Function at 0x411fd4
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
cmp byte [0x71deb0], 0
jne 0x412252
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + str.0123456789ABCDEF]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
mov ecx, 8
sub ecx, eax
mov byte [ecx + 0x7093e1], dl
mov byte [ecx + 0x7093f5], dl
inc eax
cmp eax, 8
jne 0x411fed
push str._________PID_FastMM
push 0x412258
call sub.user32.dll_FindWindowA
mov dword [0x71dea4], eax
push str._________PID_FastMM_BE
push 0x412258
call sub.user32.dll_FindWindowA
mov dword [0x71dea8], eax
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x71deac], eax
mov eax, dword [0x71dea4]
or eax, dword [0x71dea8]
or eax, dword [0x71deac]
jne 0x4121a1
mov eax, dword [0x7171e8]
cmp byte [eax], 0
jne 0x412159
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x71bc50]
push eax
push 0
mov edx, str._________PID_FastMM
mov eax, 0x412258
mov ecx, 0x80000000
call fcn.00410cf0
mov dword [0x71dea4], eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x71bc50]
push eax
push 0
mov edx, str._________PID_FastMM_BE
mov eax, 0x412258
mov ecx, 0x80000000
call fcn.00410cf0
mov dword [0x71dea8], eax
cmp dword [0x71dea4], 0
je 0x412101
mov eax, dword [0x71dea4]
mov edx, 0xffffffeb
mov ecx, 0x71de8c
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
cmp dword [0x71dea8], 0
je 0x412121
mov eax, dword [0x71dea8]
mov edx, 0xffffffeb
mov ecx, 0x71de8c
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x71deac], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x71deac]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x71de8c
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x71de8c], fcn.004115cc
mov dword [0x71de90], 0x4118dc
mov dword [0x71de94], 0x411a90
mov dword [0x71de98], 0x411d34
mov dword [0x71de9c], 0x411d7c
mov dword [0x71dea0], 0x411d80
mov byte [0x71deb1], 1
jmp 0x412237
cmp dword [0x71deac], 0
je 0x4121d5
push 0
push 0
push 0
push 4
mov eax, dword [0x71deac]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [eax]
mov esi, edx
mov edi, 0x71de8c
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x41221e
cmp dword [0x71dea4], 0
je 0x4121ff
mov eax, dword [0x71dea4]
mov edx, 0xffffffeb
push edx
push eax
call sub.user32.dll_GetWindowLongW
mov esi, eax
mov edi, 0x71de8c
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
jmp 0x41221e
mov eax, dword [0x71dea8]
mov edx, 0xffffffeb
push edx
push eax
call sub.user32.dll_GetWindowLongW
mov esi, eax
mov edi, 0x71de8c
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x71deac]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [0x71deac], eax
mov byte [0x71deb1], 0
mov eax, 0x71de74
call fcn.004049b4
mov eax, 0x71de8c
call fcn.004049c8
mov byte [0x71deb0], 1
pop edi
pop esi
pop ebx
ret