Function at 0x1002b4e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10056f87
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1006c740]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x1006c740]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
cmp byte [0x1007ef08], 0
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x28], 0x1007eef0
je 0x1002b535
push 0x1007eef0
call ebx
mov dword [esp + 0x78], 0
mov ecx, 0x1007ef44
push 0x12
push str.hongbing.yhb099452
mov dword [0x100865bc], 0
mov dword [0x1007ef0c], 2
mov byte [0x100702bb], 1
mov byte [0x1007ef10], 0
mov dword [0x10070374], 0
mov byte [0x1007ef5c], 1
call fcn.100039c0
lea ecx, [esp + 0x44]
mov dword [0x1007eeec], 0xf
call fcn.1002b0f0
mov esi, eax
mov edi, 0x10095118
cmp esi, edi
je 0x1002b5d9
cmp dword [0x1009512c], 0x10
jb 0x1002b5b6
push dword [0x10095118]
call fcn.100359a3
add esp, 4
push esi
mov ecx, edi
mov dword [0x1009512c], 0xf
mov dword [0x10095128], 0
mov byte [0x10095118], 0
call fcn.1000f1f0
cmp dword [esp + 0x58], 0x10
jb 0x1002b5ec
push dword [esp + 0x44]
call fcn.100359a3
add esp, 4
cmp dword [0x1009512c], 0x10
mov eax, edi
mov dword [esp + 0x20], 0x1007eef0
cmovae eax, dword [0x10095118]
cmp byte [0x1007ef08], 0
mov dword [esp + 0x10], eax
je 0x1002b618
push 0x1007eef0
call ebx
mov byte [esp + 0x78], 1
mov esi, dword [0x1006f650]
test esi, esi
jne 0x1002b671
push 0x90
call fcn.10035cb1
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov byte [esp + 0x78], 2
test esi, esi
je 0x1002b664
push 0x90
push 0
push esi
call fcn.10037cb0
add esp, 8
mov ecx, esi
push 0
call fcn.100288c0
mov dword [esi + 0x88], esi
jmp 0x1002b666
xor esi, esi
mov byte [esp + 0x78], 1
mov dword [0x1006f650], esi
push dword [esp + 0x10]
mov ecx, esi
call fcn.10028b00
cmp byte [0x1007ef08], 0
je 0x1002b690
push 0x1007eef0
call dword [0x10059108]
cmp dword [0x1009512c], 0x10
mov eax, edi
mov dword [esp + 0x14], 0x1007eef0
cmovae eax, dword [0x10095118]
cmp byte [0x1007ef08], 0
mov dword [esp + 0x10], eax
je 0x1002b6bc
push 0x1007eef0
call ebx
mov byte [esp + 0x78], 3
mov esi, dword [0x1006f654]
test esi, esi
jne 0x1002b715
push 0x90
call fcn.10035cb1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov byte [esp + 0x78], 4
test esi, esi
je 0x1002b708
push 0x90
push 0
push esi
call fcn.10037cb0
add esp, 8
mov ecx, esi
push 1
call fcn.100288c0
mov dword [esi + 0x88], esi
jmp 0x1002b70a
xor esi, esi
mov byte [esp + 0x78], 3
mov dword [0x1006f654], esi
push dword [esp + 0x10]
mov ecx, esi
call fcn.10028b00
cmp byte [0x1007ef08], 0
je 0x1002b734
push 0x1007eef0
call dword [0x10059108]
cmp dword [0x1009512c], 0x10
mov eax, edi
mov dword [esp + 0x18], 0x1007eef0
cmovae eax, dword [0x10095118]
cmp byte [0x1007ef08], 0
mov dword [esp + 0x10], eax
je 0x1002b760
push 0x1007eef0
call ebx
mov byte [esp + 0x78], 5
mov esi, dword [0x1006f658]
test esi, esi
jne 0x1002b7b9
push 0x90
call fcn.10035cb1
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov byte [esp + 0x78], 6
test esi, esi
je 0x1002b7ac
push 0x90
push 0
push esi
call fcn.10037cb0
add esp, 8
mov ecx, esi
push 2
call fcn.100288c0
mov dword [esi + 0x88], esi
jmp 0x1002b7ae
xor esi, esi
mov byte [esp + 0x78], 5
mov dword [0x1006f658], esi
push dword [esp + 0x10]
mov ecx, esi
call fcn.10028b00
cmp byte [0x1007ef08], 0
je 0x1002b7d8
push 0x1007eef0
call dword [0x10059108]
cmp dword [0x1009512c], 0x10
mov eax, edi
mov dword [esp + 0x24], 0x1007eef0
cmovae eax, dword [0x10095118]
cmp byte [0x1007ef08], 0
mov dword [esp + 0x10], eax
je 0x1002b804
push 0x1007eef0
call ebx
mov byte [esp + 0x78], 7
mov esi, dword [0x1006f65c]
test esi, esi
jne 0x1002b85d
push 0x90
call fcn.10035cb1
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov byte [esp + 0x78], 8
test esi, esi
je 0x1002b850
push 0x90
push 0
push esi
call fcn.10037cb0
add esp, 8
mov ecx, esi
push 3
call fcn.100288c0
mov dword [esi + 0x88], esi
jmp 0x1002b852
xor esi, esi
mov byte [esp + 0x78], 7
mov dword [0x1006f65c], esi
push dword [esp + 0x10]
mov ecx, esi
call fcn.10028b00
cmp byte [0x1007ef08], 0
je 0x1002b87c
push 0x1007eef0
call dword [0x10059108]
cmp dword [0x1009512c], 0x10
mov dword [esp + 0x1c], 0x1007eef0
cmovae edi, dword [0x10095118]
cmp byte [0x1007ef08], 0
je 0x1002b8a2
push 0x1007eef0
call ebx
mov byte [esp + 0x78], 9
mov esi, dword [0x1006f660]
test esi, esi
jne 0x1002b8fb
push 0x90
call fcn.10035cb1
mov esi, eax
add esp, 4
mov dword [esp + 0x24], esi
mov byte [esp + 0x78], 0xa
test esi, esi
je 0x1002b8ee
push 0x90
push 0
push esi
call fcn.10037cb0
add esp, 8
mov ecx, esi
push 4
call fcn.100288c0
mov dword [esi + 0x88], esi
jmp 0x1002b8f0
xor esi, esi
mov byte [esp + 0x78], 9
mov dword [0x1006f660], esi
push edi
mov ecx, esi
call fcn.10028b00
mov byte [esp + 0x78], 0
cmp byte [0x1007ef08], 0
mov ebx, dword [0x10059108]
je 0x1002b91e
push 0x1007eef0
call ebx
push str.GlobalAlibabaProtectShareMemory
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
test edi, edi
je 0x1002ba54
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1002b95a
push edi
call dword [0x10059100]
jmp 0x1002ba54
xor esi, esi
mov dword [esp + 0x64], 0
xorps xmm0, xmm0
mov dword [esp + 0x64], esi
movq qword [esp + 0x5c], xmm0
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x7c], 0xb
call fcn.1000fb50
mov byte [esp + 0x78], 0xc
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x1002b9be
push esi
push ecx
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.1002d2e0
test eax, eax
je 0x1002b9be
lea eax, [esp + 0x5c]
push eax
lea edx, [esi + 0x7c]
lea ecx, [esp + 0x30]
call fcn.1002b360
mov esi, dword [esp + 0x60]
add esp, 4
cmp dword [esp + 0x40], 8
jb 0x1002b9d1
push dword [esp + 0x2c]
call fcn.100359a3
add esp, 4
mov eax, dword [esp + 0x60]
cmp esi, eax
je 0x1002ba26
mov ecx, eax
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jb 0x1002ba26
cmp dword [esi + 0x14], 8
jb 0x1002b9fd
mov eax, dword [esi]
jmp 0x1002b9ff
mov eax, esi
push eax
call fcn.1003d30f
mov dword [0x10070374], eax
add esp, 4
cmp dword [esi + 0x2c], 8
lea eax, [esi + 0x18]
jb 0x1002ba18
mov eax, dword [eax]
push eax
call fcn.1003d30f
add esp, 4
mov dword [0x1007ef0c], eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [0x10059100]
test esi, esi
je 0x1002ba54
push dword [esp + 0x1c]
mov edx, dword [esp + 0x64]
push ecx
mov ecx, esi
call fcn.10027ec0
push esi
call fcn.100359a3
add esp, 0xc
cmp byte [0x1007ef08], 0
je 0x1002ba64
push 0x1007eef0
call ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100359a8
mov esp, ebp
pop ebp
ret