Function at 0x69009ea0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
cmp byte [0x69162a4c], 0
jne 0x6900a10c
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + 0x6914e7c4]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
mov ecx, 8
sub ecx, eax
mov byte [ecx + 0x6914eef3], dl
mov byte [ecx + 0x6914ef07], dl
inc eax
cmp eax, 8
jne 0x69009eb9
push str._________PID_FastMM
push 0x6900a110
call sub.user32.dll_FindWindowA
mov dword [0x69162a40], eax
push str._________PID_FastMM_BE
push 0x6900a110
call sub.user32.dll_FindWindowA
mov dword [0x69162a44], eax
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x69162a48], eax
mov eax, dword [0x69162a40]
or eax, dword [0x69162a44]
or eax, dword [0x69162a48]
jne 0x6900a063
mov eax, dword [0x6915d5d8]
cmp byte [eax], 0
jne 0x6900a01b
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x691607f8]
push eax
push 0
mov edx, str._________PID_FastMM
mov eax, 0x6900a110
mov ecx, 0x80000000
call fcn.690088f4
mov dword [0x69162a40], eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x691607f8]
push eax
push 0
mov edx, str._________PID_FastMM_BE
mov eax, 0x6900a110
mov ecx, 0x80000000
call fcn.690088f4
mov dword [0x69162a44], eax
cmp dword [0x69162a40], 0
je 0x69009fc8
push 0x69162a28
push 0xffffffffffffffeb
mov eax, dword [0x69162a40]
push eax
call sub.user32.dll_SetWindowLongA
cmp dword [0x69162a44], 0
je 0x69009fe3
push 0x69162a28
push 0xffffffffffffffeb
mov eax, dword [0x69162a44]
push eax
call sub.user32.dll_SetWindowLongA
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x69162a48], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x69162a48]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x69162a28
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x69162a28], fcn.69009134
mov dword [0x69162a2c], 0x69009418
mov dword [0x69162a30], 0x69009598
mov dword [0x69162a34], 0x69009828
mov dword [0x69162a38], 0x6900985c
mov dword [0x69162a3c], 0x69009860
mov byte [0x69162a4d], 1
jmp 0x6900a0f1
cmp dword [0x69162a48], 0
je 0x6900a097
push 0
push 0
push 0
push 4
mov eax, dword [0x69162a48]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [eax]
mov esi, edx
mov edi, 0x69162a28
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x6900a0d8
cmp dword [0x69162a40], 0
je 0x6900a0bd
push 0xffffffffffffffeb
mov eax, dword [0x69162a40]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov edi, 0x69162a28
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
jmp 0x6900a0d8
push 0xffffffffffffffeb
mov eax, dword [0x69162a44]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov edi, 0x69162a28
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x69162a48]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x69162a48], eax
mov byte [0x69162a4d], 0
mov eax, 0x69162a10
call fcn.69003334
mov eax, 0x69162a28
call fcn.69003348
mov byte [0x69162a4c], 1
pop edi
pop esi
pop ebx
ret