Function at 0x478ba0
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4bba98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
mov dword [esp + 0x1c], ebx
jne 0x478c0a
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
call fcn.00420716
pop edi
pop esi
mov eax, 0x80000020
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esp + 0x24], eax
cmp eax, ebx
jne 0x478c56
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.00420716
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00420716
pop edi
pop esi
mov eax, 0x80000026
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
jne 0x478cb6
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.0047a550
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x478c92
push eax
call esi
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x478c9d
push eax
call esi
pop edi
pop esi
mov eax, 0x80000026
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
push ebx
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x478d1a
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x478ce1
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x478cf6
push eax
call esi
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x478d79
push eax
call esi
pop edi
pop esi
mov eax, 0x80000022
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
push str.gUrUaLuZ
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 0xfffffffc
mov ecx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [esp + 0xc]
add esi, edx
push ebx
push ebx
mov eax, dword [esi + eax]
sub esi, eax
push esi
push ecx
call edi
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
jne 0x478d92
cmp eax, ebx
je 0x478d59
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x478d6e
push eax
call esi
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x478d79
push eax
call esi
pop edi
pop esi
mov eax, 0x80000022
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp eax, ebx
je 0x478da3
push eax
call edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x478db8
push eax
call esi
mov dword [esp + 0x24], ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x478e09
cmp eax, ebx
je 0x478dd6
push eax
call edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x478de5
push eax
call esi
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x478df0
push eax
call esi
pop edi
pop esi
mov eax, 0x80000025
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
cmp eax, ebx
je 0x478e14
push eax
call edi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x478e23
push eax
call esi
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x478e2e
push eax
call esi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8