Function at 0x414de2
Capabilities:
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b8]
push ebx
mov ebx, dword [ebp + 0x3b0]
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x3bc]
xor esi, esi
cmp ebx, esi
mov dword [ebp - 0x80], eax
jne 0x414e27
mov eax, 0x80004003
jmp 0x41504b
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push 0x9c9c
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
push 4
lea eax, [ebp - 0x78]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x78], 0xc
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov dword [ebx + 0xc], eax
je 0x41503f
push esi
push esi
push esi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x41503f
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
mov dword [ebx + 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
mov dword [ebx], eax
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
mov dword [ebx + 4], eax
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x9c9c
push edi
push esi
mov dword [ebx + 8], eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
push 1
lea eax, [esi + 0x28]
push 0x1f0fff
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x41503f
cmp dword [esi + 0x28], edi
je 0x41503f
cmp dword [ebx], edi
je 0x41503f
cmp dword [ebx + 4], edi
je 0x41503f
cmp dword [ebx + 8], edi
je 0x41503f
mov dword [esi], 0x9c9c
mov dword [esi + 4], 0x20000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 4]
mov dword [esi + 0x18], eax
mov eax, dword [ebx]
mov dword [esi + 0x20], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x3b4]
cmp eax, edi
mov dword [esi + 0x14], eax
je 0x414f51
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esi + 0x10], eax
xor eax, eax
inc eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov ebx, 0x104
push ebx
lea eax, [esi + 0x258]
push eax
push edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x402740
lea eax, [esi + 0x460]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll_strncpy_s]
mov ebx, 0x206
push ebx
lea eax, [ebp - 0x6a]
push edi
push eax
mov word [ebp - 0x6c], di
call sub.MSVCR80.dll_memset
push ebx
lea eax, [ebp + 0x19e]
push edi
push eax
mov word [ebp + 0x19c], di
call sub.MSVCR80.dll_memset
add esp, 0x28
push dword [ebp - 0x80]
lea eax, [ebp + 0x19c]
push dword [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00414b26
lea eax, [ebp - 0x6c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x414fd9
mov ebx, dword [sym.imp.MSVCR80.dll_wcscpy_s]
sub eax, ecx
sar eax, 1
cmp eax, 1
jbe 0x415007
lea eax, [ebp - 0x6c]
push eax
lea eax, [esi + 0x9ac]
push 0x400
push eax
call ebx
add esp, 0xc
lea eax, [ebp + 0x19c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x415010
sub eax, edx
sar eax, 1
cmp eax, 1
jbe 0x41503b
lea eax, [ebp + 0x19c]
push eax
push 0x400
add esi, 0x11ac
push esi
call ebx
add esp, 0xc
xor eax, eax
jmp 0x41504a
push ebx
call fcn.004145ec
mov eax, 0x80004005
pop edi
mov ecx, dword [ebp + 0x3a4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x3a8
leave
ret 0x10