Function at 0x411860
Capabilities:
Create thread
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
mov eax, 0x4117a8
call fcn.00404bb4
xor eax, eax
push ebp
push 0x411b34
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
lea edx, [ebp - 0x40]
xor eax, eax
call fcn.00402730
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
call fcn.00406af0
lea eax, [ebp - 0x44]
mov edx, 0x411b4c
call fcn.00403af4
mov edx, dword [ebp - 0x44]
pop eax
call fcn.00405108
test al, al
je 0x411b04
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
call fcn.004067ec
lea eax, [ebp - 0x48]
call fcn.004051ec
mov eax, dword [ebp - 0x48]
mov edx, 0x4139a4
call fcn.00405138
mov eax, 0x413c50
mov edx, 0x4139a4
call fcn.00403a74
mov eax, 0x413c54
mov edx, 0x413b10
call fcn.00403a74
lea eax, [ebp - 0x4c]
push eax
mov ecx, 5
mov dx, 0x1995
mov eax, dword [0x413c50]
call fcn.0040525c
mov edx, dword [ebp - 0x4c]
mov eax, 0x413c50
call fcn.00403890
lea eax, [ebp - 0x50]
push eax
mov ecx, 5
mov dx, 0x1995
mov eax, dword [0x413c54]
call fcn.0040525c
mov edx, dword [ebp - 0x50]
mov eax, 0x413c54
call fcn.00403890
lea edx, [ebp - 0x54]
mov eax, dword [0x413c50]
call fcn.00405220
push dword [ebp - 0x54]
lea edx, [ebp - 0x58]
mov eax, dword [0x413c54]
call fcn.00405220
push dword [ebp - 0x58]
push 0x411b64
lea edx, [ebp - 0x5c]
mov eax, dword [0x413a48]
call fcn.00405004
push dword [ebp - 0x5c]
mov eax, 0x413c4c
mov edx, 4
call fcn.00403bac
mov eax, dword [0x413c4c]
call fcn.00403aec
cmp eax, 4
jge 0x4119f5
mov eax, 0x413c4c
mov edx, 0x411b70
call fcn.00403890
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
mov eax, dword [0x413c4c]
call fcn.00403cec
push eax
push 0
push 0
call fcn.00404cbc
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x411b04
push 0x4139a0
push 0
push 0
push 0x411264
push 0
push 0
call sub.kernel32.dll_CreateThread
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
lea ecx, [ebp - 0x60]
mov eax, dword [0x412800]
mov edx, 0xd
call fcn.004050a8
mov eax, dword [ebp - 0x60]
push eax
lea edx, [ebp - 0x64]
mov eax, dword [0x413a48]
call fcn.00405004
mov ecx, dword [ebp - 0x64]
mov eax, 0x413d60
pop edx
call fcn.00403b38
push 0x104
push 0x413c58
mov eax, dword [0x413650]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push 0x413c58
call sub.kernel32.dll_LoadLibraryA
mov eax, dword [0x413d60]
call fcn.00403cec
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x411b04
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x411ae9
push 1
push 1
push 0x12
mov eax, dword [esi]
push eax
call sub.user32.dll_PostThreadMessageA
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
push 2
push 1
call sub.user32.dll_GetWindowLongA
push 1
call sub.kernel32.dll_GetTapeStatus
call sub.kernel32.dll_SetFileApisToOEM
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411b3b
lea eax, [ebp - 0x64]
mov edx, 0xa
call fcn.00403860
ret