Function at 0x10001380
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x98
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov eax, dword [0x1006ca00]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x9c], 0x8e57d26
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
sub eax, 0x81a62bcb
je 0x10003ac6
jmp 0x100013c5
mov eax, dword [ebp - 0xa4]
sub eax, 0x84324d86
je 0x10003910
jmp 0x100013db
mov eax, dword [ebp - 0xa4]
sub eax, 0x8501ab15
je 0x10003b85
jmp 0x100013f1
mov eax, dword [ebp - 0xa4]
sub eax, 0x85eba558
je 0x10003cc4
jmp 0x10001407
mov eax, dword [ebp - 0xa4]
sub eax, 0x85f491cf
je 0x100029cf
jmp 0x1000141d
mov eax, dword [ebp - 0xa4]
sub eax, 0x869617dc
je 0x10004142
jmp 0x10001433
mov eax, dword [ebp - 0xa4]
sub eax, 0x88f2fa1d
je 0x10003318
jmp 0x10001449
mov eax, dword [ebp - 0xa4]
sub eax, 0x8b51712f
je 0x100045e1
jmp 0x1000145f
mov eax, dword [ebp - 0xa4]
sub eax, 0x8efd0fd4
je 0x10004562
jmp 0x10001475
mov eax, dword [ebp - 0xa4]
sub eax, 0x8f83d60e
je 0x100044d8
jmp 0x1000148b
mov eax, dword [ebp - 0xa4]
sub eax, 0x907e5428
je 0x10003ffd
jmp 0x100014a1
mov eax, dword [ebp - 0xa4]
sub eax, 0x93d82adb
je 0x1000231b
jmp 0x100014b7
mov eax, dword [ebp - 0xa4]
sub eax, 0x93ebfd29
je 0x10004469
jmp 0x100014cd
mov eax, dword [ebp - 0xa4]
sub eax, 0x95aef61a
je 0x100025e3
jmp 0x100014e3
mov eax, dword [ebp - 0xa4]
sub eax, 0x9991bc3d
je 0x10002952
jmp 0x100014f9
mov eax, dword [ebp - 0xa4]
sub eax, 0x9cd3bf8d
je 0x10002bf9
jmp 0x1000150f
mov eax, dword [ebp - 0xa4]
sub eax, 0xa15729e8
je 0x10003514
jmp 0x10001525
mov eax, dword [ebp - 0xa4]
sub eax, 0xa1b41ed5
je 0x1000452c
jmp 0x1000153b
mov eax, dword [ebp - 0xa4]
sub eax, 0xa404166d
je 0x10003e71
jmp 0x10001551
mov eax, dword [ebp - 0xa4]
sub eax, 0xabbcc68d
je 0x100020cc
jmp 0x10001567
mov eax, dword [ebp - 0xa4]
sub eax, 0xaccbae72
je 0x1000431d
jmp 0x1000157d
mov eax, dword [ebp - 0xa4]
sub eax, 0xafe8c246
je 0x100035bd
jmp 0x10001593
mov eax, dword [ebp - 0xa4]
sub eax, 0xb1732385
je 0x10002e84
jmp 0x100015a9
mov eax, dword [ebp - 0xa4]
sub eax, 0xb2b73350
je 0x10003b34
jmp 0x100015bf
mov eax, dword [ebp - 0xa4]
sub eax, 0xb3c3d55b
je 0x10003d24
jmp 0x100015d5
mov eax, dword [ebp - 0xa4]
sub eax, 0xb525db09
je 0x1000404c
jmp 0x100015eb
mov eax, dword [ebp - 0xa4]
sub eax, 0xb79cef0f
je 0x10003e9a
jmp 0x10001601
mov eax, dword [ebp - 0xa4]
sub eax, 0xb872d1b8
je 0x100043fb
jmp 0x10001617
mov eax, dword [ebp - 0xa4]
sub eax, 0xbabb0a30
je 0x10002575
jmp 0x1000162d
mov eax, dword [ebp - 0xa4]
sub eax, 0xbafa2b20
je 0x10002a7d
jmp 0x10001643
mov eax, dword [ebp - 0xa4]
sub eax, 0xbb5e814a
je 0x100044e7
jmp 0x10001659
mov eax, dword [ebp - 0xa4]
sub eax, 0xbccf7dfb
je 0x10003a36
jmp 0x1000166f
mov eax, dword [ebp - 0xa4]
sub eax, 0xbd1d4710
je 0x100037e1
jmp 0x10001685
mov eax, dword [ebp - 0xa4]
sub eax, 0xbf7958c4
je 0x100044b1
jmp 0x1000169b
mov eax, dword [ebp - 0xa4]
sub eax, 0xc1befbaf
je 0x10003cb2
jmp 0x100016b1
mov eax, dword [ebp - 0xa4]
sub eax, 0xc640dd2b
je 0x10003eb8
jmp 0x100016c7
mov eax, dword [ebp - 0xa4]
sub eax, 0xc7ca9d30
je 0x10003496
jmp 0x100016dd
mov eax, dword [ebp - 0xa4]
sub eax, 0xc985b12a
je 0x10002a18
jmp 0x100016f3
mov eax, dword [ebp - 0xa4]
sub eax, 0xcb4d7a68
je 0x10002143
jmp 0x10001709
mov eax, dword [ebp - 0xa4]
sub eax, 0xcc5cab81
je 0x10002c6f
jmp 0x1000171f
mov eax, dword [ebp - 0xa4]
sub eax, 0xcc7470a6
je 0x100038b8
jmp 0x10001735
mov eax, dword [ebp - 0xa4]
sub eax, 0xce70f956
je 0x10002b0d
jmp 0x1000174b
mov eax, dword [ebp - 0xa4]
sub eax, 0xd2e55348
je 0x10002a97
jmp 0x10001761
mov eax, dword [ebp - 0xa4]
sub eax, 0xd4b60694
je 0x1000267b
jmp 0x10001777
mov eax, dword [ebp - 0xa4]
sub eax, 0xd5a9cb64
je 0x10003693
jmp 0x1000178d
mov eax, dword [ebp - 0xa4]
sub eax, 0xd6e464dd
je 0x10003420
jmp 0x100017a3
mov eax, dword [ebp - 0xa4]
sub eax, 0xd8641d2b
je 0x1000405b
jmp 0x100017b9
mov eax, dword [ebp - 0xa4]
sub eax, 0xd8f0608a
je 0x100023c8
jmp 0x100017cf
mov eax, dword [ebp - 0xa4]
sub eax, 0xdadb03c1
je 0x1000217f
jmp 0x100017e5
mov eax, dword [ebp - 0xa4]
sub eax, 0xde39cc3f
je 0x100039fc
jmp 0x100017fb
mov eax, dword [ebp - 0xa4]
sub eax, 0xe595acea
je 0x10002723
jmp 0x10001811
mov eax, dword [ebp - 0xa4]
sub eax, 0xe5bcaa9c
je 0x10003e80
jmp 0x10001827
mov eax, dword [ebp - 0xa4]
sub eax, 0xe95b8f8f
je 0x10002961
jmp 0x1000183d
mov eax, dword [ebp - 0xa4]
sub eax, 0xec3d73c3
je 0x10002566
jmp 0x10001853
mov eax, dword [ebp - 0xa4]
sub eax, 0xec482e6f
je 0x10004571
jmp 0x10001869
mov eax, dword [ebp - 0xa4]
sub eax, 0xece2c78e
je 0x10003036
jmp 0x1000187f
mov eax, dword [ebp - 0xa4]
sub eax, 0xee89528e
je 0x10004737
jmp 0x10001895
mov eax, dword [ebp - 0xa4]
sub eax, 0xeebd8a23
je 0x10003411
jmp 0x100018ab
mov eax, dword [ebp - 0xa4]
sub eax, 0xf23c7e72
je 0x1000284c
jmp 0x100018c1
mov eax, dword [ebp - 0xa4]
sub eax, 0xf24eb56f
je 0x10003c69
jmp 0x100018d7
mov eax, dword [ebp - 0xa4]
sub eax, 0xf28b8557
je 0x10003764
jmp 0x100018ed
mov eax, dword [ebp - 0xa4]
sub eax, 0xf3de63b0
je 0x10004298
jmp 0x10001903
mov eax, dword [ebp - 0xa4]
sub eax, 0xf8e8fdca
je 0x10002b8b
jmp 0x10001919
mov eax, dword [ebp - 0xa4]
sub eax, 0xf93c8879
je 0x10002de5
jmp 0x1000192f
mov eax, dword [ebp - 0xa4]
sub eax, 0xfa56ac53
je 0x10004672
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
add edx, 0xa3d5de91
sub edx, 1
sub edx, 0xa3d5de91
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x85eba558
mov ecx, 0xcb4d7a68
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x67efa213
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
add edx, 0xcfa33cc2
sub edx, 1
sub edx, 0xcfa33cc2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbf7958c4
mov ecx, 0xffb17d53
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
add edx, 0x8ef3c4ea
sub edx, 1
sub edx, 0x8ef3c4ea
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x12b2519
mov ecx, 0x55b5f94e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
sub edx, 0x53630c4a
sub edx, 1
add edx, 0x53630c4a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8f83d60e
mov ecx, 0x63bde914
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0xbabb0a30
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbb5e814a
mov ecx, 0x95aef61a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x60]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbb5e814a
mov ecx, 0xd4b60694
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x1ea8238f
jmp 0x10004741
mov eax, dword [ebp - 0x58]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x9c], 0x7083472e
jmp 0x10004741
mov dl, byte [ebp - 0x49]
mov eax, 0x39207de
mov ecx, 0x36515d91
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0xe95b8f8f
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x160ff6a7
mov ecx, 0x85f491cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x160ff6a7
mov ecx, 0xc985b12a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x63c31f40
jmp 0x10004741
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x9c], 0xd2e55348
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0xfb8f91e2
sub edx, 1
add edx, 0xfb8f91e2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc640dd2b
mov ecx, 0xce70f956
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov word [eax], 0
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
add edx, 0x3b92c69d
sub edx, 1
sub edx, 0x3b92c69d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc640dd2b
mov ecx, 0x3ecad198
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x54b8b11f
mov ecx, 0x9cd3bf8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0x5d7bf96c
sub edx, 1
add edx, 0x5d7bf96c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa1b41ed5
mov ecx, 0xcc5cab81
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [ebp - 0x70]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0x28221648
sub edx, 1
add edx, 0x28221648
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa1b41ed5
mov ecx, 0x227f59ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0x84a7a37f
sub edx, 1
add edx, 0x84a7a37f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7974e7c0
mov ecx, 0xff71ddb9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ax, word [ebp - 0x36]
movzx esi, ax
mov edx, dword [ebp - 0x40]
mov eax, 0x3c45fad3
mov ecx, 0x3324ff3a
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x8efd0fd4
mov ecx, 0x788de902
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011640
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x8c]
mov esi, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xc0b2a2d1
add esi, eax
add esi, 0xc0b2a2d1
mov eax, dword [ebp - 0x68]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x23], al
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
add edx, 0x1da620d9
sub edx, 1
sub edx, 0x1da620d9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfc7cbda8
mov ecx, 0xeebd8a23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0xd6e464dd
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0xe1d7a0cb
sub edx, 1
add edx, 0xe1d7a0cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x249fe342
mov ecx, 0xc7ca9d30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [ebp - 0x64]
mov cl, byte [ebp - 0x23]
mov byte [eax], cl
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0x933a9c96
sub edx, 1
add edx, 0x933a9c96
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x249fe342
mov ecx, 0xa15729e8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
sub edx, 0xd68d2e6b
sub edx, 1
add edx, 0xd68d2e6b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x352efed0
mov ecx, 0x7159c31a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
add edx, 0x2521a3e8
sub edx, 1
sub edx, 0x2521a3e8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2ed78ca4
mov ecx, 0x730144fc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
add edx, 0x4ac2c85f
sub edx, 1
sub edx, 0x4ac2c85f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7dd765b7
mov ecx, 0x55e5417f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x499c2dc6
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a73101
mov ecx, 0x535a992b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x2471500d
mov ecx, 0x6429b92c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
add edx, 0xdfb0d1a1
sub edx, 1
sub edx, 0xdfb0d1a1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8b51712f
mov ecx, 0x176d18ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0xf8e8fdca
jmp 0x10004741
mov eax, dword [ebp - 0x20]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0xe1b124f
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x1a702693
mov ecx, 0xb2b73350
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
add edx, 0xb217d6c4
sub edx, 1
sub edx, 0xb217d6c4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6f1a25d9
mov ecx, 0x8501ab15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
mov edx, ecx
sub edx, 0xc456524b
sub edx, 1
add edx, 0xc456524b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6f1a25d9
mov ecx, 0x2c53f109
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x40391afc
mov ecx, 0xc1befbaf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100108b0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x9c], 0xabbcc68d
jmp 0x10004741
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d5b4c1a
mov ecx, 0x21362d13
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x3d788b53
jmp 0x10004741
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x9c], 0x5ada651a
jmp 0x10004741
mov eax, dword [ebp - 0x48]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x9c], 0xa236cb2
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x30e2c72a
mov ecx, 0x5dfbf139
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfa56ac53
mov ecx, 0xb525db09
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x9cd3bf8d
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7592abbc
mov ecx, 0x4d0c54d1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x4950d264
jmp 0x10004741
mov dword [ebp - 0x9c], 0x88f2fa1d
jmp 0x10004741
mov eax, dword [ebp - 0x64]
mov cl, byte [ebp - 0x23]
mov byte [eax], cl
mov eax, dword [0x1006dd48]
mov ecx, dword [0x1006dd44]
mov edx, eax
add edx, 0xde55c850
sub edx, 1
sub edx, 0xde55c850
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x138b7811
mov ecx, 0x4593c237
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov ecx, dword [0x1006dd48]
mov eax, dword [0x1006dd44]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xee89528e
mov ecx, 0x93ebfd29
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x9c], eax
jmp 0x10004741
mov dword [ebp - 0x9c], 0x730144fc
jmp 0x10004741
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x9c], 0xffb17d53
jmp 0x10004741
mov dword [ebp - 0x9c], 0x63bde914
jmp 0x10004741
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x60]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x9c], 0x95aef61a
jmp 0x10004741
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x9c], 0xcc5cab81
jmp 0x10004741
mov dword [ebp - 0x9c], 0x788de902
jmp 0x10004741
mov dword [ebp - 0x9c], 0x2b0dcc94
jmp 0x10004741
mov dword [ebp - 0x9c], 0x176d18ff
jmp 0x10004741
mov dword [ebp - 0x9c], 0xb872d1b8
jmp 0x100013a9