Function at 0x401c40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 2
jne 0x401d4c
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00401b60
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x401cb5
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c7fad
add esp, 4
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00401a10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x401d47
mov eax, dword [ebp - 4]
push eax
call fcn.004c7fad
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00401b60
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
push 4
mov ecx, dword [ebp - 0xc]
add ecx, 0x14
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x401d47
mov ecx, dword [ebp - 4]
push ecx
call fcn.004c7fad
add esp, 4
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00401a10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
push 0
push 4
mov edx, dword [ebp - 0xc]
add edx, 0x14
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x401dcd
cmp dword [ebp + 8], 1
jne 0x401d65
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00401a10
mov dword [ebp - 4], eax
jmp 0x401d8f
cmp dword [ebp + 8], 3
jne 0x401d80
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00401a10
mov dword [ebp - 4], eax
jmp 0x401d8f
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.00401b60
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x401dcd
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
push 0
push 4
mov edx, dword [ebp - 0xc]
add edx, 0x14
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x401e3e
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
push 0
push 0
push 6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401e3e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
add eax, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
cmp dword [eax], 0x12345678
je 0x401e3e
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call fcn.004ce490
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [edx], 0x12345678
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x401eb3
mov edx, dword [ebp - 4]
add edx, 0xffffffff
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov cl, byte [eax + 1]
mov byte [ebp - 0x11], cl
add dword [ebp - 0x10], 1
cmp byte [ebp - 0x11], 0
jne 0x401e52
mov edi, dword [ebp - 0x10]
mov edx, dword [str._Eve]
mov dword [edi], edx
mov al, byte [0x5f07bc]
mov byte [edi + 4], al
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0xc], 0
jne 0x401eb3
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xc]
add edx, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc], eax
cmp dword [ebp - 4], 0
je 0x401ec5
mov edx, dword [ebp - 4]
push edx
call fcn.004c7fad
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret 0x10