Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x9c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x10068800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x9c], 0xbc6e3dc1
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
sub eax, 0x8027fe3b
je 0x10002b43
jmp 0x100010f4
mov eax, dword [ebp - 0xa4]
sub eax, 0x817b6b8c
je 0x1000191b
jmp 0x1000110a
mov eax, dword [ebp - 0xa4]
sub eax, 0x851a5f3f
je 0x10001b2a
jmp 0x10001120
mov eax, dword [ebp - 0xa4]
sub eax, 0x89ac3768
je 0x10002a55
jmp 0x10001136
mov eax, dword [ebp - 0xa4]
sub eax, 0x89bb87cd
je 0x10001e0e
jmp 0x1000114c
mov eax, dword [ebp - 0xa4]
sub eax, 0x8bae3652
je 0x10001ad9
jmp 0x10001162
mov eax, dword [ebp - 0xa4]
sub eax, 0x8db5429f
je 0x10002800
jmp 0x10001178
mov eax, dword [ebp - 0xa4]
sub eax, 0x920c9168
je 0x10002307
jmp 0x1000118e
mov eax, dword [ebp - 0xa4]
sub eax, 0x9b4f5176
je 0x10002abc
jmp 0x100011a4
mov eax, dword [ebp - 0xa4]
sub eax, 0xa91850b6
je 0x10001bd8
jmp 0x100011ba
mov eax, dword [ebp - 0xa4]
sub eax, 0xaf8ecbaf
je 0x10002139
jmp 0x100011d0
mov eax, dword [ebp - 0xa4]
sub eax, 0xb2369228
je 0x10002547
jmp 0x100011e6
mov eax, dword [ebp - 0xa4]
sub eax, 0xb5c7e594
je 0x10002a75
jmp 0x100011fc
mov eax, dword [ebp - 0xa4]
sub eax, 0xbc4864b3
je 0x100023ab
jmp 0x10001212
mov eax, dword [ebp - 0xa4]
sub eax, 0xbc6e3dc1
je 0x10001755
jmp 0x10001228
mov eax, dword [ebp - 0xa4]
sub eax, 0xbe27b3b0
je 0x10002b31
jmp 0x1000123e
mov eax, dword [ebp - 0xa4]
sub eax, 0xc238d7c1
je 0x100029c1
jmp 0x10001254
mov eax, dword [ebp - 0xa4]
sub eax, 0xc8aeaf7f
je 0x1000217b
jmp 0x1000126a
mov eax, dword [ebp - 0xa4]
sub eax, 0xc8cd5eef
je 0x10002148
jmp 0x10001280
mov eax, dword [ebp - 0xa4]
sub eax, 0xca8362ab
je 0x1000246e
jmp 0x10001296
mov eax, dword [ebp - 0xa4]
sub eax, 0xcf3e9761
je 0x10001974
jmp 0x100012ac
mov eax, dword [ebp - 0xa4]
sub eax, 0xd1fd73b3
je 0x1000200a
jmp 0x100012c2
mov eax, dword [ebp - 0xa4]
sub eax, 0xd37081d7
je 0x100026f7
jmp 0x100012d8
mov eax, dword [ebp - 0xa4]
sub eax, 0xd3ad090c
je 0x100025fc
jmp 0x100012ee
mov eax, dword [ebp - 0xa4]
sub eax, 0xd3ae1d51
je 0x10001aca
jmp 0x10001304
mov eax, dword [ebp - 0xa4]
sub eax, 0xd53b593a
je 0x100027f1
jmp 0x1000131a
mov eax, dword [ebp - 0xa4]
sub eax, 0xecd300f2
je 0x10002672
jmp 0x10001330
mov eax, dword [ebp - 0xa4]
sub eax, 0xfecec6b8
je 0x100029a7
jmp 0x10001346
mov eax, dword [ebp - 0xa4]
sub eax, 0xff1e1fe3
je 0x10002931
jmp 0x1000135c
mov eax, dword [ebp - 0xa4]
sub eax, 0x1222dca
je 0x1000286f
jmp 0x10001372
mov eax, dword [ebp - 0xa4]
sub eax, 0x358564f
je 0x100023f8
jmp 0x10001388
mov eax, dword [ebp - 0xa4]
sub eax, 0x5a2d17b
je 0x1000222a
jmp 0x1000139e
mov eax, dword [ebp - 0xa4]
sub eax, 0x5eb3478
je 0x10001f1f
jmp 0x100013b4
mov eax, dword [ebp - 0xa4]
sub eax, 0x143eb480
je 0x10001f8d
jmp 0x100013ca
mov eax, dword [ebp - 0xa4]
sub eax, 0x15398c58
je 0x10001c55
jmp 0x100013e0
mov eax, dword [ebp - 0xa4]
sub eax, 0x178ecb2d
je 0x10001854
jmp 0x100013f6
mov eax, dword [ebp - 0xa4]
sub eax, 0x19f0b6b7
je 0x100027c9
jmp 0x1000140c
mov eax, dword [ebp - 0xa4]
sub eax, 0x1a0b8ad1
je 0x100026e8
jmp 0x10001422
mov eax, dword [ebp - 0xa4]
sub eax, 0x2241a2c0
je 0x10001e8b
jmp 0x10001438
mov eax, dword [ebp - 0xa4]
sub eax, 0x2580c644
je 0x1000207c
jmp 0x1000144e
mov eax, dword [ebp - 0xa4]
sub eax, 0x2795654b
je 0x10002a25
jmp 0x10001464
mov eax, dword [ebp - 0xa4]
sub eax, 0x27a2f0ec
je 0x10002b22
jmp 0x1000147a
mov eax, dword [ebp - 0xa4]
sub eax, 0x30e2ebbb
je 0x10002922
jmp 0x10001490
mov eax, dword [ebp - 0xa4]
sub eax, 0x327ef0ce
je 0x10002a37
jmp 0x100014a6
mov eax, dword [ebp - 0xa4]
sub eax, 0x34af84dc
je 0x10002276
jmp 0x100014bc
mov eax, dword [ebp - 0xa4]
sub eax, 0x3775ba5c
je 0x10001eea
jmp 0x100014d2
mov eax, dword [ebp - 0xa4]
sub eax, 0x3bfe0b8c
je 0x10002748
jmp 0x100014e8
mov eax, dword [ebp - 0xa4]
sub eax, 0x3f29d9ef
je 0x100017c3
jmp 0x100014fe
mov eax, dword [ebp - 0xa4]
sub eax, 0x42b8537a
je 0x100029d3
jmp 0x10001514
mov eax, dword [ebp - 0xa4]
sub eax, 0x47f3e022
je 0x10002538
jmp 0x1000152a
mov eax, dword [ebp - 0xa4]
sub eax, 0x4a05caa1
je 0x10001cd3
jmp 0x10001540
mov eax, dword [ebp - 0xa4]
sub eax, 0x4bb72a20
je 0x100028c0
jmp 0x10001556
mov eax, dword [ebp - 0xa4]
sub eax, 0x4c9a4808
je 0x10001863
jmp 0x1000156c
mov eax, dword [ebp - 0xa4]
sub eax, 0x4e2c95e0
je 0x10001ce2
jmp 0x10001582
mov eax, dword [ebp - 0xa4]
sub eax, 0x4fb22c59
je 0x10002258
jmp 0x10001598
mov eax, dword [ebp - 0xa4]
sub eax, 0x54657090
je 0x100023ba
jmp 0x100015ae
mov eax, dword [ebp - 0xa4]
sub eax, 0x5641c77d
je 0x10002851
jmp 0x100015c4
mov eax, dword [ebp - 0xa4]
sub eax, 0x565e8d95
je 0x100020cd
jmp 0x100015da
mov eax, dword [ebp - 0xa4]
sub eax, 0x5c128bcd
je 0x10001f08
jmp 0x100015f0
mov eax, dword [ebp - 0xa4]
sub eax, 0x5c444245
je 0x10001e1d
jmp 0x10001606
mov eax, dword [ebp - 0xa4]
sub eax, 0x5c8bf151
je 0x10002239
jmp 0x1000161c
mov eax, dword [ebp - 0xa4]
sub eax, 0x5f16e161
je 0x10002019
jmp 0x10001632
mov eax, dword [ebp - 0xa4]
sub eax, 0x65852b25
je 0x10002828
jmp 0x10001648
mov eax, dword [ebp - 0xa4]
sub eax, 0x685fbbcd
je 0x10001bba
jmp 0x1000165e
mov eax, dword [ebp - 0xa4]
sub eax, 0x695c530b
je 0x10001be7
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x30e2ebbb
mov ecx, 0x3f29d9ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0xf33089f4
sub edx, 1
add edx, 0xf33089f4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30e2ebbb
mov ecx, 0x178ecb2d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x4c9a4808
jmp 0x10002b4d
mov eax, dword [ebp - 0xa0]
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x74], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x6c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x68], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x64], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000c2e0
add esp, 0xc
mov eax, dword [ebp - 0x98]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x8c]
mov eax, 0x77644214
mov ecx, 0x817b6b8c
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x90]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x9c], 0xcf3e9761
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x79be4e4f
sub edx, 1
add edx, 0x79be4e4f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xff1e1fe3
mov ecx, 0x78764a1a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x8bae3652
jmp 0x10002b4d
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0xc85d4b7b
sub edx, 1
sub edx, 0xc85d4b7b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfecec6b8
mov ecx, 0x851a5f3f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, 0xffffffff
cmp dword [eax], ecx
sete al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x7c3ea912
sub edx, 1
add edx, 0x7c3ea912
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfecec6b8
mov ecx, 0x685fbbcd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dl, byte [ebp - 0x51]
mov eax, 0x695c530b
mov ecx, 0xa91850b6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x1222dca
jmp 0x10002b4d
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x6aaa6d1d
sub edx, 1
add edx, 0x6aaa6d1d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc238d7c1
mov ecx, 0x4a05caa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x4e2c95e0
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
add edx, 0xa95e1b87
sub edx, 1
sub edx, 0xa95e1b87
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x42b8537a
mov ecx, 0x6c49b06f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x5c444245
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2795654b
mov ecx, 0x2241a2c0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x4c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0xe0a85fc5
sub edx, 1
add edx, 0xe0a85fc5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2795654b
mov ecx, 0x3775ba5c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dl, byte [ebp - 0x45]
mov eax, 0x5c128bcd
mov ecx, 0x6c82fc3a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x9c], 0x5eb3478
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x327ef0ce
mov ecx, 0x143eb480
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x327ef0ce
mov ecx, 0xd1fd73b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x5f16e161
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x1222dca
jmp 0x10002b4d
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0x170584a6
sub edx, 1
sub edx, 0x170584a6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89ac3768
mov ecx, 0x565e8d95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0x7bd03d09
sub edx, 1
add edx, 0x7bd03d09
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x89ac3768
mov ecx, 0xaf8ecbaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0xc8cd5eef
jmp 0x10002b4d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x3c]
add ecx, 0x309645fb
add ecx, eax
sub ecx, 0x309645fb
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov word [eax], 0
mov dword [ebp - 0x9c], 0xc8aeaf7f
jmp 0x10002b4d
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb5c7e594
mov ecx, 0x7bc9e256
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x5c8bf151
jmp 0x10002b4d
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x29], al
mov dword [ebp - 0x9c], 0x4fb22c59
jmp 0x10002b4d
mov dl, byte [ebp - 0x29]
mov eax, 0x8db5429f
mov ecx, 0x34af84dc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
sub eax, 0x6e8451bd
add eax, ecx
add eax, 0x6e8451bd
mov ecx, dword [ebp - 0x6c]
movzx ecx, word [ecx]
imul ecx, ecx, 0x28
add eax, 0x5368f489
add eax, ecx
sub eax, 0x5368f489
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x9c], 0x7eb66236
jmp 0x10002b4d
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100183b0
call fcn.1000e650
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x8d187a4d
sub edx, 1
add edx, 0x8d187a4d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7e11dca5
mov ecx, 0xbc4864b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x54657090
jmp 0x10002b4d
mov dl, byte [ebp - 0x21]
mov eax, 0x797f317a
mov ecx, 0xd3ad090c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
add edx, 0x3057a2e3
sub edx, 1
sub edx, 0x3057a2e3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9b4f5176
mov ecx, 0xca8362ab
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub edx, eax
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
add edx, 0x1f20651
sub edx, 1
sub edx, 0x1f20651
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x9b4f5176
mov ecx, 0x47f3e022
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0xb2369228
jmp 0x10002b4d
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x1c]
add edx, 0xe39e1e28
add edx, eax
sub edx, 0xe39e1e28
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xa2fca06e
add ecx, eax
add ecx, 0xa2fca06e
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000c440
add esp, 0xc
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov esi, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xc3d83c6f
add esi, eax
add esi, 0xc3d83c6f
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov dword [ebp - 0x9c], 0xd3ad090c
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0xe157bb6c
sub edx, 1
add edx, 0xe157bb6c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x27a2f0ec
mov ecx, 0xecd300f2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x39bd4db0
sub edx, 1
add edx, 0x39bd4db0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x27a2f0ec
mov ecx, 0x1a0b8ad1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0xd37081d7
jmp 0x10002b4d
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0x17ff2061
sub edx, 1
sub edx, 0x17ff2061
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe27b3b0
mov ecx, 0x3bfe0b8c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [ebp - 0x6c]
mov ax, word [eax]
xor ecx, ecx
sub cx, 1
sub ax, cx
mov word [ebp - 0x16], ax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbe27b3b0
mov ecx, 0x19f0b6b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x7da78a85
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0xc8aeaf7f
jmp 0x10002b4d
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x9c], 0x65852b25
jmp 0x10002b4d
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x9c], 0x5641c77d
jmp 0x10002b4d
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0x1222dca
jmp 0x10002b4d
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0x1b66a74b
sub edx, 1
sub edx, 0x1b66a74b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8027fe3b
mov ecx, 0x4bb72a20
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0xe5b38c30
sub edx, 1
sub edx, 0xe5b38c30
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8027fe3b
mov ecx, 0x7d556aa0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x3f29d9ef
jmp 0x10002b4d
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x9c], 0x78764a1a
jmp 0x10002b4d
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x9c], 0x851a5f3f
jmp 0x10002b4d
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x9c], 0x15398c58
jmp 0x10002b4d
mov eax, dword [ebp - 0x50]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x9c], 0x6c49b06f
jmp 0x10002b4d
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x9c], 0x2241a2c0
jmp 0x10002b4d
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0x143eb480
jmp 0x10002b4d
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x9c], 0x565e8d95
jmp 0x10002b4d
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x9c], 0x7bc9e256
jmp 0x10002b4d
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x373e5c44
add edx, eax
sub edx, 0x373e5c44
mov eax, dword [ebp - 0x64]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x60]
mov byte [eax], cl
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x9c], 0xca8362ab
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0xecd300f2
jmp 0x10002b4d
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x9c], 0x3bfe0b8c
jmp 0x10002b4d
mov dword [ebp - 0x9c], 0x4bb72a20
jmp 0x100010d8