Function at 0x10031116
Capabilities:
Read file via mapping

Disassembly:
push 0x94
push 0x100311c0
call fcn.100014a0
mov eax, dword [0x1003b164]
mov dword [ebp - 0x1c], eax
mov esi, ecx
mov dword [ebp - 0x54], esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x48], 0x200
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], 0x400
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x60], ebx
xor eax, eax
lea edi, [ebp - 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xa4], ebx
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x24], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 5
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x29], al
mov byte [ebp - 0x28], al
mov byte [ebp - 0x27], 1
mov ecx, esi
call fcn.100307b5
test eax, eax
jne 0x100311cc
mov eax, 0x80070079
lea esp, [ebp - 0xb0]
mov ecx, dword [ebp - 0x1c]
call fcn.10023cf0
call fcn.10001766
ret
mov dword [ebp - 4], ebx
push 0x10005518
push ebx
push 0x3001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x10], eax
cmp eax, ebx
je 0x1003121b
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x18], eax
cmp eax, ebx
jne 0x10031212
mov dword [ebp - 0x30], 0x8000ffff
or dword [ebp - 4], 0xffffffff
call fcn.10031434
mov eax, dword [ebp - 0x30]
jmp 0x100311a8
mov ecx, esi
call fcn.10030a97
jmp 0x10031204
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x2c]
push eax
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
call edi
test eax, eax
je 0x10031307
mov dword [ebp - 0xa4], 4
mov dword [ebp - 0xa0], 2
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 5
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
je 0x10031307
mov edi, 0xf001f
mov dword [ebp - 0x84], edi
push 2
pop eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x3c]
push ecx
push ebx
lea ecx, [ebp - 0xa4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x100312d7
jle 0x100312cf
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x30], eax
jmp 0x10031204
push 0x14
pop eax
call fcn.10001a44
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x50], eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10031307
push ebx
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x1003131b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10031317
call edi
jmp 0x100312cf
call edi
jmp 0x100312c5
mov dword [ebp - 0x60], 0xc
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.10030c54
push 0x10
pop eax
mov dword [ebp - 0x4c], eax
movzx ebx, word [ebp - 0x48]
imul ebx, ebx, 0x70
add ebx, eax
mov dword [ebp - 0x4c], ebx
movzx eax, word [ebp - 0x44]
imul eax, eax, 0x134
add ebx, eax
mov dword [ebp - 0x4c], ebx
movzx eax, word [ebp - 0x40]
shl eax, 4
add ebx, eax
mov dword [ebp - 0x4c], ebx
push 0x10005518
push ebx
push 0
push 4
lea eax, [ebp - 0x60]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x10], eax
xor ecx, ecx
push ecx
push ecx
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [esi + 0x18], ecx
test ecx, ecx
jne 0x100313bd
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x100313af
call edi
xor ebx, ebx
jmp 0x100312cf
call edi
and eax, 0xffff
or eax, 0x80070000
jmp 0x100313a8
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x18]
mov cx, word [ebp - 0x48]
mov word [eax], cx
mov eax, dword [esi + 0x18]
mov cx, word [ebp - 0x44]
mov word [eax + 2], cx
mov eax, dword [esi + 0x18]
mov cx, word [ebp - 0x40]
mov word [eax + 4], cx
mov eax, dword [esi + 0x18]
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x18]
and dword [eax + 0xc], 0
mov eax, dword [esi + 0x18]
lea ecx, [eax + 0x10]
mov dword [esi + 0x1c], ecx
movzx edx, word [eax]
imul edx, edx, 0x70
add ecx, edx
mov dword [esi + 0x20], ecx
movzx eax, word [eax + 2]
imul eax, eax, 0x134
add eax, ecx
mov dword [esi + 0x24], eax
mov dword [esi + 8], 1
mov ecx, esi
call fcn.10030fc9
jmp 0x100313a8