Function at 0x41b04431
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor ebx, ebx
push ebx
push 0x41b29454
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x41b086f3
push ebx
push 0xffffffffffffffff
push dword [0x41b28b40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x41b28f10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push 0x41b2945c
call esi
test eax, eax
je 0x41b0448c
push 0x41b28f10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
leave
ret
mov eax, dword [0x41b29428]
push edi
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x41b044d0
push dword [eax + 4]
push 0x41b280e8
call esi
xor ecx, ecx
cmp dword [0x41b280e8], eax
setne cl
mov eax, ecx
cmp eax, ebx
jne 0x41b0543a
mov eax, dword [0x41b29428]
cmp eax, ebx
je 0x41b044d0
mov eax, dword [eax + 8]
cmp dword [0x41b280f4], eax
jne 0x41b05b59
xor edi, edi
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b044f1
test dword [eax + 0x1c], 0x400000
je 0x41b044f1
cmp byte [eax + 0x19], 5
jae 0x41b10822
cmp dword [ebp - 0x10], ebx
jne 0x41b06216
cmp dword [ebp - 4], ebx
jne 0x41b06216
cmp edi, ebx
jne 0x41b06216
push ebx
push 0x41b2945c
call esi
pop edi
jmp 0x41b0447d
lea eax, [ebp - 8]
push eax
call fcn.41b05851
mov edi, eax
cmp dword [ebp - 8], ebx
jne 0x41b0bc00
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0547b
test dword [eax + 0x1c], 0x400000
je 0x41b0547b
cmp byte [eax + 0x19], 4
jb 0x41b0547b
push 0x41b03980
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.41b06b62
test eax, eax
jne 0x41b044b8
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.41b054c6
push dword [ebp - 8]
mov dword [ebp - 4], eax
push ebx
push dword [0x41b28b30]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], ebx
je 0x41b044b8
call fcn.41b03995
jmp 0x41b044b8
xor edi, edi
inc edi
mov dword [0x41b280f4], eax
jmp 0x41b044d2
call fcn.41b06233
cmp dword [ebp - 4], ebx
je 0x41b0450b
call fcn.41b08e12
jmp 0x41b0450b
call fcn.41b0582d
call fcn.41b0840b
cmp dword [0x41b29428], ebx
jne 0x41b08745
push 0x41b08760
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0x41b29424], eax
cmp eax, ebx
je 0x41b107ee
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x41b29428], eax
cmp eax, ebx
je 0x41b107d7
cmp dword [0x41b29424], ebx
je 0x41b107ee
call sub.MMDevAPI.DLL_Ordinal_3
call fcn.41b08793
push dword [0x41b28b40]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x41b04465
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b0bc2d
test dword [eax + 0x1c], 0x400000
je 0x41b0bc2d
cmp byte [eax + 0x19], 4
jb 0x41b0bc2d
push 0x41b03980
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
push edi
call fcn.41b0bc58
test eax, eax
jl 0x41b044b8
push 0x40000
push dword [0x41b282f0]
call fcn.41b054c6
mov dword [ebp - 4], eax
jmp 0x41b054ae
push dword [0x41b29424]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41b29424], ebx
jmp 0x41b08739
mov eax, dword [0x41b28b68]
cmp eax, 0x41b28b68
je 0x41b08745
test dword [eax + 0x1c], 0x400000
je 0x41b08745
push 0x41b03980
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b02941
jmp 0x41b08745
push edi
push 0x41b03980
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.41b0298a
jmp 0x41b044f1