Function at 0x414ea0
Capabilities:
Read file via mapping

Disassembly:
push 0xffffffffffffffff
push 0x4b34fb
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x4f4930]
xor eax, esp
mov dword [esp + 0x1d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov eax, dword [esp + 0x200]
mov ebp, dword [esp + 0x1fc]
mov dword [esp + 0x14], eax
mov esi, ecx
call fcn.00423400
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test al, al
je 0x414f23
mov dword [esp + 0x18], str.CreateShareble
call ebx
mov edi, eax
call fcn.0042cb40
push edi
mov edi, eax
call fcn.0042c640
mov ecx, eax
mov eax, str.CreateShareble
call fcn.0042c950
xor edi, edi
mov dword [esp + 0x1f4], edi
cmp dword [ebp + 4], edi
je 0x414f7f
mov ecx, dword [esp + 0x14]
push str._rYeR
push ecx
call fcn.0041a530
add esp, 8
mov byte [esp + 0x1f], al
mov dword [esp + 0x1f4], 0xffffffff
call fcn.00423400
test al, al
je 0x414f76
call ebx
mov esi, eax
call fcn.0042cb40
push esi
mov edi, eax
call fcn.0042c640
cmp byte [eax], 0
je 0x414f76
call fcn.0042ca00
mov al, byte [esp + 0x1f]
jmp 0x415249
cmp esi, edi
jne 0x414f8a
xor ebx, ebx
jmp 0x415039
push 6
push str.Local_
push esi
lea ebx, [esp + 0x2c]
call fcn.0047236c
add esp, 0xc
test eax, eax
je 0x414fcc
push str.Local_
mov edx, ebx
push 0xe2
push edx
call fcn.0047149d
add esp, 0xc
push 0xc2
push esi
mov eax, ebx
push 0xe2
push eax
call fcn.004713af
jmp 0x414fe1
push 0xc8
push esi
lea ecx, [esp + 0x28]
push 0xe2
push ecx
call fcn.004710fb
xor edx, edx
add esp, 0x10
mov word [esp + 0x1b0], dx
cmp byte [esp + 0x208], dl
je 0x415018
call fcn.00419890
add eax, 0x4be
cmp eax, edi
je 0x415018
push eax
lea eax, [esp + 0x24]
push 0xe2
push eax
call fcn.00471f8e
add esp, 0xc
call fcn.00419890
add eax, 0x49c
cmp eax, edi
je 0x415039
push eax
lea ecx, [esp + 0x24]
push 0xe2
push ecx
call fcn.00471f8e
add esp, 0xc
call fcn.00419890
xor eax, eax
cmp ebx, edi
je 0x415102
push ebx
push 1
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, edi
je 0x415102
mov dword [ebp + 0xc], 2
or esi, 0xffffffff
mov ecx, dword [esp + 0x20c]
push ecx
push edi
push edi
push 6
push eax
mov dword [ebp + 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x415237
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x41509f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp + 8], edi
mov eax, dword [ebp + 4]
cmp eax, edi
je 0x4150b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 4], edi
cmp ebx, edi
jne 0x4151bc
mov ebx, dword [esp + 0x14]
mov ecx, ebx
call fcn.0041a480
mov edi, esi
mov esi, eax
call fcn.0041a720
mov ecx, ebx
call fcn.0041a480
push 0x4d3a60
push 0x4d4204
mov edx, eax
call fcn.0041f080
add esp, 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x1f4], 0xffffffff
call fcn.004233d0
xor al, al
jmp 0x415249
cmp byte [esp + 0x204], 0
je 0x415180
mov edx, dword [esp + 0x20c]
push ebx
push edx
push edi
push 0x8000004
call fcn.00424080
push eax
or esi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
jne 0x415177
cmp ebx, edi
jne 0x41515f
push 0x4d39f0
mov ebx, dword [esp + 0x18]
call fcn.0041a6f0
mov ecx, eax
call fcn.0041a870
lea ecx, [esp + 0x18]
mov dword [esp + 0x1f4], esi
call fcn.004233d0
xor al, al
jmp 0x415249
push ebx
mov ebx, dword [esp + 0x18]
push 0x4d3a0c
call fcn.0041a6f0
mov ecx, eax
call fcn.0041a870
jmp 0x415141
mov dword [ebp + 0xc], 1
jmp 0x415183
or esi, 0xffffffff
cmp eax, edi
jne 0x415065
cmp byte [esp + 0x204], 0
jne 0x415065
cmp ebx, edi
jne 0x4151a4
push 0x4d3a28
jmp 0x415138
push ebx
mov ebx, dword [esp + 0x18]
push 0x4d3a44
call fcn.0041a6f0
mov ecx, eax
call fcn.0041a870
jmp 0x415141
mov ebp, dword [esp + 0x14]
mov ecx, ebp
call fcn.0041a480
mov edi, esi
mov esi, eax
call fcn.0041a720
mov ecx, ebp
call fcn.0041a480
mov esi, eax
push str.Filemap
push 0x4d4204
mov edx, esi
call fcn.0041f080
push ebx
push 0x4d4204
mov edx, esi
call fcn.0041f080
push 0x4d3aa8
push 0x4d4204
mov edx, esi
call fcn.0041f080
mov edx, dword [esp + 0x224]
push edx
push 0x4d4d4c
mov edx, esi
call fcn.0041f080
add esp, 0x20
lea ecx, [esp + 0x18]
mov dword [esp + 0x1f4], 0xffffffff
call fcn.004233d0
xor al, al
jmp 0x415249
lea ecx, [esp + 0x18]
mov dword [esp + 0x1f4], esi
call fcn.004233d0
mov al, 1
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d4]
xor ecx, esp
call fcn.0046fdae
add esp, 0x1e4
ret 0x14