Function at 0x646109cf
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov ebx, ecx
xor edi, edi
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64610a0c
test byte [eax + 0x1c], 2
je 0x64610a0c
cmp byte [eax + 0x19], 5
jb 0x64610a0c
push dword [eax + 0x14]
mov edx, 0x64603dd0
push dword [eax + 0x10]
push 0xd
pop ecx
call fcn.6460534c
lea eax, [ebp - 0x10]
mov ecx, 0x654
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.6460d35d
mov esi, eax
test esi, esi
jne 0x64610a32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x64610d1a
push 0x654
push 0
push esi
call sub.msvcrt.dll_memset
pop ecx
push 0
push 3
push ecx
push 1
mov edx, 0x80000000
mov ecx, ebx
call fcn.6461027f
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x64610a25
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x634], eax
cmp eax, 0xffffffff
je 0x64610a25
cmp eax, 8
ja 0x64610a7a
push 0x57
jmp 0x64610d26
xor eax, eax
push eax
push eax
push eax
push 0x8000002
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
je 0x64610a25
xor ecx, ecx
push ecx
push ecx
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
je 0x64610a25
push ebx
lea ecx, [esi + 0x18]
mov edx, 0x104
call fcn.646051c2
mov ebx, eax
test ebx, ebx
jns 0x64610b0c
mov ecx, dword [0x6461800c]
cmp ecx, 0x6461800c
je 0x64610aef
test byte [ecx + 0x1c], 2
je 0x64610aef
cmp byte [ecx + 0x19], 2
jb 0x64610aef
push ebx
push dword [ecx + 0x14]
mov edx, 0x64603dd0
push dword [ecx + 0x10]
push 0xe
pop ecx
call fcn.64605370
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x64610b05
movzx edi, bx
jmp 0x64610d1a
mov edi, ebx
jmp 0x64610d1a
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi + 0x224], eax
mov eax, 0x4949
mov dword [esi + 0x220], ecx
cmp cx, ax
jne 0x64610d24
cmp word [esi + 0x222], 0x2a
jne 0x64610d24
mov ebx, dword [esi + 0x224]
test ebx, ebx
je 0x64610d24
mov edx, esi
mov ecx, ebx
call fcn.64610947
test eax, eax
je 0x64610d24
mov ecx, dword [ebp - 0x10]
jmp 0x64610b6b
cmp dword [ecx + 8], ebx
mov ecx, dword [ecx]
je 0x64610c79
lea eax, [ebp - 0x10]
cmp ecx, eax
jne 0x64610b60
push 0xc
pop ecx
call fcn.6460d35d
test eax, eax
je 0x64610ce7
and dword [ebp - 4], edi
lea edx, [ebp - 0x10]
mov dword [eax + 8], ebx
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ecx], eax
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 8]
push ecx
mov ecx, ebx
movzx eax, word [eax + ebx]
imul edx, eax, 0xc
add edx, 2
call fcn.646105eb
test eax, eax
js 0x64610cb5
mov eax, dword [ebp - 4]
mov edx, esi
mov ebx, dword [esi + 8]
mov ebx, dword [ebx + eax]
mov ecx, ebx
call fcn.64610947
test eax, eax
je 0x64610d24
inc dword [esi + 0x330]
test ebx, ebx
jne 0x64610b5b
mov eax, dword [esi + 0x224]
inc ebx
push ebx
mov edx, ebx
mov dword [esi + 0x338], eax
mov ecx, esi
mov dword [esi + 0x620], ebx
call fcn.64623dfa
test eax, eax
je 0x64610d24
mov ecx, dword [ebp - 8]
mov eax, dword [esi + 0x330]
push 0x288
push 0
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x5f0]
mov dword [ecx], eax
mov eax, dword [esi + 0x5f4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x61c]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x620]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x648]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x340]
mov dword [ecx + 0x14], eax
lea ecx, [esi + 0x348]
lea eax, [esi + 0x420]
mov dword [esi + 0x5d4], ecx
push ecx
mov dword [esi + 0x5d0], eax
mov dword [esi + 0x5d8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x64610d6b
push 0xb
pop edi
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64610d27
test byte [eax + 0x1c], 2
je 0x64610d27
cmp byte [eax + 0x19], 2
jb 0x64610d27
push dword [eax + 0x14]
mov edx, 0x64603dd0
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.6460534c
jmp 0x64610d27
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64610ce0
test byte [eax + 0x1c], 2
je 0x64610ce0
cmp byte [eax + 0x19], 2
jb 0x64610ce0
push dword [eax + 0x14]
mov edx, 0x64603dd0
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.6460534c
mov edi, 0x216
jmp 0x64610d27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x6461800c]
cmp eax, 0x6461800c
je 0x64610d1a
test byte [eax + 0x1c], 2
je 0x64610d1a
cmp byte [eax + 0x19], 2
jb 0x64610d1a
push dword [eax + 0x14]
mov edx, 0x64603dd0
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.6460534c
test edi, edi
je 0x64610d6b
test esi, esi
je 0x64610d6b
jmp 0x64610d27
push 0xb
pop edi
cmp dword [esi], 0
je 0x64610d62
cmp dword [esi], 0xffffffff
je 0x64610d62
cmp dword [esi + 8], 0
je 0x64610d44
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [esi + 8], 0
cmp dword [esi + 4], 0
je 0x64610d57
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
mov ecx, esi
call fcn.6460d3c9
xor esi, esi
mov ebx, dword [ebp - 0x10]
jmp 0x64610d8a
mov edx, dword [ebx]
mov ecx, ebx
mov ebx, edx
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
and dword [ecx], 0
and dword [ecx + 4], 0
call fcn.6460d3c9
lea eax, [ebp - 0x10]
cmp ebx, eax
jne 0x64610d70
test edi, edi
je 0x64610d9c
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8