Function at 0x49a300
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c109b
push eax
mov dword fs:[0], esp
sub esp, 0x2b0
xor eax, eax
lea edx, [esp + 0x84]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 5
mov esi, str.DisplayDiagnoseData
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x14
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x94]
push ecx
push 0xffff
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
jne 0x49a38a
xor al, al
jmp 0x49a69c
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
mov dword [ebp], edx
jne 0x49a3a9
xor al, al
jmp 0x49a69c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x1f8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [ebp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.0049a770
push 0xffffffffffffffff
mov ecx, ebp
call fcn.0049a7b0
push 0
mov ecx, ebp
call fcn.0049a7b0
lea eax, [esp + 0x1c]
push eax
call fcn.0049cf80
add esp, 4
mov dword [esp + 0x2c8], 0
call fcn.0049cf70
fstp qword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x38]
push str._.2f
push eax
call fcn.004ad4e5
mov cl, byte [esp + 0x2c]
mov ebx, esp
xor esi, esi
mov dword [esp + 0x24], esp
mov byte [ebx], cl
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov ecx, dword [esp + 0x34]
mov eax, dword [0x4c21b8]
mov edi, ecx
cmp eax, edi
mov dword [esp + 0x20], edi
jae 0x49a474
mov dword [esp + 0x20], eax
mov edi, eax
lea edx, [esp + 0x2c]
cmp ebx, edx
jne 0x49a493
push eax
push edi
mov ecx, ebx
call fcn.004032c0
push esi
push esi
mov ecx, ebx
call fcn.004032c0
jmp 0x49a51b
cmp edi, esi
jbe 0x49a4df
cmp edi, ecx
jne 0x49a4df
mov eax, dword [esp + 0x30]
cmp eax, esi
jne 0x49a4a8
mov eax, 0x4c2190
cmp byte [eax - 1], 0xfe
jae 0x49a4df
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov eax, dword [esp + 0x30]
cmp eax, esi
jne 0x49a4c4
mov eax, 0x4c2190
mov dword [ebx + 4], eax
mov ecx, dword [esp + 0x34]
mov dword [ebx + 8], ecx
mov edx, dword [esp + 0x38]
mov dword [ebx + 0xc], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x49a51b
push 1
push edi
mov ecx, ebx
call fcn.00403400
test al, al
je 0x49a51b
mov eax, dword [esp + 0x30]
cmp eax, esi
mov esi, 0x4c2190
je 0x49a4fc
mov esi, eax
mov ecx, edi
mov edi, dword [ebx + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, ebx
call fcn.004033e0
mov ecx, ebp
call fcn.0049a810
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov ecx, ebp
call fcn.0049a7d0
mov ecx, ebp
call fcn.0049a6d0
mov ecx, ebp
call fcn.0049a760
mov esi, eax
or ecx, 0xffffffff
add esi, 4
xor eax, eax
mov edi, esi
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [ecx + esi + 1]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + ebx + 1]
or ecx, 0xffffffff
mov edi, edx
mov dword [esp + 0x14], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebp, [ecx + edx + 1]
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ecx, [ecx + ebp + 2]
mov byte [esp + 0x30], al
mov dword [esp + 0x18], ecx
call fcn.0049fdf0
push ebx
call fcn.0049fff0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xf8]
mov eax, ecx
mov esi, edi
mov edi, edx
xor edx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ecx
js 0x49a5f8
mov al, 0x5c
cmp byte [esp + ecx + 0xf8], al
jne 0x49a5f0
inc edx
cmp edx, 4
je 0x49a5f8
dec ecx
jns 0x49a5e6
mov byte [esp + ecx + 0xf9], 0
lea ecx, [esp + 0xf8]
push ecx
call fcn.0049fbf0
mov edx, dword [esp + 0x14]
push edx
call fcn.004a01f0
add esp, 8
mov eax, 0x4dd398
mov dl, byte [ebp]
mov bl, byte [eax]
mov cl, dl
cmp dl, bl
jne 0x49a648
test cl, cl
je 0x49a644
mov dl, byte [ebp + 1]
mov bl, byte [eax + 1]
mov cl, dl
cmp dl, bl
jne 0x49a648
add ebp, 2
add eax, 2
test cl, cl
jne 0x49a61f
xor eax, eax
jmp 0x49a64d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x49a655
push 1
jmp 0x49a657
push 0
call fcn.004a02b0
mov eax, dword [esp + 0x30]
add esp, 4
push eax
call fcn.004a0410
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004a0420
mov ecx, dword [esp + 0x28]
add esp, 8
test ecx, ecx
je 0x49a69a
mov al, byte [ecx - 1]
test al, al
je 0x49a690
cmp al, 0xff
je 0x49a690
dec al
mov byte [ecx - 1], al
jmp 0x49a69a
dec ecx
push ecx
call fcn.004ac910
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x2c0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2bc
ret