Function at 0x411146
Capabilities:
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x415010]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b8]
push ebx
mov ebx, dword [ebp + 0x3b0]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x3bc]
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x80], eax
jne 0x41118b
mov eax, 0x80004003
jmp 0x4113af
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push 0x9c9c
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push 4
lea eax, [ebp - 0x78]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x78], 0xc
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebx + 0xc], eax
je 0x4113a3
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x4113a3
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
mov dword [ebx + 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
mov dword [ebx], eax
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
mov dword [ebx + 4], eax
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x9c9c
push edi
push esi
mov dword [ebx + 8], eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 1
lea eax, [esi + 0x28]
push 0x1f0fff
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4113a3
cmp dword [esi + 0x28], edi
je 0x4113a3
cmp dword [ebx], edi
je 0x4113a3
cmp dword [ebx + 4], edi
je 0x4113a3
cmp dword [ebx + 8], edi
je 0x4113a3
mov dword [esi], 0x9c9c
mov dword [esi + 4], 0x20000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebx]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x3b4]
cmp eax, edi
mov dword [esi + 0x14], eax
je 0x4112b5
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x10], eax
xor eax, eax
inc eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov ebx, 0x104
push ebx
lea eax, [esi + 0x258]
push eax
push edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x402a08
lea eax, [esi + 0x460]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll_strncpy_s]
mov ebx, 0x206
push ebx
lea eax, [ebp - 0x6a]
push edi
push eax
mov word [ebp - 0x6c], di
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp + 0x19e]
push edi
push eax
mov word [ebp + 0x19c], di
call sub.MSVCR80.dll_memset
add esp, 0x28
push dword [ebp - 0x80]
lea eax, [ebp + 0x19c]
push dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00410e8a
lea eax, [ebp - 0x6c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x41133d
mov ebx, dword [sym.imp.MSVCR80.dll_wcscpy_s]
sub eax, ecx
sar eax, 1
cmp eax, 1
jbe 0x41136b
lea eax, [ebp - 0x6c]
push eax
lea eax, [esi + 0x9ac]
push 0x400
push eax
call ebx
add esp, 0xc
lea eax, [ebp + 0x19c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x411374
sub eax, edx
sar eax, 1
cmp eax, 1
jbe 0x41139f
lea eax, [ebp + 0x19c]
push eax
push 0x400
add esi, 0x11ac
push esi
call ebx
add esp, 0xc
xor eax, eax
jmp 0x4113ae
push ebx
call fcn.00410950
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp + 0x3a4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fdc4
add ebp, 0x3a8
leave
ret 0x10