Function at 0x4134d0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x4b81f4]
xor eax, esp
mov dword [esp + 0x1c4], eax
push ebx
push esi
mov esi, dword [esp + 0x1d8]
push edi
mov edi, ecx
cmp dword [edi + 4], 0
mov ebx, edx
je 0x41350c
push str._rYeR
mov eax, ebx
call fcn.0040e730
add esp, 4
jmp 0x41378a
push ebp
test esi, esi
jne 0x413518
xor ebp, ebp
jmp 0x4135ba
push 6
push 0x4ad5e4
push esi
lea ebp, [esp + 0x1c]
call fcn.0046c53b
add esp, 0xc
test eax, eax
je 0x41355a
push 0x4ad5e4
mov eax, ebp
push 0xe2
push eax
call fcn.0046c680
push 0xc2
push esi
mov ecx, ebp
push 0xe2
push ecx
call fcn.0046eb9c
add esp, 0x1c
jmp 0x413572
push 0xc8
push esi
lea edx, [esp + 0x18]
push 0xe2
push edx
call fcn.0046c2c4
add esp, 0x10
xor eax, eax
mov word [esp + 0x1a0], ax
call fcn.0040c9f0
add eax, 0x4be
je 0x41359b
push eax
lea ecx, [esp + 0x14]
push 0xe2
push ecx
call fcn.0046eb1f
add esp, 0xc
call fcn.0040c9f0
add eax, 0x49c
je 0x4135ba
push eax
lea edx, [esp + 0x14]
push 0xe2
push edx
call fcn.0046eb1f
add esp, 0xc
xor esi, esi
test ebp, ebp
je 0x41366f
push ebp
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x41366f
mov dword [edi + 0xc], 2
mov ecx, dword [esp + 0x1e4]
push ecx
push 0
push 0
push 6
push esi
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x413787
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x413620
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x413635
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov eax, ebx
call fcn.0040e680
mov edi, esi
mov esi, eax
call fcn.0040f390
mov eax, ebx
call fcn.0040e680
test ebp, ebp
jne 0x41373b
push 0x4ae50c
push 0x4ad42c
mov edx, eax
call fcn.0040fd10
add esp, 8
xor al, al
jmp 0x413789
cmp byte [esp + 0x1dc], 0
je 0x4136eb
mov eax, dword [esp + 0x1e4]
push ebp
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x4136cd
call fcn.0040f360
test ebp, ebp
jne 0x4136a9
push 0x4ae49c
jmp 0x413659
mov esi, eax
push 0x4ae4b8
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 8
mov eax, ebp
call fcn.0040f4a0
xor al, al
jmp 0x413789
mov dword [edi + 0xc], 1
test ebp, ebp
je 0x4136eb
push 6
push esi
call fcn.00413b20
push 6
push esi
call fcn.00413b70
add esp, 0x10
test esi, esi
jne 0x4135e0
cmp byte [esp + 0x1dc], 0
jne 0x4135e0
call fcn.0040f360
test ebp, ebp
jne 0x413714
push 0x4ae4d4
jmp 0x413659
mov esi, eax
push 0x4ae4f0
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
push ebp
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
add esp, 0x10
xor al, al
jmp 0x413789
mov esi, eax
push str.Filemap
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
push ebp
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
push 0x4ae554
push 0x4ad42c
mov edx, esi
call fcn.0040fd10
mov edx, dword [esp + 0x1fc]
push edx
push 0x4adf24
mov edx, esi
call fcn.0040fd10
add esp, 0x20
xor al, al
jmp 0x413789
mov al, 1
pop ebp
mov ecx, dword [esp + 0x1d0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046b4eb
add esp, 0x1c8
ret 0xc