Function at 0x1002bfd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x1002bff5
cmp dword [ebp + 0xc], 0
je 0x1002bff5
cmp dword [ebp + 0x10], 0
jne 0x1002bffc
xor eax, eax
jmp 0x1002c21a
push 0x104
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x1002c047
xor eax, eax
jmp 0x1002c21a
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x1002c081
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002c21a
push 0
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x1002c0c8
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002c21a
mov edx, dword [ebp + 8]
push edx
call fcn.1002bc90
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002c10b
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002c21a
push 0x40
push 0x1000
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x1002c162
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002c21a
mov ecx, dword [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call fcn.1002bed0
add esp, 8
test eax, eax
je 0x1002c193
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.1002bd50
add esp, 8
test eax, eax
jne 0x1002c1db
push 0x8000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002c21a
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x114]
mov dword [ecx], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret