Function at 0x424850
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4c962b
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x1e8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1f8]
mov ebx, ecx
mov dword [esp + 0x18], eax
mov esi, edx
call fcn.00436e80
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test al, al
je 0x4248ce
mov dword [esp + 0x14], str.CreateShareble
call ebp
mov edi, eax
call fcn.00442230
push edi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.CreateShareble
call fcn.00441d20
xor edi, edi
mov dword [esp + 0x1f0], edi
cmp dword [ebx + 4], edi
je 0x424926
mov ecx, dword [esp + 0x18]
push str._rYeR
push ecx
call fcn.0042ca40
add esp, 8
mov bl, al
mov dword [esp + 0x1f0], 0xffffffff
call fcn.00436e80
test al, al
je 0x42491f
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
cmp byte [eax], 0
je 0x42491f
call fcn.00441dd0
mov al, bl
jmp 0x424bdd
cmp esi, edi
jne 0x424931
xor ebp, ebp
jmp 0x4249e0
push 6
push str.Local_
push esi
lea ebp, [esp + 0x28]
call fcn.004a6e24
add esp, 0xc
test eax, eax
je 0x424973
push str.Local_
mov edx, ebp
push 0xe2
push edx
call fcn.004a575e
add esp, 0xc
push 0xc2
push esi
mov eax, ebp
push 0xe2
push eax
call fcn.004a8374
jmp 0x424988
push 0xc8
push esi
lea ecx, [esp + 0x24]
push 0xe2
push ecx
call fcn.004a5f71
xor edx, edx
add esp, 0x10
mov word [esp + 0x1ac], dx
cmp byte [esp + 0x200], dl
je 0x4249bf
call fcn.00428f90
add eax, 0x4be
cmp eax, edi
je 0x4249bf
push eax
lea eax, [esp + 0x20]
push 0xe2
push eax
call fcn.004a58e6
add esp, 0xc
call fcn.00428f90
add eax, 0x49c
cmp eax, edi
je 0x4249e0
push eax
lea ecx, [esp + 0x20]
push 0xe2
push ecx
call fcn.004a58e6
add esp, 0xc
call fcn.00428f90
xor eax, eax
cmp ebp, edi
je 0x424aa9
push ebp
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, edi
je 0x424aa9
mov dword [ebx + 0xc], 2
or esi, 0xffffffff
mov ecx, dword [esp + 0x204]
push ecx
push edi
push edi
push 6
push eax
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 8], eax
cmp eax, edi
jne 0x424bcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x424a46
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx + 8], edi
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x424a57
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 4], edi
mov ebx, dword [esp + 0x18]
mov ecx, ebx
call fcn.0042c990
cmp ebp, edi
mov edi, esi
mov esi, eax
jne 0x424b5f
call fcn.0042cad0
mov ecx, ebx
call fcn.0042c990
push 0x4f0758
push 0x4f0ffc
mov edx, eax
call fcn.00430eb0
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x1f0], 0xffffffff
call fcn.00436e50
xor al, al
jmp 0x424bdd
cmp byte [esp + 0x1fc], 0
je 0x424b23
mov edx, dword [esp + 0x204]
push ebp
push edx
push edi
push 0x8000004
call fcn.004317b0
push eax
or esi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
jne 0x424b1a
mov ecx, dword [esp + 0x18]
cmp ebp, edi
jne 0x424b06
push 0x4f06e8
call fcn.0042caa0
mov ecx, eax
call fcn.0042cc20
lea ecx, [esp + 0x14]
mov dword [esp + 0x1f0], esi
call fcn.00436e50
xor al, al
jmp 0x424bdd
push ebp
push 0x4f0704
call fcn.0042caa0
mov ecx, eax
call fcn.0042cc20
jmp 0x424ae8
mov dword [ebx + 0xc], 1
jmp 0x424b26
or esi, 0xffffffff
cmp eax, edi
jne 0x424a0c
cmp byte [esp + 0x1fc], 0
jne 0x424a0c
mov ecx, dword [esp + 0x18]
cmp ebp, edi
jne 0x424b4b
push 0x4f0720
jmp 0x424ae3
push ebp
push 0x4f073c
call fcn.0042caa0
mov ecx, eax
call fcn.0042cc20
jmp 0x424ae8
call fcn.0042cad0
mov ecx, ebx
call fcn.0042c990
mov esi, eax
push str.Filemap
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push ebp
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push 0x4f07a0
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
mov edx, dword [esp + 0x21c]
push edx
push 0x4f2bbc
mov edx, esi
call fcn.00430eb0
add esp, 0x20
lea ecx, [esp + 0x14]
mov dword [esp + 0x1f0], 0xffffffff
call fcn.00436e50
xor al, al
jmp 0x424bdd
lea ecx, [esp + 0x14]
mov dword [esp + 0x1f0], esi
call fcn.00436e50
mov al, 1
mov ecx, dword [esp + 0x1e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.004a4a25
add esp, 0x1e0
ret 0x10