Function at 0x101106a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, edx
xor ebx, ebx
inc ebx
mov ecx, dword [edi + 0x1c]
call fcn.1010ba80
mov esi, eax
test esi, esi
je 0x101108a2
and dword [esp + 0xc], 0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0xc]
jne 0x101106cf
sub ecx, edx
sar ecx, 1
inc ecx
lea ecx, [esi + ecx*2]
call fcn.1010ba80
test eax, eax
je 0x101107b8
mov ecx, dword [edi + 0x1c]
xor eax, eax
mov dword [esp + 0x20], eax
mov esi, eax
mov dword [esp + 0x24], eax
call fcn.1010ba80
mov edi, eax
test edi, edi
je 0x101107b0
xor eax, eax
push eax
push 0x100080
push 3
push eax
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x1011078a
xor edx, edx
lea ecx, [esp + 0x18]
push ecx
push edx
push edx
push eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x1011077a
test esi, esi
je 0x10110766
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x1011077e
mov eax, dword [esp + 0x18]
mov esi, edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
jmp 0x1011077e
xor eax, eax
mov ebx, eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1011078e
xor eax, eax
mov ebx, eax
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0xc]
jne 0x10110793
sub ecx, edx
sar ecx, 1
inc ecx
lea ecx, [edi + ecx*2]
test ebx, ebx
jne 0x10110700
test ebx, ebx
je 0x101108a2
test esi, esi
je 0x101108a2
xor eax, eax
push eax
push 0x100080
push 3
push eax
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x10110834
xor esi, esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x10110826
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10110826
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1011083e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0xc], 0xffffffff
jmp 0x10110838
mov edi, dword [esp + 0x14]
xor eax, eax
mov esi, eax
jmp 0x10110840
xor eax, eax
test esi, esi
je 0x101108a0
cmp edi, 2
jb 0x10110868
cmp byte [esi], 0xff
jne 0x10110868
cmp byte [esi + 1], 0xfe
jne 0x10110868
shr edi, 1
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 2]
lea edx, [edi - 1]
call fcn.101102f0
jmp 0x10110876
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.101104e3
mov ecx, dword [ebp + 8]
xor ebx, ebx
test eax, eax
setne bl
test ecx, ecx
je 0x10110888
mov dword [ecx], eax
jmp 0x10110893
test eax, eax
je 0x10110893
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.1010a14f
jmp 0x101108a2
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8