Function at 0x100011d0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
mov eax, dword [0x10074800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x9e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x9d], al
mov dword [ebp - 0xa4], 0xb9cd831f
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
sub eax, 0x81d6dfe8
je 0x10002a11
jmp 0x1000124b
mov eax, dword [ebp - 0xac]
sub eax, 0x87aadae9
je 0x100029af
jmp 0x10001261
mov eax, dword [ebp - 0xac]
sub eax, 0x8edae4d5
je 0x100023b4
jmp 0x10001277
mov eax, dword [ebp - 0xac]
sub eax, 0x9a3150b0
je 0x10001d59
jmp 0x1000128d
mov eax, dword [ebp - 0xac]
sub eax, 0x9a7fc64a
je 0x10002624
jmp 0x100012a3
mov eax, dword [ebp - 0xac]
sub eax, 0xa4f30b63
je 0x10001e8a
jmp 0x100012b9
mov eax, dword [ebp - 0xac]
sub eax, 0xa7e85acd
je 0x1000292a
jmp 0x100012cf
mov eax, dword [ebp - 0xac]
sub eax, 0xac1ff174
je 0x100019e6
jmp 0x100012e5
mov eax, dword [ebp - 0xac]
sub eax, 0xaf2f8887
je 0x10001fbb
jmp 0x100012fb
mov eax, dword [ebp - 0xac]
sub eax, 0xb1ce0fe8
je 0x10001c45
jmp 0x10001311
mov eax, dword [ebp - 0xac]
sub eax, 0xb5cad392
je 0x10002c55
jmp 0x10001327
mov eax, dword [ebp - 0xac]
sub eax, 0xb684cef6
je 0x10002b26
jmp 0x1000133d
mov eax, dword [ebp - 0xac]
sub eax, 0xb6b1dfc4
je 0x100027f0
jmp 0x10001353
mov eax, dword [ebp - 0xac]
sub eax, 0xb87c8b5f
je 0x10001e2a
jmp 0x10001369
mov eax, dword [ebp - 0xac]
sub eax, 0xb9cd831f
je 0x100018c2
jmp 0x1000137f
mov eax, dword [ebp - 0xac]
sub eax, 0xbb97988d
je 0x10002a99
jmp 0x10001395
mov eax, dword [ebp - 0xac]
sub eax, 0xbe2a8be1
je 0x10002b8b
jmp 0x100013ab
mov eax, dword [ebp - 0xac]
sub eax, 0xbf986fa1
je 0x100028ca
jmp 0x100013c1
mov eax, dword [ebp - 0xac]
sub eax, 0xc2ee7eb1
je 0x10001de1
jmp 0x100013d7
mov eax, dword [ebp - 0xac]
sub eax, 0xc4267653
je 0x100026ee
jmp 0x100013ed
mov eax, dword [ebp - 0xac]
sub eax, 0xc81338a3
je 0x10001a12
jmp 0x10001403
mov eax, dword [ebp - 0xac]
sub eax, 0xcae5b88f
je 0x10002a84
jmp 0x10001419
mov eax, dword [ebp - 0xac]
sub eax, 0xcf5eba21
je 0x1000220e
jmp 0x1000142f
mov eax, dword [ebp - 0xac]
sub eax, 0xd3e531cd
je 0x100020c5
jmp 0x10001445
mov eax, dword [ebp - 0xac]
sub eax, 0xd65da4e4
je 0x100022af
jmp 0x1000145b
mov eax, dword [ebp - 0xac]
sub eax, 0xdea6feb6
je 0x10002031
jmp 0x10001471
mov eax, dword [ebp - 0xac]
sub eax, 0xe0b660e0
je 0x100019d7
jmp 0x10001487
mov eax, dword [ebp - 0xac]
sub eax, 0xe45f8c9f
je 0x10001cc5
jmp 0x1000149d
mov eax, dword [ebp - 0xac]
sub eax, 0xe6ccde52
je 0x10002b64
jmp 0x100014b3
mov eax, dword [ebp - 0xac]
sub eax, 0xe76c1167
je 0x100024df
jmp 0x100014c9
mov eax, dword [ebp - 0xac]
sub eax, 0xeeaa649b
je 0x10002615
jmp 0x100014df
mov eax, dword [ebp - 0xac]
sub eax, 0xf1961067
je 0x10001ce3
jmp 0x100014f5
mov eax, dword [ebp - 0xac]
sub eax, 0xf21d1b2e
je 0x10002555
jmp 0x1000150b
mov eax, dword [ebp - 0xac]
sub eax, 0xf3a55d18
je 0x10002b76
jmp 0x10001521
mov eax, dword [ebp - 0xac]
sub eax, 0xf3af9833
je 0x10001ca8
jmp 0x10001537
mov eax, dword [ebp - 0xac]
sub eax, 0xf5537136
je 0x10002260
jmp 0x1000154d
mov eax, dword [ebp - 0xac]
sub eax, 0xf686479c
je 0x1000211d
jmp 0x10001563
mov eax, dword [ebp - 0xac]
sub eax, 0xfa6b95a4
je 0x10002939
jmp 0x10001579
mov eax, dword [ebp - 0xac]
sub eax, 0xfb805c8d
je 0x1000280e
jmp 0x1000158f
mov eax, dword [ebp - 0xac]
sub eax, 0xfef1bc1c
je 0x10001c54
jmp 0x100015a5
mov eax, dword [ebp - 0xac]
sub eax, 0x20c3f9b
je 0x10002a00
jmp 0x100015bb
mov eax, dword [ebp - 0xac]
sub eax, 0x3a85ee8
je 0x10002be1
jmp 0x100015d1
mov eax, dword [ebp - 0xac]
sub eax, 0x74fef36
je 0x100021ae
jmp 0x100015e7
mov eax, dword [ebp - 0xac]
sub eax, 0xb3f55f8
je 0x10002ab7
jmp 0x100015fd
mov eax, dword [ebp - 0xac]
sub eax, 0x1025059f
je 0x10002831
jmp 0x10001613
mov eax, dword [ebp - 0xac]
sub eax, 0x15c34149
je 0x10002a20
jmp 0x10001629
mov eax, dword [ebp - 0xac]
sub eax, 0x1bf756b6
je 0x10002cae
jmp 0x1000163f
mov eax, dword [ebp - 0xac]
sub eax, 0x1f53310e
je 0x1000226f
jmp 0x10001655
mov eax, dword [ebp - 0xac]
sub eax, 0x27f9af1c
je 0x10001f1e
jmp 0x1000166b
mov eax, dword [ebp - 0xac]
sub eax, 0x3255fb25
je 0x100026fd
jmp 0x10001681
mov eax, dword [ebp - 0xac]
sub eax, 0x331e1c44
je 0x10002c90
jmp 0x10001697
mov eax, dword [ebp - 0xac]
sub eax, 0x345b592e
je 0x10001b14
jmp 0x100016ad
mov eax, dword [ebp - 0xac]
sub eax, 0x3532994e
je 0x10001a63
jmp 0x100016c3
mov eax, dword [ebp - 0xac]
sub eax, 0x38f095b2
je 0x10001fac
jmp 0x100016d9
mov eax, dword [ebp - 0xac]
sub eax, 0x3a5f985f
je 0x10002300
jmp 0x100016ef
mov eax, dword [ebp - 0xac]
sub eax, 0x3b922fae
je 0x100018f1
jmp 0x10001705
mov eax, dword [ebp - 0xac]
sub eax, 0x3c0fa431
je 0x10001b41
jmp 0x1000171b
mov eax, dword [ebp - 0xac]
sub eax, 0x3dc5602c
je 0x10001e99
jmp 0x10001731
mov eax, dword [ebp - 0xac]
sub eax, 0x430c894a
je 0x1000285c
jmp 0x10001747
mov eax, dword [ebp - 0xac]
sub eax, 0x4c384ee7
je 0x100027ff
jmp 0x1000175d
mov eax, dword [ebp - 0xac]
sub eax, 0x4c3a7c8d
je 0x10002716
jmp 0x10001773
mov eax, dword [ebp - 0xac]
sub eax, 0x4c64a448
je 0x10001b32
jmp 0x10001789
mov eax, dword [ebp - 0xac]
sub eax, 0x4e454f45
je 0x100020d4
jmp 0x1000179f
mov eax, dword [ebp - 0xac]
sub eax, 0x5537f7ca
je 0x10001ea8
jmp 0x100017b5
mov eax, dword [ebp - 0xac]
sub eax, 0x56951d3b
je 0x10001c20
mov al, byte [ebp - 0x9e]
mov cl, byte [ebp - 0x9d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x81d6dfe8
mov ecx, 0x3b922fae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
sub edx, 0x59ca082e
sub edx, 1
add edx, 0x59ca082e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x81d6dfe8
mov ecx, 0xe0b660e0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0xac1ff174
jmp 0x10002cb8
mov ecx, dword [ebp - 0xa8]
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xa4], 0xc81338a3
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0x71c17b91
sub edx, 1
sub edx, 0x71c17b91
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15c34149
mov ecx, 0x3532994e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000d800
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x59], al
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0xc7c9d47b
sub edx, 1
sub edx, 0xc7c9d47b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15c34149
mov ecx, 0x345b592e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dl, byte [ebp - 0x59]
mov eax, 0x4c64a448
mov ecx, 0x3c0fa431
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0xfa6b95a4
jmp 0x10002cb8
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax]
mov eax, dword [ebp - 0x94]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa4], 0x63063ab8
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0xfa6b95a4
jmp 0x10002cb8
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov dword [ebp - 0xa4], 0xf3af9833
jmp 0x10002cb8
mov eax, dword [ebp - 0x80]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov dword [ebp - 0xa4], 0xe45f8c9f
jmp 0x10002cb8
mov dl, byte [ebp - 0x4d]
mov eax, 0xf1961067
mov ecx, 0x5537f7ca
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
sub edx, 0x6edc7e29
sub edx, 1
add edx, 0x6edc7e29
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcae5b88f
mov ecx, 0x9a3150b0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xcae5b88f
mov ecx, 0x5ebfbfaa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb97988d
mov ecx, 0xb87c8b5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
sub edx, 0x995057a
sub edx, 1
add edx, 0x995057a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbb97988d
mov ecx, 0xa4f30b63
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x3dc5602c
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0xfa6b95a4
jmp 0x10002cb8
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
sub edx, 0xaf0d4120
sub edx, 1
add edx, 0xaf0d4120
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb3f55f8
mov ecx, 0x27f9af1c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb3f55f8
mov ecx, 0x38f095b2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0xaf2f8887
jmp 0x10002cb8
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
sub edx, 0x58046671
sub edx, 1
add edx, 0x58046671
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x761aa942
mov ecx, 0xdea6feb6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
add eax, 0x3c
mov dword [ebp - 0x40], eax
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
add edx, 0x9cfb572e
sub edx, 1
sub edx, 0x9cfb572e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x761aa942
mov ecx, 0xd3e531cd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x4e454f45
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb684cef6
mov ecx, 0xf686479c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
sub ecx, 0x190e8af5
add ecx, eax
add ecx, 0x190e8af5
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb684cef6
mov ecx, 0x74fef36
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x7ed6d902
jmp 0x10002cb8
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe6ccde52
mov ecx, 0xf5537136
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x1f53310e
jmp 0x10002cb8
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x36], ax
mov dword [ebp - 0xa4], 0x734bc69c
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0x53968f6
sub edx, 1
sub edx, 0x53968f6
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3a55d18
mov ecx, 0x3a5f985f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub eax, 0x917d7bb2
add eax, 0x18
add eax, 0x917d7bb2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov ax, word [eax + 0x14]
mov word [ebp - 0x2e], ax
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0xb17ac682
sub edx, 1
sub edx, 0xb17ac682
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3a55d18
mov ecx, 0x577385ba
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
sub edx, 0xe82c05e8
sub edx, 1
add edx, 0xe82c05e8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe2a8be1
mov ecx, 0x70354bbc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
sub edx, 0x1c3413aa
sub edx, 1
add edx, 0x1c3413aa
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3a85ee8
mov ecx, 0xf21d1b2e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0x65e0e4b9
sub edx, 1
sub edx, 0x65e0e4b9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3a85ee8
mov ecx, 0xeeaa649b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x9a7fc64a
jmp 0x10002cb8
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x24]
add eax, 0x59bef63e
add eax, ecx
sub eax, 0x59bef63e
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
sub eax, 0x7cf5091b
add eax, ecx
add eax, 0x7cf5091b
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa4], 0x6e9ee959
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x3255fb25
jmp 0x10002cb8
mov eax, dword [ebp - 0x70]
mov ax, word [eax]
mov word [ebp - 0x12], ax
mov dword [ebp - 0xa4], 0x4c3a7c8d
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0xc32660c0
sub edx, 1
sub edx, 0xc32660c0
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb5cad392
mov ecx, 0x69f1321b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x4c384ee7
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x7ed6d902
jmp 0x10002cb8
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0x1025059f
jmp 0x10002cb8
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa4], 0x430c894a
jmp 0x10002cb8
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x331e1c44
mov ecx, 0xbf986fa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0xaeb3d87e
sub edx, 1
sub edx, 0xaeb3d87e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x331e1c44
mov ecx, 0xa7e85acd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0xfa6b95a4
jmp 0x10002cb8
mov ecx, dword [0x10075b40]
mov eax, dword [0x10075b3c]
mov edx, ecx
sub edx, 0x3c4fb189
sub edx, 1
add edx, 0x3c4fb189
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1bf756b6
mov ecx, 0x87aadae9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov eax, dword [0x10075b40]
mov ecx, dword [0x10075b3c]
mov edx, eax
add edx, 0xab0515b1
sub edx, 1
sub edx, 0xab0515b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1bf756b6
mov ecx, 0x20c3f9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa4], eax
jmp 0x10002cb8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000cc00
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xa4], 0x3b922fae
jmp 0x10002cb8
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000d800
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa4], 0x3532994e
jmp 0x10002cb8
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xa4], 0x9a3150b0
jmp 0x10002cb8
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xb87c8b5f
jmp 0x10002cb8
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa4], 0x27f9af1c
jmp 0x10002cb8
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
sub ecx, 0xd6f8c186
add ecx, eax
add ecx, 0xd6f8c186
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov dword [ebp - 0xa4], 0xf686479c
jmp 0x10002cb8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa4], 0xcf5eba21
jmp 0x10002cb8
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xa4], 0x3a5f985f
jmp 0x10002cb8
mov ax, word [ebp - 0x28]
movzx eax, ax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0xd3609a9e
add ecx, eax
add ecx, 0xd3609a9e
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000fb70
add esp, 8
mov dword [ebp - 0xa4], 0x70354bbc
jmp 0x10002cb8
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x64]
mov byte [eax], cl
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa4], 0xf21d1b2e
jmp 0x10002cb8
mov ax, word [ebp - 0x12]
mov ax, word [ebp - 0x12]
mov ax, word [ebp - 0x12]
mov ax, word [ebp - 0x12]
mov ax, word [ebp - 0x12]
mov cx, word [ebp - 0x12]
add cx, 0xcd4d
add cx, 1
sub cx, 0xcd4d
mov eax, dword [ebp - 0x70]
mov word [eax], cx
mov dword [ebp - 0xa4], 0x69f1321b
jmp 0x10002cb8
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa4], 0xbf986fa1
jmp 0x10002cb8
mov dword [ebp - 0xa4], 0x87aadae9
jmp 0x1000122f