0x3002b910]
mov dword [ebp - 0x14], eax
lea edi, [esi + 8]
push edi
call fcn.30011a7a
lea eax, [esi + 0xc]
push eax
call fcn.30011a7a
cmp dword [ebp - 0x14], ebx
je 0x30011cff
mov eax, dword [ebp - 0x14]
cmp word [eax], bx
ja 0x30011d1c
cmp dword [ebp - 8], ebx
jg 0x30011d1c
cmp dword [ebp - 0xc], ebx
jne 0x30011d1c
cmp dword [esi + 0x20], ebx
jne 0x30011d1c
cmp dword [esi + 0x24], ebx
jne 0x30011d1c
cmp dword [edi], ebx
jne 0x30011d1c
cmp dword [esi + 0xc], ebx
je 0x30011d79
mov eax, dword [esi + 0x24]
push dword [ebp - 0x14]
or eax, dword [esi + 0x20]
push eax
lea eax, [esi + 0x2c]
push eax
push dword [esi + 0xc]
push dword [edi]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 0x18]
call fcn.300112c3
test eax, eax
je 0x3001224f
cmp dword [0x3002eab0], ebx
jne 0x30011d79
push esi
push 0x3000921e
push dword [0x3002d814]
push 0x6d
push dword [0x3002eae4]
call fcn.30007c23
test eax, eax
jne 0x30011d79
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 1
jmp 0x3001224f
push 1
pop edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
call fcn.3001576d
test eax, eax
je 0x30011bda
cmp dword [esi + 0x20], ebx
je 0x30011eea
cmp dword [0x3002ed10], ebx
jne 0x30011dcb
mov eax, dword [0x3002b2e0]
cmp eax, ebx
je 0x3001224c
push dword [0x3002b2e4]
push eax
push 0x30011b60
call fcn.30015823
test eax, eax
jne 0x30011eea
jmp 0x3001224c
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x3001224c
cmp word [eax], bx
je 0x3001224c
push eax
call fcn.30025737
mov edi, eax
push 0x106
inc edi
lea eax, [edi + edi]
push eax
call fcn.30024221
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x3001224c
push edi
push eax
push dword [ebp + 0x10]
call fcn.30025678
push 0x7c
push dword [ebp + 8]
call fcn.3000b631
mov edi, eax
push ebx
push 0x8000000
push 3
push ebx
push 3
push 0x80000000
push edi
mov byte [ebp + 0x13], bl
call fcn.3000e868
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x30011eda
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 0x28], eax
je 0x30011ea8
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x30011e9f
push 0x30011b6c
push edi
call fcn.3000dbaa
mov edi, eax
cmp edi, ebx
je 0x30011e96
push ebx
push dword [ebp + 0xc]
call dword [fcn.30001128]
push eax
push dword [ebp - 0x24]
push edi
call fcn.30015823
test eax, eax
je 0x30011ec9
push edi
call fcn.3002425c
mov byte [ebp + 0x13], 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [ebp + 0x13], bl
je 0x30011eda
push 0x7c
push ebx
call fcn.3000b631
mov edi, eax
cmp edi, ebx
je 0x30011edf
jmp 0x30011e17
push edi
mov dword [ebp - 4], ebx
call fcn.3002425c
push dword [ebp + 8]
jmp 0x30012224
mov dword [ebp - 4], ebx
jmp 0x30011ed2
push dword [ebp + 8]
call fcn.3002425c
push 1
pop edi
cmp dword [esi + 0x24], ebx
je 0x30011f3a
cmp dword [0x3002ed10], ebx
jne 0x30011f3a
cmp dword [0x3002eaf4], ebx
jne 0x30011f3a
push edi
push 0x3002b2e8
push 0x104
push 0x3002b500
call fcn.3000cc58
mov eax, dword [0x3002b2f0]
cmp eax, ebx
je 0x3001224c
push dword [0x3002b2f4]
push eax
push 0x30011b70
call fcn.30015823
test eax, eax
je 0x3001224c
mov eax, dword [esi + 0x28]
mov dword [ebp + 8], ebx
cmp word [eax], bx
jbe 0x30011fc1
xor edi, edi
mov eax, dword [eax + 0xc]
lea eax, [eax + edi + 8]
push eax
call fcn.300256b0
inc eax
mov dword [ebp + 0xc], eax
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.300244ab
test eax, eax
je 0x3001224c
mov eax, dword [esi + 0x28]
push dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push dword [ebp + 0x10]
lea eax, [eax + edi + 8]
push eax
call fcn.30025695
push dword [ebp + 0x10]
call fcn.3000db3f
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0xc]
add eax, edi
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x10]
call fcn.30015823
test eax, eax
je 0x30012134
push dword [ebp + 0x10]
call fcn.300245ad
mov eax, dword [esi + 0x28]
inc dword [ebp + 8]
add edi, 0x10c
movzx ecx, word [eax]
cmp dword [ebp + 8], ecx
jl 0x30011f47
lea eax, [ebp - 0x1c]
push eax
call fcn.300119b0
test eax, eax
je 0x30011fed
push dword [ebp - 0x1c]
call fcn.300256b0
inc eax
push eax
push dword [ebp - 0x1c]
push 0x30011b84
call fcn.30015823
test eax, eax
je 0x3001224c
cmp dword [ebp - 0x10], ebx
je 0x30012005
push dword [ebp - 8]
push dword [ebp - 0x18]
call fcn.3001109d
test eax, eax
je 0x3001224c
cmp dword [ebp - 0x14], ebx
je 0x30012023
cmp dword [esi + 0x1c], ebx
je 0x30012023
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
call fcn.300110c3
test eax, eax
je 0x3001224c
cmp dword [ebp - 0xc], ebx
je 0x30012038
push dword [ebp - 0xc]
call fcn.300111e8
test eax, eax
je 0x3001224c
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x3001214f
push 0x3b
push eax
call fcn.3000b631
mov dword [ebp + 8], eax
push ebx
push 0x8000000
push 3
push ebx
push 3
push 0x80000000
push eax
mov byte [ebp + 0x13], bl
call fcn.3000e868
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
je 0x300120eb
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x300120dd
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x300120d4
push 0x30011b90
push dword [ebp + 8]
call fcn.3000dbaa
push ebx
mov dword [ebp + 0x10], eax
push dword [ebp - 0x28]
call dword [fcn.30001128]
push eax
push edi
push dword [ebp + 0x10]
call fcn.30015823
test eax, eax
je 0x30012144
push dword [ebp + 0x10]
call fcn.3002425c
push edi
mov byte [ebp + 0x13], 1
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [ebp + 0x13], bl
jne 0x30012120
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x30011b94
mov dword [ebp - 0x24], eax
push dword [ebp + 8]
call fcn.3000dbaa
mov edi, eax
lea eax, [ebp - 0x24]
push 4
push eax
push edi
mov byte [edi], 0x21
call fcn.30015823
test eax, eax
je 0x30012220
push edi
call fcn.3002425c
push 0x3b
push ebx
call fcn.3000b631
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x3001214f
jmp 0x3001204e
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
call fcn.300245ad
jmp 0x3001224f
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
jmp 0x30012224
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x3001222b
push 0x3b
push eax
call fcn.3000b631
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x10]
call fcn.3000e9af
cmp eax, ebx
mov dword [ebp + 0xc], eax
jle 0x300121db
push 0x106
push eax
call fcn.30024221
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x300121a0
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 0x28]
push dword [ebp + 0x10]
call fcn.3000ea28
push 0x30011b98
push dword [ebp + 0x10]
call fcn.3000dbaa
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.30015823
test eax, eax
je 0x30012220
push edi
call fcn.3002425c
push dword [ebp + 8]
jmp 0x30012207
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x30011ba0
mov dword [ebp - 0x24], eax
push dword [ebp + 0x10]
call fcn.3000dbaa
mov edi, eax
lea eax, [ebp - 0x24]
push 4
push eax
push edi
mov byte [edi], 0x21
call fcn.30015823
test eax, eax
je 0x30012220
push edi
call fcn.3002425c
push 0x3b
push ebx
call fcn.3000b631
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x3001222b
jmp 0x30012165
mov dword [ebp - 4], ebx
push edi
call fcn.3002425c
jmp 0x3001224f
lea edi, [esi + 0x14]
add esi, 0x18
push edi
push esi
call fcn.300158e6
test eax, eax
jne 0x3001224f
mov eax, dword [esi]
mov dword [edi], ebx
cmp eax, ebx
je 0x3001224c
push eax
call fcn.3002425c
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x3001227a
xor esi, esi
cmp word [eax], bx
jbe 0x30012274
mov eax, dword [eax + 0xc]
push dword [eax + esi*4]
call dword [sym.imp.OLEAUT32.DLL_SysStringLen]
mov eax, dword [ebp - 0xc]
inc esi
movzx ecx, word [eax]
cmp esi, ecx
jl 0x3001225d
push eax
call fcn.300271a7
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x300122bd
xor edi, edi
cmp word [eax], bx
jbe 0x300122a3
xor esi, esi
mov eax, dword [eax + 0xc]
add eax, esi
push eax
call fcn.3000c734
mov eax, dword [ebp - 0x20]
inc edi
add esi, 0x10
movzx ecx, word [eax]
cmp edi, ecx
jl 0x3001228a
push eax
call fcn.300274ef
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
mov esi, ecx
je 0x300122bd
call fcn.3001047e
push esi
call fcn.3002425c
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x300122ec
xor esi, esi
cmp word [eax], bx
jbe 0x300122e6
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx + esi*4]
cmp ecx, ebx
je 0x300122de
push ecx
call fcn.3002425c
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
inc esi
cmp esi, ecx
jl 0x300122cb
push eax
call fcn.300271a7
cmp dword [ebp - 0x18], ebx
je 0x300122f9
push dword [ebp - 0x18]
call fcn.3002425c
cmp dword [ebp - 0x1c], ebx
je 0x30012306
push dword [ebp - 0x1c]
call fcn.3002425c
mov eax, dword [ebp - 4]
jmp 0x30011bdc