Function at 0x4efb88
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4efb90
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x4efba7
add esp, 0xfffffff0
call fcn.004058d4
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4f0104
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi + 0x190], eax
lea eax, [edi + 0x168]
xor ecx, ecx
mov edx, 0x25
call fcn.00404e90
mov dword [edi + 0x168], 0x66554433
lea eax, [edi + 0x40]
xor ecx, ecx
mov edx, 0xa
call fcn.00404e90
lea eax, [edi + 0x4a]
xor ecx, ecx
mov edx, 0x60
call fcn.00404e90
lea eax, [edi + 0xb2]
xor ecx, ecx
mov edx, 0x14
call fcn.00404e90
lea eax, [edi + 0xaa]
xor ecx, ecx
mov edx, 8
call fcn.00404e90
lea eax, [edi + 0xc6]
xor ecx, ecx
mov edx, 0x64
call fcn.00404e90
lea eax, [edi + 0x12a]
xor ecx, ecx
mov edx, 0x34
call fcn.00404e90
mov ecx, 3
mov edx, 1
mov eax, 1
call fcn.004dc158
mov dword [0x539598], eax
mov eax, dword [0x539598]
mov dword [edi + 0x40], eax
mov word [edi + 0x44], 0
xor eax, eax
mov dword [edi + 0x46], eax
push 0
lea eax, [edi + 0x40]
push eax
push 0
push 0
call sub.xvidcore.dll_xvid_global
add esp, 0x10
xor eax, eax
mov dword [edi + 0x388], eax
mov eax, dword [ebp - 4]
call fcn.0040b57c
test al, al
je 0x4efcaa
mov edx, 0x42
mov eax, dword [ebp - 4]
call fcn.0040b428
mov dword [edi + 0x388], eax
jmp 0x4efcd0
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.0040696c
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [edi + 0x388], eax
mov byte [edi + 0x394], 0
mov dword [edi + 0x390], 0x14
mov dl, 1
mov eax, dword [0x41ab4c]
call fcn.00405580
mov dword [edi + 0x36c], eax
lea eax, [edi + 0x3b4]
push eax
call sub.kernel32.dll_GetCurrentProcessId_1
push eax
call sub.kernel32.dll_ProcessIdToSessionId
test eax, eax
jne 0x4efd11
xor eax, eax
mov dword [edi + 0x3b4], eax
mov eax, dword [edi + 0x3b4]
mov dword [edi + 0x3b8], eax
push 0
push 0x4f0134
mov cl, 1
mov dl, 1
mov eax, dword [0x47cff4]
call fcn.0047db2c
mov esi, eax
mov dword [edi + 0x3b0], esi
mov eax, dword [0x50f914]
cmp dword [eax], 0
je 0x4eff4b
push 0
mov eax, dword [edi + 0x3b4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040b0e4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x4f0160
call fcn.004067f4
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47cff4]
call fcn.0047db2c
mov esi, eax
mov dword [edi + 0x398], esi
mov eax, esi
call fcn.00434adc
push 1
mov eax, dword [edi + 0x3b4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x14]
call fcn.0040b0e4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4f0184
call fcn.004067f4
mov eax, dword [ebp - 0x10]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47cff4]
call fcn.0047db2c
mov esi, eax
mov dword [edi + 0x39c], esi
mov eax, esi
call fcn.00434ad0
push 1
mov eax, dword [edi + 0x3b4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.0040b0e4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4f01ac
call fcn.004067f4
mov eax, dword [ebp - 0x18]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47cff4]
call fcn.0047db2c
mov esi, eax
mov dword [edi + 0x3a4], esi
mov eax, esi
call fcn.00434ad0
push 0
mov eax, dword [edi + 0x3b4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.0040b0e4
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4f01d0
call fcn.004067f4
mov eax, dword [ebp - 0x20]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47cff4]
call fcn.0047db2c
mov esi, eax
mov dword [edi + 0x3a0], esi
mov eax, esi
call fcn.00434adc
mov eax, dword [edi + 0x3b4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0040b0e4
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x4f01f4
call fcn.004067f4
mov eax, dword [ebp - 0x28]
call fcn.0040696c
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA_1
mov esi, eax
mov dword [edi + 0x3ac], esi
test esi, esi
jne 0x4efedd
mov eax, dword [edi + 0x3b4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.0040b0e4
mov ecx, dword [ebp - 0x34]
mov edx, 0x4f01f4
lea eax, [ebp - 0x30]
call fcn.004067f4
mov eax, dword [ebp - 0x30]
call fcn.0040696c
push eax
push 0x99dc0d
push 0
push 4
push 0xffffffffffffffff
call fcn.0047d720
mov dword [edi + 0x3ac], eax
push 0
push 0
push 0
push 6
mov eax, dword [edi + 0x3ac]
push eax
call sub.kernel32.dll_MapViewOfFile_1
mov dword [edi + 0x3a8], eax
cmp dword [edi + 0x3a8], 0
je 0x4eff24
mov eax, dword [edi + 0x398]
cmp dword [eax + 4], 0
je 0x4eff24
mov eax, dword [edi + 0x39c]
cmp dword [eax + 4], 0
je 0x4eff24
mov eax, dword [edi + 0x3a4]
cmp dword [eax + 4], 0
jne 0x4eff3c
push 0
push 0
push 0x12
mov eax, dword [0x50f950]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostThreadMessageA
call fcn.0040ef48
call sub.kernel32.dll_GetCurrentProcessId_1
mov edx, dword [edi + 0x3a8]
mov dword [edx], eax
jmp 0x4eff52
mov eax, esi
call fcn.00434adc
mov dl, 1
mov eax, dword [0x4e9864]
call fcn.004ea138
mov dword [edi + 0x1d8], eax
mov dl, 1
mov eax, dword [0x4e9864]
call fcn.004ea138
mov dword [edi + 0x1dc], eax
mov eax, dword [edi + 0x1d8]
mov edx, 0x4f021c
call fcn.004ebb8c
mov eax, dword [edi + 0x1dc]
mov edx, 0x4f021c
call fcn.004ebb8c
mov dl, 1
mov eax, dword [0x47d054]
call fcn.0047d910
mov dword [edi + 0x308], eax
mov dl, 1
mov eax, dword [0x47d054]
call fcn.0047d910
mov dword [edi + 0x30c], eax
mov dl, 1
mov eax, dword [0x47d054]
call fcn.0047d910
mov dword [edi + 0x160], eax
mov dl, 1
mov eax, dword [0x47d054]
call fcn.0047d910
mov dword [edi + 0x164], eax
mov dl, 1
mov eax, dword [0x42bb78]
call fcn.00431f0c
mov dword [edi + 0x194], eax
mov dl, 1
mov eax, dword [0x42bb78]
call fcn.00431f0c
mov dword [edi + 0x198], eax
mov dl, 1
mov eax, dword [0x42bb78]
call fcn.00431f0c
mov dword [edi + 0x19c], eax
mov dl, 1
mov eax, dword [0x42bb78]
call fcn.00431f0c
mov dword [edi + 0x1a0], eax
mov dl, 1
mov eax, dword [0x47dc08]
call fcn.0047e46c
mov dword [edi + 0x370], eax
mov dl, 1
mov eax, dword [0x47dc08]
call fcn.0047e46c
mov dword [edi + 0x314], eax
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x47cff4]
call fcn.0047db2c
mov dword [edi + 0x318], eax
mov dl, 1
mov eax, dword [0x47dc08]
call fcn.0047e46c
mov dword [edi + 0x378], eax
xor eax, eax
mov dword [edi + 0x1a4], eax
xor eax, eax
mov dword [edi + 0x1a8], eax
xor eax, eax
mov dword [edi + 0x1c8], eax
xor eax, eax
mov dword [edi + 0x1cc], eax
mov byte [edi + 0x1c6], 1
mov dl, 3
mov eax, edi
call fcn.004f2a60
xor eax, eax
mov dword [0x50f114], eax
mov dword [edi + 0x1d0], 0x3f800000
mov dword [edi + 0x1d4], 0x3f800000
mov byte [edi + 0x384], 0
mov byte [edi + 0x38c], 0
mov dl, 1
mov eax, dword [0x4efab0]
call fcn.004f5864
mov dword [0x50f110], eax
mov cl, 1
xor edx, edx
mov eax, edi
call fcn.004247dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f010b
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.004064f0
ret