Function at 0x10011c20
Capabilities:
Allocate or change rwx memory
Read file via mapping
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20dc
call fcn.1001c920
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
je 0x10011c74
push 0x10011190
mov ecx, dword [sym.imp.USER32.dll_CreateWindowExA]
push ecx
call fcn.10044060
add esp, 8
mov dword [0x100b2098], eax
push 0x10011240
mov edx, dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
call fcn.10044060
add esp, 8
mov dword [0x100b20a0], eax
xor eax, eax
jmp 0x10012625
mov eax, 1
test eax, eax
je 0x10011d3b
mov ecx, 2
imul edx, ecx, 0
mov dword [ebp - 0x20b8], edx
cmp dword [ebp - 0x20b8], 0x2000
jae 0x10011c9d
jmp 0x10011ca2
call fcn.1001ca83
xor eax, eax
mov ecx, dword [ebp - 0x20b8]
mov word [ebp + ecx - 0x2044], ax
push 0xfff
lea edx, [ebp - 0x2044]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x2050], 0
jmp 0x10011ce1
mov eax, dword [ebp - 0x2050]
add eax, 1
mov dword [ebp - 0x2050], eax
lea ecx, [ebp - 0x2044]
push ecx
call fcn.10043a90
add esp, 4
cmp dword [ebp - 0x2050], eax
jge 0x10011d3b
mov edx, dword [ebp - 0x2050]
movzx eax, word [ebp + edx*2 - 0x2044]
cmp eax, 0x5c
je 0x10011d1e
mov ecx, dword [ebp - 0x2050]
movzx edx, word [ebp + ecx*2 - 0x2044]
cmp edx, 0x2f
jne 0x10011d39
mov eax, dword [ebp - 0x2050]
lea ecx, [ebp + eax*2 - 0x2042]
push ecx
push 0x100aef10
call fcn.10043a30
add esp, 8
jmp 0x10011cd2
mov edx, 1
test edx, edx
je 0x10011d57
call fcn.1000bd30
test eax, eax
je 0x10011d57
mov dword [0x100aef08], 1
cmp dword [0x100aef08], 0
je 0x10011d65
call fcn.1000bbf0
cmp dword [0x100aef08], 0
jne 0x10011d9d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20bc], eax
mov eax, 1
imul ecx, eax, 0xfff
mov edx, dword [ebp - 0x20bc]
movsx eax, byte [edx + ecx]
cmp eax, 1
je 0x10011d9d
xor eax, eax
jmp 0x10012625
mov ecx, 1
test ecx, ecx
je 0x10011db7
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10011db7
xor eax, eax
jmp 0x10012625
mov edx, 1
test edx, edx
je 0x1001216b
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x2058], eax
mov eax, dword [ebp - 0x2058]
mov dword [ebp - 0x20b0], eax
mov ecx, dword [ebp - 0x20b0]
mov edx, dword [ebp - 0x2058]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20a0], edx
mov eax, dword [ebp - 0x20b0]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x2058]
lea eax, [edx + ecx + 0xf8]
mov dword [ebp - 0x20d4], eax
mov ecx, 8
shl ecx, 1
mov edx, dword [ebp - 0x20a0]
cmp dword [edx + ecx + 0x78], 0
je 0x1001216b
mov eax, 8
shl eax, 1
mov ecx, dword [ebp - 0x20a0]
mov edx, dword [ebp - 0x2058]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x204c], edx
mov eax, dword [ebp - 0x204c]
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp - 0x204c]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x20d0], ecx
mov dword [ebp - 0x207c], 0
jmp 0x10011e7b
mov ecx, dword [ebp - 0x207c]
add ecx, 1
mov dword [ebp - 0x207c], ecx
mov edx, dword [ebp - 0x207c]
cmp edx, dword [ebp - 0x20d0]
jge 0x1001216b
mov eax, dword [ebp - 0x204c]
add eax, 0x10
mov dword [ebp - 0x2064], eax
mov ecx, dword [ebp - 0x207c]
mov edx, dword [ebp - 0x2064]
lea eax, [edx + ecx*8]
mov dword [ebp - 0x2064], eax
mov ecx, dword [ebp - 0x2064]
cmp dword [ecx], 0x10
jne 0x10012166
mov edx, dword [ebp - 0x2064]
mov eax, dword [edx + 4]
and eax, 0x7fffffff
mov dword [ebp - 0x2084], eax
jne 0x10011ed8
jmp 0x10011e6c
mov ecx, dword [ebp - 0x2084]
add ecx, dword [ebp - 0x204c]
mov dword [ebp - 0x2084], ecx
mov edx, dword [ebp - 0x2084]
mov dword [ebp - 0x209c], edx
mov eax, dword [ebp - 0x209c]
movzx ecx, word [eax + 0xe]
mov edx, dword [ebp - 0x209c]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x20c4], ecx
mov dword [ebp - 0x2078], 0
jmp 0x10011f2d
mov ecx, dword [ebp - 0x2078]
add ecx, 1
mov dword [ebp - 0x2078], ecx
mov edx, dword [ebp - 0x2078]
cmp edx, dword [ebp - 0x20c4]
jge 0x10012166
mov eax, dword [ebp - 0x209c]
add eax, 0x10
mov dword [ebp - 0x2090], eax
mov ecx, dword [ebp - 0x2078]
mov edx, dword [ebp - 0x2090]
lea eax, [edx + ecx*8]
mov dword [ebp - 0x2090], eax
mov ecx, dword [ebp - 0x2090]
mov edx, dword [ecx + 4]
and edx, 0x7fffffff
mov dword [ebp - 0x2070], edx
jne 0x10011f7c
jmp 0x10011f1e
mov eax, dword [ebp - 0x2070]
add eax, dword [ebp - 0x204c]
mov dword [ebp - 0x2070], eax
mov ecx, dword [ebp - 0x2070]
mov dword [ebp - 0x2094], ecx
mov edx, dword [ebp - 0x2094]
movzx eax, word [edx + 0xe]
mov ecx, dword [ebp - 0x2094]
movzx edx, word [ecx + 0xc]
add eax, edx
mov dword [ebp - 0x20c8], eax
mov dword [ebp - 0x2080], 0
jmp 0x10011fd1
mov eax, dword [ebp - 0x2080]
add eax, 1
mov dword [ebp - 0x2080], eax
mov ecx, dword [ebp - 0x2080]
cmp ecx, dword [ebp - 0x20c8]
jge 0x10012161
mov edx, dword [ebp - 0x2094]
add edx, 0x10
mov dword [ebp - 0x2068], edx
mov eax, dword [ebp - 0x2080]
mov ecx, dword [ebp - 0x2068]
lea edx, [ecx + eax*8]
mov dword [ebp - 0x2068], edx
mov eax, dword [ebp - 0x2068]
cmp dword [eax + 4], 0
jne 0x10012015
jmp 0x10011fc2
mov ecx, dword [ebp - 0x2068]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x2088], edx
mov eax, dword [ebp - 0x2088]
add eax, dword [ebp - 0x204c]
mov dword [ebp - 0x2088], eax
mov ecx, dword [ebp - 0x2088]
mov dword [ebp - 0x2048], ecx
mov edx, dword [ebp - 0x2048]
cmp dword [edx], 0
jne 0x10012052
jmp 0x10011fc2
mov eax, dword [ebp - 0x2048]
cmp dword [eax + 4], 0
jne 0x10012063
jmp 0x10011fc2
mov ecx, dword [ebp - 0x2048]
mov edx, dword [ebp - 0x2058]
add edx, dword [ecx]
mov dword [ebp - 0x206c], edx
mov eax, dword [ebp - 0x2048]
cmp dword [eax + 4], 0x30
jbe 0x1001215c
lea ecx, [ebp - 0x20cc]
push ecx
push 0x40
mov edx, dword [ebp - 0x2048]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x206c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x2054], 0
jmp 0x100120c2
mov edx, dword [ebp - 0x2054]
add edx, 1
mov dword [ebp - 0x2054], edx
mov eax, dword [ebp - 0x2048]
mov ecx, dword [eax + 4]
sub ecx, 0x42
cmp dword [ebp - 0x2054], ecx
jae 0x10012137
push 0x40
push 0
lea edx, [ebp - 0x44]
push edx
call fcn.10043f30
add esp, 0xc
push 0x3e
mov eax, dword [ebp - 0x206c]
add eax, dword [ebp - 0x2054]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.10043eb0
add esp, 0xc
push 0x1004bc34
lea edx, [ebp - 0x44]
push edx
call fcn.10043920
add esp, 8
test eax, eax
jne 0x10012132
push str.FileDesCription
mov eax, dword [ebp - 0x206c]
add eax, dword [ebp - 0x2054]
push eax
call fcn.10043a30
add esp, 8
jmp 0x10012137
jmp 0x100120b3
lea ecx, [ebp - 0x20d8]
push ecx
mov edx, dword [ebp - 0x20cc]
push edx
mov eax, dword [ebp - 0x2048]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x206c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10011fc2
jmp 0x10011f1e
jmp 0x10011e6c
cmp dword [0x100aef08], 0
jne 0x100122fa
mov dword [ebp - 0x205c], 0
mov dword [ebp - 0x2098], 0
jmp 0x1001219d
mov eax, dword [ebp - 0x2098]
add eax, 1
mov dword [ebp - 0x2098], eax
cmp dword [ebp - 0x2098], 0xa
jge 0x100121d7
push str.MaiDRMBusterQueryMem
push 1
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x205c], eax
cmp dword [ebp - 0x205c], 0
je 0x100121c8
jmp 0x100121d7
push 0x3e8
call fcn.10043f60
add esp, 4
jmp 0x1001218e
cmp dword [ebp - 0x205c], 0
jne 0x100121fc
push 0
push 0x1004bdd4
push str.0x90030001
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1f4
call fcn.10043f60
add esp, 4
push 0x500000
push 0
push 0
push 4
mov ecx, dword [ebp - 0x205c]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x2060], eax
cmp dword [ebp - 0x2060], 0
jne 0x1001224c
push 0
push 0x1004bdf4
push str.0x90030002
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x148
push 0
push 0x1010a130
call fcn.10043f30
add esp, 0xc
mov edx, dword [ebp - 0x2060]
mov eax, dword [edx + 0x4000]
mov dword [0x100b1f18], eax
push 0x500000
call fcn.1001c60e
add esp, 4
mov dword [ebp - 0x20c0], eax
mov ecx, dword [ebp - 0x20c0]
mov dword [0x100b0f14], ecx
cmp dword [0x100b1f18], 0
je 0x100122bb
mov edx, dword [0x100b1f18]
push edx
mov eax, dword [ebp - 0x2060]
add eax, 0x4010
push eax
mov ecx, dword [0x100b0f14]
push ecx
call fcn.10043eb0
add esp, 0xc
push 0x148
mov edx, dword [ebp - 0x2060]
push edx
push 0x1010a130
call fcn.10043eb0
add esp, 0xc
mov eax, dword [0x1010a230]
mov dword [0x100aef0c], eax
mov ecx, dword [ebp - 0x2060]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 0x205c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001231c
push 0x148
call fcn.1000be10
push eax
push 0x1010a130
call fcn.10043eb0
add esp, 0xc
mov eax, dword [0x1010a230]
mov dword [0x100aef0c], eax
cmp dword [0x100aef08], 0
jne 0x100123c7
push str.MaiDRMBusterResponseMem
push 1
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x20b4], eax
cmp dword [ebp - 0x20b4], 0
jne 0x10012363
push 0
push 0x1004be58
push str.0x90030003
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x500000
push 0
push 0
push 2
mov ecx, dword [ebp - 0x20b4]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x208c], eax
cmp dword [ebp - 0x208c], 0
jne 0x100123a6
push 0
push 0x1004be88
push str.0x90030004
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x500000
push 0
mov edx, dword [ebp - 0x208c]
push edx
call fcn.10043f30
add esp, 0xc
mov eax, dword [ebp - 0x208c]
mov dword [0x100b0f10], eax
mov ecx, 1
test ecx, ecx
je 0x100124f6
cmp dword [0x1010a234], 0
jne 0x1001245a
push 0x100112e0
mov edx, dword [sym.imp.USER32.dll_LoadStringA]
push edx
call fcn.10044060
add esp, 8
mov dword [0x100b60ac], eax
push 0x10011540
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
call fcn.10044060
add esp, 8
mov dword [0x100b60b4], eax
push 0x10011800
mov ecx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ecx
call fcn.10044060
add esp, 8
mov dword [0x100ca0e8], eax
push 0x10011ac0
mov edx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
push edx
call fcn.10044060
add esp, 8
mov dword [0x100ca114], eax
push 0x10011190
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
push eax
call fcn.10044060
add esp, 8
mov dword [0x100b2098], eax
jmp 0x100124b3
cmp dword [0x1010a234], 1
jne 0x1001246a
call fcn.10014560
jmp 0x100124b3
cmp dword [0x1010a234], 2
jne 0x10012485
movzx ecx, byte [0x1010a259]
push ecx
call fcn.10002300
add esp, 4
jmp 0x100124b3
cmp dword [0x1010a234], 3
jne 0x10012495
call fcn.100186b0
jmp 0x100124b3
cmp dword [0x1010a234], 4
jne 0x100124a5
call fcn.10014cd0
jmp 0x100124b3
cmp dword [0x1010a234], 5
jne 0x100124b3
call fcn.10017370
movzx edx, byte [0x1010a258]
test edx, edx
je 0x100124c3
call fcn.10002380
cmp dword [0x100aef08], 0
je 0x100124f6
push 0x10010e70
push str.NtCreateFile
push 0x1004bf5c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.10044060
add esp, 8
mov dword [0x100b1f8c], eax
xor eax, eax
jmp 0x10012625
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret