Function at 0x43ef20
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x50221b
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x5355a0]
xor eax, esp
mov dword [esp + 0x1d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5355a0]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1fc]
mov edi, ecx
mov esi, edx
call fcn.00441c30
test al, al
je 0x43ef90
mov dword [esp + 0x1c], str.CreateShareble
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.004456d0
mov ecx, eax
mov eax, str.CreateShareble
call fcn.00445b10
xor ebx, ebx
mov dword [esp + 0x1f4], ebx
cmp dword [edi + 4], ebx
je 0x43efe4
push str._rYeR
push ebp
call fcn.00433e60
add esp, 8
mov byte [esp + 0x1b], al
mov dword [esp + 0x1f4], 0xffffffff
call fcn.00441c30
test al, al
je 0x43efdb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.004456d0
cmp byte [eax], 0
je 0x43efdb
call fcn.00445bb0
mov al, byte [esp + 0x1b]
jmp 0x43f299
cmp esi, ebx
je 0x43f0a1
push 6
push 0x51f1a4
push esi
lea ebx, [esp + 0x2c]
call fcn.004c40b2
add esp, 0xc
test eax, eax
je 0x43f02e
push 0x51f1a4
mov eax, ebx
push 0xe2
push eax
call fcn.004c38b0
add esp, 0xc
push 0xc2
push esi
mov ecx, ebx
push 0xe2
push ecx
call fcn.004c6d2f
jmp 0x43f043
push 0xc8
push esi
lea edx, [esp + 0x28]
push 0xe2
push edx
call fcn.004c5747
xor eax, eax
add esp, 0x10
mov word [esp + 0x1b0], ax
cmp byte [esp + 0x204], al
je 0x43f078
call fcn.0043d5c0
add eax, 0x4be
je 0x43f078
push eax
lea ecx, [esp + 0x24]
push 0xe2
push ecx
call fcn.004c3833
add esp, 0xc
cmp byte [esp + 0x208], 0
je 0x43f0a1
call fcn.0043d5c0
add eax, 0x49c
je 0x43f0a1
push eax
lea edx, [esp + 0x24]
push 0xe2
push edx
call fcn.004c3833
add esp, 0xc
xor esi, esi
test ebx, ebx
je 0x43f151
push ebx
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
test esi, esi
je 0x43f151
mov dword [edi + 0xc], 2
mov ecx, dword [esp + 0x20c]
push ecx
push 0
push 0
push 6
push esi
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
test eax, eax
jne 0x43f26c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x43f107
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x43f11c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov ecx, ebp
call fcn.00433db0
mov edi, esi
mov esi, eax
call fcn.004345f0
mov ecx, ebp
call fcn.00433db0
test ebx, ebx
jne 0x43f21f
push 0x520ac4
push 0x51620c
mov edx, eax
call fcn.004351e0
add esp, 8
jmp 0x43f196
cmp byte [esp + 0x200], 0
je 0x43f1e5
mov eax, dword [esp + 0x20c]
push ebx
push eax
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x43f1c7
test ebx, ebx
jne 0x43f1b1
push 0x520a54
mov ebx, ebp
call fcn.004345c0
mov ecx, eax
call fcn.00434720
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1f4], 0xffffffff
call fcn.00441c00
xor al, al
jmp 0x43f299
push ebx
push 0x520a70
mov ebx, ebp
call fcn.004345c0
mov ecx, eax
call fcn.00434720
jmp 0x43f18f
mov dword [edi + 0xc], 1
test ebx, ebx
je 0x43f1e5
push 6
push esi
call fcn.0043fba0
push 6
push esi
call fcn.0043fbf0
add esp, 0x10
test esi, esi
jne 0x43f0c7
cmp byte [esp + 0x200], 0
jne 0x43f0c7
test ebx, ebx
jne 0x43f206
push 0x520a8c
jmp 0x43f188
push ebx
push 0x520aa8
mov ebx, ebp
call fcn.004345c0
mov ecx, eax
call fcn.00434720
jmp 0x43f18f
mov esi, eax
push 0x520ae8
push 0x51620c
mov edx, esi
call fcn.004351e0
push ebx
push 0x51620c
mov edx, esi
call fcn.004351e0
push 0x520b0c
push 0x51620c
mov edx, esi
call fcn.004351e0
mov edx, dword [esp + 0x224]
push edx
push 0x51f4c8
mov edx, esi
call fcn.004351e0
add esp, 0x20
jmp 0x43f196
mov dword [esp + 0x1f4], 0xffffffff
call fcn.00441c30
test al, al
je 0x43f297
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call fcn.004456d0
cmp byte [eax], 0
je 0x43f297
call fcn.00445bb0
mov al, 1
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.004c31a1
add esp, 0x1e4
ret 0x14