Function at 0x10042ec0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x103dda04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0xd077d66b
mov dword [ebp - 0x5c], 0x62cea79
lea eax, [ebp - 0x60]
mov dword [ebp - 0x58], 0xb7adc4ee
mov dword [ebp - 0x54], 0xea624fe8
movq qword [ebp - 0x40], xmm0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x20], 0xbc13a205
mov dword [ebp - 0x1c], 0x6a48c415
mov dword [ebp - 0x18], 0xb7adc482
mov dword [ebp - 0x14], 0xea624fe8
movaps xmm1, xmmword [ebp - 0x20]
pxor xmm1, xmmword [ebp - 0x60]
push eax
movaps xmmword [ebp - 0x60], xmm1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xc
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_K32GetModuleInformation
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x90]
push 0
push 0
mov dword [ebp - 0x90], 0xeb4f9846
mov dword [ebp - 0x8c], 0x52caa7c
mov dword [ebp - 0x88], 0xe4f1b7f5
mov dword [ebp - 0x84], 0x8f163c91
mov dword [ebp - 0x80], 0x151ad86a
mov dword [ebp - 0x7c], 0x93057059
mov dword [ebp - 0x78], 0xba6e878
mov dword [ebp - 0x74], 0xdfeb714e
movaps xmm1, xmmword [ebp - 0x90]
push 3
push 0
mov dword [ebp - 0x30], 0xbc13a205
mov dword [ebp - 0x2c], 0x6a48c415
mov dword [ebp - 0x28], 0xb7adc482
mov dword [ebp - 0x24], 0xea624fe8
pxor xmm1, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x90], xmm1
movaps xmm1, xmmword [ebp - 0x80]
push 1
mov dword [ebp - 0x20], 0x4928eb07
mov dword [ebp - 0x1c], 0xff610437
mov dword [ebp - 0x18], 0x67c2c614
mov dword [ebp - 0x14], 0xdfeb7122
pxor xmm1, xmmword [ebp - 0x20]
push SysReAllocString
push eax
mov dword [ebp - 0x48], esi
movaps xmmword [ebp - 0x80], xmm1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 0
push 0x1000002
push 0
push eax
mov dword [ebp - 0x64], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x1004315b
mov edi, dword [esi + 0x3c]
xor ecx, ecx
add edi, esi
xor esi, esi
cmp cx, word [edi + 6]
jae 0x1004314b
mov dword [ebp - 0x20], 0xbc13a205
mov dword [ebp - 0x1c], 0x6a48c415
mov dword [ebp - 0x18], 0xb7adc482
mov dword [ebp - 0x14], 0xea624fe8
nop word [eax + eax]
movaps xmm1, xmmword [ebp - 0x20]
movzx eax, si
mov dword [ebp - 0x60], 0xc476d62b
mov dword [ebp - 0x5c], 0x6a48c461
mov dword [ebp - 0x58], 0xb7adc482
lea ecx, [eax + eax*4]
mov dword [ebp - 0x54], 0xea624fe8
movzx eax, word [edi + 0x14]
lea ecx, [ecx + 3]
pxor xmm1, xmmword [ebp - 0x60]
add eax, edi
movaps xmmword [ebp - 0x60], xmm1
lea ecx, [eax + ecx*8]
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 0x60]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100430e1
test dl, dl
je 0x100430dd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100430e1
add ecx, 2
add eax, 2
test dl, dl
jne 0x100430c1
xor eax, eax
jmp 0x100430e6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1004313d
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x44]
push 0x40
push dword [eax + 8]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x44]
push dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x4c]
add eax, ecx
push eax
mov eax, dword [ebp - 0x48]
add eax, ecx
push eax
call fcn.100b8180
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x44]
push dword [ebp - 0x34]
push dword [eax + 8]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp si, word [edi + 6]
jb 0x10043080
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100b684e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret