Function at 0x40edca
Capabilities:
Read file via mapping

Disassembly:
push 0x2b8
push 0x420690
call fcn.004204d4
mov dword [ebp - 0x2a0], edx
mov esi, ecx
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x2b8], esi
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x2b4], edi
mov dword [ebp - 0x2b0], edi
mov dword [ebp - 0x280], edi
push 0x34
push edi
lea eax, [ebp - 0x50]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x2ac], edi
mov eax, edi
mov dword [ebp - 0x27c], eax
call fcn.0041ca2d
push 0x218
push edi
lea eax, [ebp - 0x268]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [esi]
call dword [sym.imp.api_ms_win_shcore_path_l1_1_0.dll_Ordinal_170]
mov dword [ebp - 0x264], eax
push dword [esi]
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindExtensionW]
mov dword [ebp - 0x260], eax
mov eax, dword [0x421cc0]
cmp eax, 0xffffffff
jne 0x40ee6c
mov ecx, dword [esi]
call fcn.0040f81b
jmp 0x40f6d1
lea ecx, [ebp - 0x50]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileInformationByHandle]
mov esi, eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
lea edx, [ebp - 0x25c]
mov ecx, dword [ebp - 0x288]
mov ecx, dword [ecx]
call fcn.0040ed48
test esi, esi
jne 0x40eeb1
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax]
call fcn.0040f81b
jmp 0x40f6be
cmp dword [ebp - 0x26c], 0x40000000
jae 0x40f69d
cmp dword [ebp - 0x30], ebx
jne 0x40f69d
push dword [0x421dc8]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax]
call fcn.0040f8ac
test eax, eax
je 0x40f6d1
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x40ef4a
mov esi, edi
mov dword [ebp - 0x2a4], esi
push edi
push eax
push edi
push 2
push edi
push dword [0x421cc0]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov ecx, eax
mov dword [ebp - 0x290], ecx
test ecx, ecx
je 0x40ef5f
push dword [ebp - 0x26c]
push edi
push edi
push 4
pop eax
mov dword [ebp - 0x270], eax
push eax
push ecx
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x2a4], esi
push dword [ebp - 0x290]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x40ef69
lea esi, [ebp - 0x2a8]
mov dword [ebp - 0x2a4], esi
xor eax, eax
mov word [ebp - 0x2a8], ax
mov dword [ebp - 0x270], 4
push dword [0x421cc0]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
or dword [0x421cc0], 0xffffffff
test esi, esi
jne 0x40ef99
push dword [0x421dcc]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x288]
mov ecx, dword [eax]
jmp 0x40ee62
mov dword [ebp - 4], edi
mov edx, esi
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0x2a0]
test eax, eax
jne 0x40f126
movzx eax, word [esi]
mov ecx, 0xbbef
cmp ax, cx
je 0x40f007
mov edx, 0xfeff
cmp ax, dx
je 0x40f003
mov ecx, 0xfffe
movzx eax, word [esi]
cmp ax, cx
jne 0x40f038
push 3
xor eax, eax
inc eax
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x280], eax
pop eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
mov ebx, eax
shr ebx, 1
jmp 0x40f2c9
push 2
jmp 0x40efd8
mov eax, dword [ebp - 0x26c]
cmp eax, 2
jbe 0x40f03e
cmp byte [esi + 2], 0xbf
jne 0x40f03e
mov ecx, 0xfde9
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x278], 4
jmp 0x40f237
mov eax, dword [ebp - 0x26c]
mov edx, eax
mov ecx, esi
call fcn.0041d44d
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x298], eax
test eax, eax
je 0x40f075
push 2
pop eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
mov ebx, eax
shr ebx, 1
jmp 0x40f2ca
push edi
push edi
push dword [ebp - 0x26c]
push esi
push 8
mov eax, 0xfde9
mov dword [ebp - 0x27c], eax
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
test eax, eax
jne 0x40f0cb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x459
jne 0x40f0cb
xor eax, eax
inc eax
mov dword [ebp - 0x278], eax
mov ecx, edi
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x294], ecx
mov eax, dword [ebp - 0x26c]
jmp 0x40f2d2
test byte [0x421c8c], 0x30
jne 0x40f0d9
call fcn.0040d715
xor eax, eax
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 0x29c], 3
mov dword [ebp - 0x2c0], eax
mov ax, word [ebp - 0x29c]
mov word [ebp - 0x2bc], ax
sub esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
mov edx, 0x127655e
mov ecx, 0x421c8c
call fcn.0040e37a
push 5
pop eax
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x27c]
jmp 0x40f0b4
dec eax
sub eax, 1
je 0x40f291
sub eax, 1
je 0x40f24e
sub eax, 1
je 0x40f1ea
sub eax, 1
je 0x40f16f
xor eax, eax
inc eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov ecx, edi
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x294], ecx
mov eax, dword [ebp - 0x26c]
jmp 0x40f2d8
mov eax, 0xfde9
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x294], eax
test byte [0x421c8c], 0x30
jne 0x40f18e
call fcn.0040d715
xor eax, eax
mov dword [ebp - 0x290], eax
mov byte [ebp - 0x28c], 3
mov dword [ebp - 0x2c8], eax
mov ax, word [ebp - 0x28c]
mov word [ebp - 0x2c4], ax
sub esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
mov edx, 0x127655e
mov ecx, 0x421c8c
call fcn.0040e37a
push 5
pop eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x27c]
jmp 0x40f2d2
mov ecx, 0xfde9
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x294], ecx
push 4
pop eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
cmp eax, 2
jbe 0x40f2d8
mov ecx, 0xbbef
cmp word [esi], cx
mov ecx, dword [ebp - 0x27c]
jne 0x40f2d8
cmp byte [esi + 2], 0xbf
jne 0x40f2d8
lea edx, [esi + 3]
mov dword [ebp - 0x274], edx
sub eax, 3
mov dword [ebp - 0x26c], eax
jmp 0x40f2d8
xor eax, eax
inc eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x298], eax
push 3
pop eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
mov ebx, eax
shr ebx, 1
mov dword [ebp - 0x284], ebx
mov ecx, 0xfffe
cmp word [esi], cx
mov ecx, edi
jne 0x40f2d8
dec ebx
mov dword [ebp - 0x284], ebx
jmp 0x40f2d8
xor eax, eax
inc eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x298], eax
push 2
pop eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x26c]
mov ebx, eax
shr ebx, 1
mov dword [ebp - 0x284], ebx
mov edx, 0xfeff
cmp word [esi], dx
jne 0x40f2d0
dec ebx
mov dword [ebp - 0x284], ebx
mov ecx, edi
mov edx, dword [ebp - 0x274]
cmp dword [ebp - 0x280], 0
jne 0x40f2f5
push edi
push edi
push eax
push edx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ebx, eax
mov dword [ebp - 0x284], ebx
push edi
push edi
push 0xb
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0xb1
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0xb7
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
lea eax, [ebx*2 + 2]
push eax
push dword [0x421dd0]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalReAlloc]
mov dword [ebp - 0x2ac], eax
test eax, eax
jne 0x40f3c6
push dword [ebp - 0x288]
lea ecx, [ebp - 0x280]
call fcn.0040de9b
xor ecx, ecx
call fcn.0040f6e3
push dword [0x421dcc]
call dword [sym.imp.USER32.dll_SetCursor]
push 0x30
push dword [ebp - 0x280]
push dword [0x421224]
mov edx, dword [0x421220]
mov ecx, dword [0x422c94]
call fcn.0040cf46
lea eax, [ebp - 0x2a8]
cmp esi, eax
je 0x40f39f
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
push edi
push edi
push 0xb
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x280]
call fcn.0040e47d
mov dword [ebp - 4], 0xfffffffe
jmp 0x40f6d1
push dword [ebp - 0x2ac]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalLock]
mov ecx, eax
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x2b4], ecx
cmp dword [ebp - 0x280], 0
je 0x40f425
movzx edx, word [esi]
mov eax, 0xfeff
cmp dx, ax
jne 0x40f400
lea eax, [ebx + ebx]
push eax
lea eax, [esi + 2]
push eax
jmp 0x40f41a
mov eax, 0xfffe
cmp dx, ax
jne 0x40f415
push ebx
lea edx, [esi + 2]
call fcn.0040e65b
jmp 0x40f449
lea eax, [ebx + ebx]
push eax
push esi
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40f449
push ebx
push ecx
push dword [ebp - 0x26c]
push dword [ebp - 0x274]
push edi
mov eax, dword [ebp - 0x27c]
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ebx, eax
mov dword [ebp - 0x284], ebx
mov eax, dword [ebp - 0x270]
mov dword [0x421d4c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x40f4b1
lea eax, [ebp - 0x2a8]
cmp esi, eax
je 0x40f4c2
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x290]
test ecx, ecx
je 0x40f51e
mov eax, ecx
test ebx, ebx
je 0x40f4e7
mov edx, ebx
cmp word [eax], di
jne 0x40f4df
push 0x20
pop esi
mov word [eax], si
add eax, 2
sub edx, 1
jne 0x40f4d4
xor eax, eax
mov word [ecx + ebx*2], ax
movzx eax, word [ecx]
cmp eax, 0x2e
jne 0x40f518
movzx eax, word [ecx + 2]
cmp eax, 0x4c
jne 0x40f518
movzx eax, word [ecx + 4]
cmp eax, 0x4f
jne 0x40f518
cmp word [ecx + 6], 0x47
mov dword [ebp - 0x2b0], 1
je 0x40f51e
mov dword [ebp - 0x2b0], edi
mov esi, dword [ebp - 0x2ac]
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalUnlock]
mov dword [0x421dd0], esi
mov ecx, 0x422800
mov esi, dword [ebp - 0x288]
cmp esi, ecx
je 0x40f549
push dword [esi]
call fcn.0040d536
mov dword [esi], edi
mov cl, 1
call fcn.0040caa8
mov dword [0x421244], edi
mov dword [0x422a80], 1
push edi
push dword [0x421dd0]
push 0xbc
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x422a80], 2
jne 0x40f5cb
push dword [0x421dcc]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x422a80], edi
push 0x30
push dword [esi]
push dword [0x421224]
mov edx, dword [0x421220]
mov ecx, dword [0x422c94]
call fcn.0040cf46
xor ecx, ecx
call fcn.0040f6e3
push edi
push 1
push 0xb
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40f6d1
mov dword [0x422a80], edi
push edi
push edi
push 0xc5
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x2b0], 0
je 0x40f61b
push ebx
push ebx
push 0xb1
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push edi
push 0xb7
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
inc ecx
call fcn.0040e4f1
push 1
push edi
push 0xbe
push 0x115
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push dword [0x422c94]
call dword [sym.imp.USER32.dll_SetScrollPos]
push edi
push 1
push 0xb
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push edi
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0040c567
push dword [0x421dcc]
call dword [sym.imp.USER32.dll_SetCursor]
push dword [0x422800]
push 3
call dword [sym.imp.SHELL32.dll_SHAddToRecentDocs]
lea ecx, [ebp - 0x268]
call fcn.0041cabe
mov al, 1
jmp 0x40f6d3
push 0x30
mov eax, dword [ebp - 0x288]
push dword [eax]
push dword [0x421224]
mov edx, dword [0x421220]
mov ecx, dword [0x422c94]
call fcn.0040cf46
push dword [0x421cc0]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
or dword [0x421cc0], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret