Function at 0x490d60
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
movzx eax, byte [rsp + 0x120]
mov r14, rdx
mov edx, dword [rdx + 8]
mov r12, rcx
mov byte [rsp + 0x4b], al
mov dword [rsp + 0x118], r9d
test edx, edx
je 0x490f83
mov rax, qword [r14]
xor ebp, ebp
mov r13, qword [rax]
cmp dword [r13 + 8], 1
jbe 0x490f74
mov rax, qword [sym.imp.KERNEL32.dll_OpenEventW]
movzx r15d, r8b
mov qword [rsp + 0x58], rax
nop dword [rax + rax]
mov rdx, qword [r13]
movzx eax, word [rdx]
lea r8d, [rax - 0x41]
lea ecx, [rax + 0x20]
cmp r8w, 0x19
cmovbe eax, ecx
cmp ax, 0x72
je 0x490fa0
mov edi, dword [rsp + 0x118]
mov edx, 2
xor esi, esi
mov eax, 2
cmp dword [r13 + 8], eax
jb 0x490fc8
add rdx, qword [r13]
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.00477fd0
mov rax, qword [r13]
movzx eax, word [rax + rsi]
cmp ax, 0x21
je 0x490fd5
cmp ax, 0x40
je 0x491010
cmp ax, 0x23
jne 0x4913eb
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.00478040
mov rcx, qword [rsp + 0x80]
mov edx, 0x3a
call fcn.00475c70
mov ebx, eax
test ebx, ebx
js 0x490f20
lea esi, [rbx + 1]
mov edx, 0x3a
movsxd r13, esi
add r13, r13
mov rcx, r13
add rcx, qword [rsp + 0x80]
call fcn.00475c70
test eax, eax
js 0x490f20
lea rcx, [rsp + 0x90]
add esi, eax
mov rax, qword [rsp + 0x80]
lea edx, [rsi + 1]
lea rdx, [rax + rdx*2]
call fcn.00477fd0
cmp esi, dword [rsp + 0x88]
jb 0x491340
mov rcx, qword [rsp + 0x80]
lea rsi, str.Unsupported_Map_data_size
add rcx, r13
cmp word [rcx], 0
jne 0x491125
xor edx, edx
mov r8, qword [rsp + 0x90]
mov ecx, 2
mov qword [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
mov qword [rsp + 0x70], rax
jne 0x491304
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x491304
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rcx, rax
jmp 0x49131b
mov rsi, qword [str.Incorrect_Map_command]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x490f39
call fcn.007da030
test rsi, rsi
jne 0x4913f2
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x490f51
call fcn.007da030
mov edx, dword [r14 + 8]
add ebp, 1
cmp ebp, edx
jae 0x491429
mov rcx, qword [r14]
mov eax, ebp
mov r13, qword [rcx + rax*8]
cmp dword [r13 + 8], 1
ja 0x490dc0
lea rsi, str.Too_short_switch
cmp ebp, edx
jne 0x49165e
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [rdx + 2]
cmp eax, 0x7f
jle 0x491360
mov eax, 3
xor edi, edi
cmp dword [r13 + 8], eax
mov edx, 4
mov esi, 2
jae 0x490dfd
mov edx, dword [r14 + 8]
lea rsi, str.Too_short_switch
jmp 0x490f7b
test edi, edi
movzx esi, byte [rsp + 0x4b]
je 0x4913e0
xor r9d, r9d
cmp edi, 1
jne 0x490ff6
mov rcx, rbx
call fcn.004aaf80
movzx r9d, al
mov dword [rsp + 0x20], esi
mov r8, rbx
mov edx, r15d
mov rcx, r12
call fcn.004abbe0
jmp 0x490f42
mov rbx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], 0
movzx r13d, byte [rsp + 0x4b]
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x38], rax
mov rcx, rbx
call fcn.004b0bf0
test al, al
je 0x49150c
mov r8d, dword [rsp + 0x128]
lea rax, [rsp + 0x70]
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.004a9fc0
test al, al
je 0x4914d7
mov esi, dword [rsp + 0x78]
xor ebx, ebx
test esi, esi
jne 0x4910b4
jmp 0x4914b9
xor r9d, r9d
cmp edi, 1
jne 0x491096
mov rcx, rsi
call fcn.004aaf80
movzx r9d, al
mov dword [rsp + 0x20], r13d
mov r8, rsi
mov edx, r15d
mov rcx, r12
call fcn.004abbe0
mov eax, dword [rsp + 0x78]
add ebx, 1
cmp eax, ebx
jbe 0x4910d0
mov rdx, qword [rsp + 0x70]
mov eax, ebx
test edi, edi
mov rsi, qword [rdx + rax*8]
jne 0x491082
mov r9d, 1
jmp 0x491096
test eax, eax
mov rcx, qword [rsp + 0x70]
je 0x491112
lea ebx, [rax - 1]
shl rbx, 3
mov rsi, qword [rcx + rbx]
test rsi, rsi
je 0x491108
mov rcx, qword [rsi]
test rcx, rcx
je 0x4910f6
call fcn.007da030
mov rcx, rsi
mov edx, 0x10
call fcn.007da070
mov rcx, qword [rsp + 0x70]
sub rbx, 8
cmp rbx, 0xfffffffffffffff8
jne 0x4910e0
test rcx, rcx
je 0x490f42
call fcn.007da030
jmp 0x490f42
lea rax, [rsp + 0xa0]
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.004aa4e0
mov r13d, eax
mov rax, qword [rsp + 0xa0]
movzx edx, word [rax]
lea eax, [r13 - 2]
cmp eax, 0x7ffffffe
ja 0x4912d0
test dx, dx
jne 0x4912d0
test r13b, 1
jne 0x4912d0
cmp ebx, dword [rsp + 0x88]
jb 0x4913a0
mov r8, qword [rsp + 0x80]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
mov qword [rsp + 0x40], rax
je 0x491496
mov eax, r13d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov qword [rsp + 0x50], rax
je 0x4914b0
mov rcx, qword [rsp + 0x38]
call fcn.00477f50
mov rax, qword [rsp + 0x50]
cmp word [rax], 0
jne 0x491430
shr r13d, 1
cmp r13d, 1
je 0x4914c3
lea rbx, [rax + 2]
mov rsi, rax
lea eax, [r13 - 2]
lea r13, [rsi + rax*2 + 4]
movzx eax, byte [rsp + 0x4b]
mov dword [rsp + 0x4c], eax
jmp 0x49126b
test edi, edi
je 0x491470
xor r9d, r9d
cmp edi, 1
jne 0x49122e
mov rcx, qword [rsp + 0x38]
call fcn.004aaf80
movzx r9d, al
mov eax, dword [rsp + 0x4c]
mov edx, r15d
mov rcx, r12
mov r8, qword [rsp + 0x38]
mov dword [rsp + 0x20], eax
call fcn.004abbe0
mov rcx, qword [rsp + 0xa0]
add rbx, 2
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0xa8], 0
cmp r13, rbx
mov word [rcx], r9w
je 0x4912b0
movzx esi, word [rbx]
test si, si
je 0x491210
mov eax, dword [rsp + 0xa8]
cmp dword [rsp + 0xac], eax
je 0x491480
mov rcx, qword [rsp + 0xa0]
lea edx, [rax + 1]
add rbx, 2
xor r8d, r8d
cmp r13, rbx
mov word [rcx + rax*2], si
mov eax, edx
mov word [rcx + rax*2], r8w
mov dword [rsp + 0xa8], edx
jne 0x49126b
lea rsi, str.Map_data_error
test edx, edx
mov eax, 0
cmove rsi, rax
jmp 0x49143f
xor edx, edx
mov ecx, 2
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], 0
mov r8, qword [rsp + 0x90]
lea rsi, str.Unsupported_Map_data_size
call rax
test rax, rax
mov qword [rsp + 0x70], rax
je 0x490ef9
lea rax, [rsp + 0x70]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.0047eae0
mov rcx, qword [rsp + 0x38]
call fcn.0047e9d0
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x490f27
call fcn.007da030
jmp 0x490f27
mov rcx, qword [rsp + 0x80]
xor r11d, r11d
mov dword [rsp + 0x88], esi
mov word [rcx + rsi*2], r11w
jmp 0x490eb9
lea rcx, [0x0080fc98]
movsx edx, al
call fcn.00475c30
test eax, eax
je 0x491410
cmp eax, 1
je 0x4913c0
test eax, eax
js 0x490fad
mov edx, 6
mov esi, 4
mov eax, 4
xor edi, edi
jmp 0x490df3
mov r8, qword [rsp + 0x80]
xor r10d, r10d
mov dword [rsp + 0x88], ebx
mov word [r8 + rbx*2], r10w
jmp 0x49117f
mov edx, 6
mov esi, 4
mov eax, 4
mov edi, 2
jmp 0x490df3
mov r9d, 1
jmp 0x490ff6
lea rsi, str.Incorrect_wildcard_type_marker
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x491401
call fcn.007da030
mov edx, dword [r14 + 8]
jmp 0x490f7b
mov edx, 6
mov esi, 4
mov eax, 4
mov edi, 1
jmp 0x490df3
xor esi, esi
jmp 0x490f7b
mov rcx, qword [rsp + 0xa0]
lea rsi, str.Unsupported_Map_data
test rcx, rcx
je 0x491449
call fcn.007da030
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x490ecd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x490ecd
mov r9d, 1
jmp 0x49122e
mov rcx, qword [rsp + 0x38]
call fcn.00477b00
mov eax, dword [rsp + 0xa8]
jmp 0x491287
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.Can_not_open_mapping
test eax, eax
jne 0x490ecd
jmp 0x49119a
lea rsi, str.MapViewOfFile_error
jmp 0x491454
mov rcx, qword [rsp + 0x70]
jmp 0x491112
mov edx, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
jmp 0x4912b0
mov ecx, 0x10
call fcn.007da1c0
lea rdx, str.Incorrect_item_in_listfile._nCheck_charset_encoding_and__scs_switch.
mov r8, rbx
mov rcx, rax
mov rsi, rax
call fcn.0048efc0
lea r8, [0x006b4bc0]
mov rcx, rsi
lea rdx, [0x00837e80]
call fcn.007da930
mov ecx, 0x10
call fcn.007da1c0
lea rdx, str.Cannot_find_listfile
mov r8, rbx
mov rcx, rax
mov rsi, rax
call fcn.0048efc0
lea rax, [rsp + 0x70]
mov rcx, rsi
lea r8, [0x006b4bc0]
mov qword [rsp + 0x38], rax
lea rdx, [0x00837e80]
call fcn.007da930
mov rcx, rsi
mov rbx, rax
call fcn.007da570
mov rcx, qword [rsp + 0x38]
call fcn.006b09c0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x49156f
call fcn.007da030
mov rcx, rbx
call fcn.0067d310
mov rcx, rsi
mov rbx, rax
call fcn.007da570
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rcx, rax
jmp 0x49155b
mov ecx, 0x10
call fcn.007da1c0
mov rdx, rsi
mov rbx, rax
mov rax, qword [r14]
mov rcx, rbx
mov rax, qword [rax + rbp*8]
mov r8, qword [rax]
call fcn.0048efc0
lea r8, [0x006b4bc0]
mov rcx, rbx
lea rdx, [0x00837e80]
call fcn.007da930
mov rbx, rax
mov rcx, qword [rsp + 0x38]
jmp 0x49155b