Function at 0x6d523bba
Capabilities:
Get file size
Parse pe header

Disassembly:
push 0x334
push 0x6d5130d8
call fcn.6d536a6c
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 0xc]
dec eax
je 0x6d523c5f
dec eax
je 0x6d523c25
dec eax
jne 0x6d523d14
mov dword [ebp - 0x24], edi
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0x448]
push dword [esi]
call fcn.6d52368d
mov dword [ebx + 0x44c], eax
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x30], eax
lea eax, [ebx + 0x23e]
mov dword [ebx + 0x67c], 3
mov esi, edi
jmp 0x6d523c87
mov dword [ebp - 0x24], edi
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0x234]
push dword [esi]
call fcn.6d52368d
mov dword [ebx + 0x238], eax
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x30], eax
mov dword [ebx + 0x67c], 2
mov esi, edi
jmp 0x6d523c84
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x71c]
mov dword [ebp - 0x24], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], edi
mov dword [ebx + 0x67c], 5
lea eax, [ebx + 0x2a]
mov dword [ebp - 0x34], eax
mov dword [ebx + 0x86c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 4], edi
push 2
lea eax, [ebp - 0x40]
push eax
push edi
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
jne 0x6d523cc0
mov dword [0x6d58043c], 6
jmp 0x6d523d10
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x674], eax
cmp word [ebp - 0x40], 0x4944
jne 0x6d523dd7
push 0x30
lea eax, [ebp - 0x74]
push eax
push edi
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d523d10
mov ax, word [ebp - 0x70]
cmp ax, 0x14c
je 0x6d523d1b
cmp ax, 0x184
je 0x6d523d1b
add ebx, 0x44c
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx], edi
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x6d524503
mov ecx, dword [ebp - 0x50]
mov dword [ebx + 0x6ec], ecx
mov ecx, dword [ebp - 0x68]
mov dword [ebx + 0x1c], ecx
mov word [ebx + 0x28], ax
mov eax, dword [ebp - 0x6c]
mov dword [ebx + 0x20], eax
movzx eax, word [ebp - 0x6e]
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x10]
or eax, dword [ebx + 0x14]
jne 0x6d523d4c
mov eax, dword [ebp - 0x64]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edi
cmp dword [ebx + 0x18], edi
jne 0x6d523d57
mov eax, dword [ebp - 0x60]
mov dword [ebx + 0x18], eax
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x78], esi
lea esi, [esi + esi*4]
shl esi, 3
push esi
call fcn.6d522878
mov dword [ebp - 0x7c], eax
cmp eax, edi
je 0x6d524182
push esi
push eax
push edi
push 0x30
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d524182
mov ecx, dword [ebp - 0x7c]
mov dword [ebx + 0x6ac], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebx + 0x6e0], eax
mov dword [ebx + 0x6a4], ecx
mov dword [ebx + 0x6d8], eax
mov eax, dword [ebp - 0x54]
cmp eax, edi
je 0x6d524182
xor edx, edx
push 0x1c
pop ecx
div ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x5c]
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + eax*8 + 0x30]
jmp 0x6d52417f
cmp word [ebp - 0x40], 0x5a4d
jne 0x6d523e6c
push 0x40
lea eax, [ebp - 0xbc]
push eax
push edi
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d523cb4
push 0xf8
lea eax, [ebp - 0x1b4]
push eax
mov eax, dword [ebp - 0x80]
cdq
push edx
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d523cb4
cmp dword [ebp - 0x1b4], 0x4550
je 0x6d523f11
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x1b8], ecx
movzx ecx, word [ebp - 0x1a0]
mov edx, dword [ebp - 0x80]
lea ecx, [ecx + edx + 0x18]
mov dword [ebp - 0x1bc], ecx
jmp 0x6d523f14
cmp word [ebp - 0x40], 0x14c
jne 0x6d523ea5
push 0xf4
lea eax, [ebp - 0x1b0]
push eax
push edi
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d523d10
mov dword [ebp - 0x1b4], 0x524f4d20
jmp 0x6d523f11
push 0x4c
lea eax, [ebp - 0x208]
push eax
push edi
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d523cb4
cmp word [ebp - 0x208], 0x14c
je 0x6d523eec
cmp word [ebp - 0x208], 0x184
je 0x6d523eec
cmp word [ebp - 0x208], 0x284
jne 0x6d523d10
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x208]
mov dword [ebp - 0x1b8], eax
movzx eax, word [ebp - 0x1f8]
add eax, 0x14
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1c]
cmp eax, edi
je 0x6d523f4e
cmp word [eax], 0x107
jne 0x6d523d10
mov dword [ebx + 0x6f4], 1
mov cx, word [eax]
mov word [ebx + 0x23c], cx
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], edi
mov eax, dword [eax + 4]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
jmp 0x6d524085
movzx eax, word [ebp - 0x1b0]
push eax
call fcn.6d523609
test eax, eax
je 0x6d524003
push 0x108
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x80]
cdq
push edx
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d523cb4
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x80]
add eax, 0x108
mov dword [ebp - 0x1bc], eax
mov ax, word [ebp - 0x2f8]
mov word [ebx + 0x23c], ax
xor eax, eax
inc eax
mov dword [ebx + 0x6f0], eax
cmp dword [ebp + 0xc], 2
je 0x6d523fd4
cmp dword [ebp + 0xc], eax
jne 0x6d523ffb
mov eax, dword [ebp - 0x2e0]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebx + 0x6ec], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x2c0]
jmp 0x6d524082
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b8], eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x314], eax
mov ax, word [ebp - 0x19c]
mov word [ebx + 0x23c], ax
cmp dword [ebp - 0x1b4], 0x524f4d20
jne 0x6d524041
mov dword [ebp - 0x1bc], 0xf4
jmp 0x6d52404f
mov eax, dword [ebp - 0x80]
add eax, 0xf8
mov dword [ebp - 0x1bc], eax
cmp dword [ebp + 0xc], 2
je 0x6d52405b
cmp dword [ebp + 0xc], 1
jne 0x6d52407c
mov eax, dword [ebp - 0x180]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edi
mov eax, dword [ebp - 0x17c]
mov dword [ebx + 0x6ec], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x164]
mov dword [ebx + 0x18], eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x64
push dword [ebx + 0x878]
call fcn.6d52358e
mov eax, dword [ebp - 0x1b8]
movzx esi, word [eax + 2]
mov dword [ebp - 0x78], esi
lea eax, [esi + esi*4]
shl eax, 3
mov dword [ebp - 0x318], eax
push eax
call fcn.6d522878
mov edi, eax
mov dword [ebp - 0x7c], edi
test edi, edi
je 0x6d524182
push dword [ebp - 0x318]
push edi
push 0
push dword [ebp - 0x1bc]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.6d52362c
mov dword [ebp - 0x44], eax
test eax, eax
je 0x6d524182
mov dword [ebx + 0x6ac], edi
mov dword [ebx + 0x6e0], esi
mov dword [ebx + 0x6a0], edi
mov dword [ebx + 0x6d4], esi
mov eax, dword [ebp - 0x1b8]
mov cx, word [eax]
mov word [ebx + 0x28], cx
mov ecx, dword [eax + 4]
mov dword [ebx + 0x20], ecx
movzx eax, word [eax + 0x12]
mov dword [ebx + 0x24], eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x65
push dword [ebx + 0x878]
call fcn.6d52358e
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], esi
jae 0x6d524182
cmp dword [ebx + 0x6f4], 0
je 0x6d524262
mov eax, dword [ebp - 0x1b8]
test byte [eax + 0x13], 2
jne 0x6d524262
mov edi, 0x6d512de8
mov esi, dword [ebp - 0x7c]
push 7
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x6d524262
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
mov esi, dword [ebp + 0xc]
cmp esi, 2
jne 0x6d5241a3
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 0x6b0], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x6b4], eax
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x6d5244fc
push 0x1c
lea eax, [ebp - 0x33c]
push eax
push edi
push dword [ebp - 0x3c]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.6d52362c
mov dword [ebp - 0x44], eax
cmp eax, edi
je 0x6d5244fc
cmp dword [ebp - 0x32c], edi
je 0x6d5244e9
push edi
push esi
push dword [ebp - 0x330]
push dword [ebx + 0x878]
call fcn.6d52358e
mov eax, dword [ebp - 0x330]
dec eax
je 0x6d5243d4
dec eax
je 0x6d524336
dec eax
dec eax
jne 0x6d524417
mov eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x30]
jae 0x6d52431d
mov ecx, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebp - 0x340], eax
cmp dword [eax], 1
jne 0x6d524417
cmp esi, 3
jne 0x6d5242f2
lea ecx, [ebx + 0x12e]
cmp byte [ecx], 0
jne 0x6d524417
push 0x104
add eax, 0xc
push eax
push ecx
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
jmp 0x6d524417
mov esi, dword [ebp - 0x314]
push esi
push dword [ebp - 0x7c]
push dword [ebp - 0x24]
call fcn.6d52393d
mov dword [ebp - 0x320], eax
test eax, eax
je 0x6d5242b7
mov ecx, dword [ebp + 0xc]
mov dword [ebx + 0x824], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 0x888], ecx
xor ecx, ecx
mov dword [ebx + 0x880], eax
mov dword [ebx + 0x884], ecx
push 0x28
lea edx, [ebx + 0x844]
push edx
push ecx
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.6d52362c
lea eax, [esi + 0x30]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x24]
call fcn.6d52393d
mov dword [ebp - 0x320], eax
test eax, eax
je 0x6d5242e0
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0x34]
xor edx, edx
push 0x1c
pop ecx
div ecx
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x31c]
add dword [ebp - 0x7c], 0x28
mov esi, dword [ebp - 0x78]
jmp 0x6d524138
mov ecx, dword [ebp - 0x1b8]
add eax, 0xc
push 0x104
push eax
test byte [ecx + 0x13], 2
lea eax, [ebx + 0x342]
jne 0x6d524313
lea eax, [ebx + 0x12e]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 0
push dword [ebp - 0x330]
push dword [ebx + 0x878]
call fcn.6d52358e
jmp 0x6d524417
cmp dword [ebp - 0x24], edi
je 0x6d52438d
cmp dword [ebp - 0x328], edi
je 0x6d52438d
push dword [ebp - 0x32c]
call fcn.6d522878
mov edi, eax
mov dword [ebp - 0x344], edi
test edi, edi
je 0x6d524417
push dword [ebp - 0x32c]
push edi
push 0
push dword [ebp - 0x328]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
call fcn.6d52362c
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x6d5243ae
push edi
call fcn.6d52288d
jmp 0x6d524417
mov eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x30]
jae 0x6d524417
mov ecx, dword [ebp - 0x2c]
lea edi, [ecx + eax]
mov dword [ebp - 0x344], edi
mov dword [ebx + 0x6fc], 1
mov dword [ebx + 0x680], edi
mov eax, dword [ebp - 0x32c]
mov dword [ebx + 0x6e4], eax
mov dword [ebx + 0x82c], esi
push dword [ebp - 0x34]
push ebx
call fcn.6d52397b
jmp 0x6d52431d
mov eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x30]
jae 0x6d52440d
mov ecx, dword [ebp - 0x2c]
add ecx, eax
mov dword [ebx + 0x684], ecx
mov eax, dword [ebp - 0x32c]
mov dword [ebx + 0x6e8], eax
xor eax, eax
inc eax
mov dword [ebx + 0x6f8], eax
mov dword [ebx + 0x828], esi
push esi
push edi
push eax
jmp 0x6d524326
mov dword [ebx + 0x86c], 1
mov ecx, dword [ebp - 0x324]
cmp ecx, dword [ebp - 0x30]
jae 0x6d5244e9
mov eax, dword [ebp - 0x330]
sub eax, 3
je 0x6d5244af
dec eax
dec eax
je 0x6d5244a2
dec eax
dec eax
je 0x6d524471
dec eax
jne 0x6d5244e9
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebx + 0x69c], eax
mov eax, dword [ebp - 0x32c]
shr eax, 3
mov dword [ebx + 0x6d0], eax
mov dword [ebx + 0x710], 1
mov dword [ebx + 0x83c], esi
push esi
push 0
push 8
jmp 0x6d5244de
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebx + 0x698], eax
mov eax, dword [ebp - 0x32c]
shr eax, 3
mov dword [ebx + 0x6cc], eax
mov dword [ebx + 0x70c], 1
mov dword [ebx + 0x838], esi
push esi
push 0
push 7
jmp 0x6d5244de
mov dword [ebx + 0x840], esi
push esi
push 0
push 5
jmp 0x6d5244de
mov eax, dword [ebp - 0x2c]
add eax, ecx
mov dword [ebx + 0x68c], eax
mov eax, dword [ebp - 0x32c]
shr eax, 4
mov dword [ebx + 0x6b8], eax
mov dword [ebx + 0x700], 1
mov dword [ebx + 0x834], esi
push esi
push 0
push 3
push dword [ebx + 0x878]
call fcn.6d52358e
add dword [ebp - 0x3c], 0x1c
dec dword [ebp - 0x20]
jmp 0x6d5241a3
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
call fcn.6d536aa5
ret 8