Function at 0x1000fb90
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
push edi
push str.MMAP_PS_AV_STRING_AB1098C2_33CF_4001_A246_0C68E4DFE2D3
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x10010230
mov ecx, 8
mov esi, str.0000000000000000000000000000000
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push 0x4a7d3639
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fbfb
push 0xe33f02e6
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fbfb
xor eax, eax
jmp 0x1000fc00
mov eax, 1
test al, al
setne al
add al, 0x30
push 0xf8a0b1d1
mov byte [esp + 0x34], al
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fc42
push 0xa6c7e180
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fc42
push 0x5e1718d2
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fc42
xor eax, eax
jmp 0x1000fc47
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0x3dc975b3
mov byte [esp + 0x35], cl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fc8a
push 0x5c532628
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fc8a
push 0x54833250
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fc8a
xor eax, eax
jmp 0x1000fc8f
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0x5f43d167
mov byte [esp + 0x36], dl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fcc1
push 0x3398f1df
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fcc1
xor eax, eax
jmp 0x1000fcc6
mov eax, 1
test al, al
setne al
add al, 0x30
push 0xf569010a
mov byte [esp + 0x37], al
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fcf7
push 0x9afa7931
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fcf7
xor eax, eax
jmp 0x1000fcfc
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0x7ba65ca5
mov byte [esp + 0x38], cl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fd2a
push 0x290e7d06
call fcn.1000f1c0
add esp, 4
test eax, eax
je 0x1000fd2f
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0x2e808ae5
mov byte [esp + 0x39], dl
call fcn.1000f1c0
test eax, eax
seta al
add al, 0x30
push 0x5da6c35c
mov byte [esp + 0x3e], al
call fcn.1000f1c0
test eax, eax
seta cl
add cl, 0x30
push 0x768018cb
mov byte [esp + 0x43], cl
call fcn.1000f1c0
add esp, 0xc
test eax, eax
ja 0x1000fd8c
push 0xf1ace7da
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fd8c
xor eax, eax
jmp 0x1000fd91
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0x6bd49bae
mov byte [esp + 0x3c], dl
call fcn.1000f1c0
test eax, eax
seta al
add al, 0x30
push 0x36d48902
mov byte [esp + 0x41], al
call fcn.1000f1c0
add esp, 8
test eax, eax
ja 0x1000fdd8
push 0xac5a39b4
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fdd8
xor eax, eax
jmp 0x1000fddd
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0xc4151736
mov byte [esp + 0x3e], cl
call fcn.1000f1c0
test eax, eax
seta dl
add dl, 0x30
push 0xb77c6e20
mov byte [esp + 0x43], dl
call fcn.1000f1c0
test eax, eax
seta al
add al, 0x30
push 0xb6ee655
mov byte [esp + 0x48], al
call fcn.1000f1c0
test eax, eax
seta cl
add cl, 0x30
push 0xa281be07
mov byte [esp + 0x4d], cl
call fcn.1000f1c0
add esp, 0x10
test eax, eax
seta dl
add dl, 0x30
mov ecx, str.WinDefend
mov byte [esp + 0x3e], dl
call fcn.1000f150
cmp eax, 4
je 0x1000fe67
push 0x75b1dbaa
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fe67
xor eax, eax
jmp 0x1000fe6c
mov eax, 1
test al, al
setne al
add al, 0x30
push 0x955ea822
mov byte [esp + 0x43], al
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000feae
push 0x750f114b
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000feae
push 0xe35d8c95
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000feae
xor eax, eax
jmp 0x1000feb3
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0x75177b66
mov byte [esp + 0x45], cl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fee5
push 0xe76c25e
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000fee5
xor eax, eax
jmp 0x1000feea
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0x37c02ab3
mov byte [esp + 0x46], dl
call fcn.1000f1c0
test eax, eax
seta al
add al, 0x30
push 0x5d4c48d7
mov byte [esp + 0x4b], al
call fcn.1000f1c0
add esp, 8
test eax, eax
ja 0x1000ff31
push 0xaf6fbac8
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ff31
xor eax, eax
jmp 0x1000ff36
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0x9e3a6612
mov byte [esp + 0x48], cl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ff68
push 0x3724c002
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ff68
xor eax, eax
jmp 0x1000ff6d
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0x5020c873
mov byte [esp + 0x49], dl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ffac
push 0x1944542c
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ffac
push 0x684bf36a
call fcn.1000f1c0
add esp, 4
test eax, eax
je 0x1000ffb1
mov eax, 1
test al, al
setne al
add al, 0x30
push 0x2d90a0b9
mov byte [esp + 0x4a], al
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ffe2
push 0x68949900
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1000ffe2
xor eax, eax
jmp 0x1000ffe7
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0xa40fba0f
mov byte [esp + 0x4b], cl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x10010026
push 0x4efc83c5
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x10010026
push 0xa5914847
call fcn.1000f1c0
add esp, 4
test eax, eax
je 0x1001002b
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0xc39ae7f0
mov byte [esp + 0x4c], dl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1001005d
push 0x914e412c
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1001005d
xor eax, eax
jmp 0x10010062
mov eax, 1
test al, al
setne al
add al, 0x30
push 0x93b5637f
mov byte [esp + 0x4d], al
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x10010093
push 0xe2477f3
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x10010093
xor eax, eax
jmp 0x10010098
mov eax, 1
test al, al
setne cl
add cl, 0x30
push 0x2da5955c
mov byte [esp + 0x4e], cl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x100100ca
push 0x5779bb8c
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x100100ca
xor eax, eax
jmp 0x100100cf
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0x992bdc64
mov byte [esp + 0x4f], dl
call fcn.1000f1c0
test eax, eax
seta al
add al, 0x30
push 0xed4f37d8
mov byte [esp + 0x54], al
call fcn.1000f1c0
test eax, eax
seta cl
add cl, 0x30
push 0x82272400
mov byte [esp + 0x59], cl
call fcn.1000f1c0
add esp, 0xc
test eax, eax
ja 0x1001012c
push 0x9bbc6ad2
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x1001012c
xor eax, eax
jmp 0x10010131
mov eax, 1
test al, al
setne dl
add dl, 0x30
push 0xf7092721
mov byte [esp + 0x52], dl
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x10010163
push 0xe79c16ca
call fcn.1000f1c0
add esp, 4
test eax, eax
ja 0x10010163
xor eax, eax
jmp 0x10010168
mov eax, 1
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpynA]
test al, al
push esi
lea ecx, [esp + 0x34]
setne al
push ecx
add al, 0x30
push edi
mov byte [esp + 0x4c], al
call ebp
sub esp, 0x1c
mov ecx, esp
lea eax, [esp + 0x4c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
mov dword [esp + 0x2c], esp
mov byte [ecx + 4], 0
lea ebx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100101b0
sub eax, ebx
push eax
lea edx, [esp + 0x50]
push edx
call fcn.10002100
lea eax, [esp + 0x30]
push eax
call fcn.1000fad0
mov eax, dword [esp + 0x38]
mov ebx, 0x10
add esp, 0x20
cmp dword [esp + 0x2c], ebx
jae 0x100101e4
lea eax, [esp + 0x18]
push esi
push eax
push edi
call ebp
push 0x10038c30
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10010215
push esi
push edi
push eax
call ebp
cmp dword [esp + 0x2c], ebx
jb 0x10010241
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10021970
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
mov edx, dword [esp + 0x60]
push edx
push eax
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret