Function at 0x10008c50
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x10083280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
mov edx, ecx
sub edx, 0xd23c44a3
sub edx, 1
add edx, 0xd23c44a3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x92], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x91], al
mov dword [ebp - 0x98], 0x73beda0e
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x801f6f71
je 0x1000a293
jmp 0x10008cd4
mov eax, dword [ebp - 0xa0]
sub eax, 0x80997b88
je 0x10009d6d
jmp 0x10008cea
mov eax, dword [ebp - 0xa0]
sub eax, 0x84e1ff97
je 0x1000a349
jmp 0x10008d00
mov eax, dword [ebp - 0xa0]
sub eax, 0x87f54003
je 0x10009e13
jmp 0x10008d16
mov eax, dword [ebp - 0xa0]
sub eax, 0x914137f2
je 0x1000a156
jmp 0x10008d2c
mov eax, dword [ebp - 0xa0]
sub eax, 0x93f1cdb4
je 0x10009d5e
jmp 0x10008d42
mov eax, dword [ebp - 0xa0]
sub eax, 0x9487bfd9
je 0x10009587
jmp 0x10008d58
mov eax, dword [ebp - 0xa0]
sub eax, 0x9e1d26d3
je 0x10009536
jmp 0x10008d6e
mov eax, dword [ebp - 0xa0]
sub eax, 0xa113c5bd
je 0x1000971e
jmp 0x10008d84
mov eax, dword [ebp - 0xa0]
sub eax, 0xa3736b77
je 0x1000a1e7
jmp 0x10008d9a
mov eax, dword [ebp - 0xa0]
sub eax, 0xa8563d8f
je 0x100098a8
jmp 0x10008db0
mov eax, dword [ebp - 0xa0]
sub eax, 0xae7c161d
je 0x10009849
jmp 0x10008dc6
mov eax, dword [ebp - 0xa0]
sub eax, 0xb367a581
je 0x100097e1
jmp 0x10008ddc
mov eax, dword [ebp - 0xa0]
sub eax, 0xb55d5c84
je 0x10009c41
jmp 0x10008df2
mov eax, dword [ebp - 0xa0]
sub eax, 0xbbcedf63
je 0x10009b06
jmp 0x10008e08
mov eax, dword [ebp - 0xa0]
sub eax, 0xc5a9661a
je 0x10009e64
jmp 0x10008e1e
mov eax, dword [ebp - 0xa0]
sub eax, 0xc692263c
je 0x1000a060
jmp 0x10008e34
mov eax, dword [ebp - 0xa0]
sub eax, 0xc784ab0d
je 0x10009ba6
jmp 0x10008e4a
mov eax, dword [ebp - 0xa0]
sub eax, 0xc84bf29e
je 0x100098c6
jmp 0x10008e60
mov eax, dword [ebp - 0xa0]
sub eax, 0xca0c5e5a
je 0x10009ee1
jmp 0x10008e76
mov eax, dword [ebp - 0xa0]
sub eax, 0xd67b3d77
je 0x10009b31
jmp 0x10008e8c
mov eax, dword [ebp - 0xa0]
sub eax, 0xda7e53fc
je 0x1000a369
jmp 0x10008ea2
mov eax, dword [ebp - 0xa0]
sub eax, 0xda9332f7
je 0x1000a33a
jmp 0x10008eb8
mov eax, dword [ebp - 0xa0]
sub eax, 0xdda72e4c
je 0x1000a0d6
jmp 0x10008ece
mov eax, dword [ebp - 0xa0]
sub eax, 0xdfc86c6c
je 0x1000a249
jmp 0x10008ee4
mov eax, dword [ebp - 0xa0]
sub eax, 0xdfe2ecda
je 0x1000969c
jmp 0x10008efa
mov eax, dword [ebp - 0xa0]
sub eax, 0xe1876554
je 0x10009995
jmp 0x10008f10
mov eax, dword [ebp - 0xa0]
sub eax, 0xe9e73bce
je 0x1000a2b7
jmp 0x10008f26
mov eax, dword [ebp - 0xa0]
sub eax, 0xfebdbdf0
je 0x1000990f
jmp 0x10008f3c
mov eax, dword [ebp - 0xa0]
sub eax, 0x3c5deb
je 0x1000a2a5
jmp 0x10008f52
mov eax, dword [ebp - 0xa0]
sub eax, 0xd4350f
je 0x10009a79
jmp 0x10008f68
mov eax, dword [ebp - 0xa0]
sub eax, 0x265aa97
je 0x10009c92
jmp 0x10008f7e
mov eax, dword [ebp - 0xa0]
sub eax, 0xc72525f
je 0x1000a1f6
jmp 0x10008f94
mov eax, dword [ebp - 0xa0]
sub eax, 0xcfd36cc
je 0x10009968
jmp 0x10008faa
mov eax, dword [ebp - 0xa0]
sub eax, 0xd8ffcd9
je 0x1000a00e
jmp 0x10008fc0
mov eax, dword [ebp - 0xa0]
sub eax, 0x1393799e
je 0x100096c6
jmp 0x10008fd6
mov eax, dword [ebp - 0xa0]
sub eax, 0x14c498ee
je 0x100092b4
jmp 0x10008fec
mov eax, dword [ebp - 0xa0]
sub eax, 0x1c363f0d
je 0x1000a051
jmp 0x10009002
mov eax, dword [ebp - 0xa0]
sub eax, 0x1d4ce169
je 0x10009ed2
jmp 0x10009018
mov eax, dword [ebp - 0xa0]
sub eax, 0x268090cd
je 0x10009a9f
jmp 0x1000902e
mov eax, dword [ebp - 0xa0]
sub eax, 0x28b40315
je 0x1000a01d
jmp 0x10009044
mov eax, dword [ebp - 0xa0]
sub eax, 0x2bd0cd1f
je 0x10009f1d
jmp 0x1000905a
mov eax, dword [ebp - 0xa0]
sub eax, 0x2ca9945a
je 0x10009bd6
jmp 0x10009070
mov eax, dword [ebp - 0xa0]
sub eax, 0x320b03d8
je 0x10009617
jmp 0x10009086
mov eax, dword [ebp - 0xa0]
sub eax, 0x3545ef19
je 0x1000a144
jmp 0x1000909c
mov eax, dword [ebp - 0xa0]
sub eax, 0x35b129fe
je 0x1000941d
jmp 0x100090b2
mov eax, dword [ebp - 0xa0]
sub eax, 0x422a9712
je 0x100097d2
jmp 0x100090c8
mov eax, dword [ebp - 0xa0]
sub eax, 0x4ca11efb
je 0x10009fac
jmp 0x100090de
mov eax, dword [ebp - 0xa0]
sub eax, 0x53cf070d
je 0x10009509
jmp 0x100090f4
mov eax, dword [ebp - 0xa0]
sub eax, 0x54e3befa
je 0x10009493
jmp 0x1000910a
mov eax, dword [ebp - 0xa0]
sub eax, 0x584e38b7
je 0x10009e04
jmp 0x10009120
mov eax, dword [ebp - 0xa0]
sub eax, 0x5a366b89
je 0x10009626
jmp 0x10009136
mov eax, dword [ebp - 0xa0]
sub eax, 0x5a68605a
je 0x10009a88
jmp 0x1000914c
mov eax, dword [ebp - 0xa0]
sub eax, 0x5b9c0bfd
je 0x10009527
jmp 0x10009162
mov eax, dword [ebp - 0xa0]
sub eax, 0x604668f6
je 0x10009b56
jmp 0x10009178
mov eax, dword [ebp - 0xa0]
sub eax, 0x68fb9244
je 0x10009b8f
jmp 0x1000918e
mov eax, dword [ebp - 0xa0]
sub eax, 0x6b449921
je 0x10009977
jmp 0x100091a4
mov eax, dword [ebp - 0xa0]
sub eax, 0x6b48604f
je 0x100096d5
jmp 0x100091ba
mov eax, dword [ebp - 0xa0]
sub eax, 0x6d6bc494
je 0x10009efa
jmp 0x100091d0
mov eax, dword [ebp - 0xa0]
sub eax, 0x6de01b68
je 0x10009800
jmp 0x100091e6
mov eax, dword [ebp - 0xa0]
sub eax, 0x6fad3778
je 0x10009b6f
jmp 0x100091fc
mov eax, dword [ebp - 0xa0]
sub eax, 0x73beda0e
je 0x10009285
jmp 0x10009212
mov eax, dword [ebp - 0xa0]
sub eax, 0x7601b822
je 0x100093fd
jmp 0x10009228
mov eax, dword [ebp - 0xa0]
sub eax, 0x771dcc77
je 0x100093ee
jmp 0x1000923e
mov eax, dword [ebp - 0xa0]
sub eax, 0x7b30213f
je 0x10009a03
mov al, byte [ebp - 0x92]
mov cl, byte [ebp - 0x91]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x914137f2
mov ecx, 0x14c498ee
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov ecx, dword [ebp - 0x9c]
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov edx, esp
mov dword [ebp - 0x90], edx
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0x8c], edx
push eax
mov edx, esp
mov dword [ebp - 0x88], edx
push eax
mov edx, esp
mov dword [ebp - 0x84], edx
sub esp, 0x104
mov edx, esp
mov dword [ebp - 0x80], edx
push eax
mov edx, esp
mov dword [ebp - 0x7c], edx
push eax
mov edx, esp
mov dword [ebp - 0x78], edx
push eax
mov edx, esp
mov dword [ebp - 0x74], edx
push eax
mov edx, esp
mov dword [ebp - 0x70], edx
push eax
mov edx, esp
mov dword [ebp - 0x6c], edx
push eax
mov edx, esp
mov dword [ebp - 0x68], edx
push eax
mov edx, esp
mov dword [ebp - 0x64], edx
push eax
mov edx, esp
mov dword [ebp - 0x60], edx
push eax
mov edx, esp
mov dword [ebp - 0x5c], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100247d0
mov eax, dword [ebp - 0xa4]
add esp, 0xc
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x914137f2
mov ecx, 0x771dcc77
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0x7601b822
jmp 0x1000a373
mov eax, dword [ebp - 0x88]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov dword [ebp - 0x98], 0x35b129fe
jmp 0x1000a373
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
mov edx, ecx
sub edx, 0xc1160b4f
sub edx, 1
add edx, 0xc1160b4f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa3736b77
mov ecx, 0x54e3befa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
mov edx, ecx
add edx, 0x8e01c387
sub edx, 1
sub edx, 0x8e01c387
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa3736b77
mov ecx, 0x53cf070d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dl, byte [ebp - 0x55]
mov eax, 0x5b9c0bfd
mov ecx, 0x9e1d26d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0xc692263c
jmp 0x1000a373
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
sub edx, 0xd3954ae
sub edx, 1
add edx, 0xd3954ae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc72525f
mov ecx, 0x9487bfd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x54], eax
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc72525f
mov ecx, 0x320b03d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0x5a366b89
jmp 0x1000a373
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x54]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x98], 0xdfe2ecda
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x7c]
mov esi, 0xffffffff
mov eax, 0x6b48604f
mov ecx, 0x1393799e
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0xc692263c
jmp 0x1000a373
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdfc86c6c
mov ecx, 0xa113c5bd
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
mov edx, ecx
add edx, 0xe5cd4511
sub edx, 1
sub edx, 0xe5cd4511
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdfc86c6c
mov ecx, 0x422a9712
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0xb367a581
jmp 0x1000a373
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x98], 0x6de01b68
jmp 0x1000a373
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x801f6f71
mov ecx, 0xae7c161d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [ebp - 0x48]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x41], al
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
add edx, 0x26a67679
sub edx, 1
sub edx, 0x26a67679
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x801f6f71
mov ecx, 0xa8563d8f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dl, byte [ebp - 0x41]
mov eax, 0xc84bf29e
mov ecx, 0x5a68605a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c5deb
mov ecx, 0xfebdbdf0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
sub edx, 0x6d1d2a6b
sub edx, 1
add edx, 0x6d1d2a6b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3c5deb
mov ecx, 0xcfd36cc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0x6b449921
jmp 0x1000a373
mov eax, dword [ebp - 0x40]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xe1876554
jmp 0x1000a373
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe9e73bce
mov ecx, 0x7b30213f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0xc692263c
jmp 0x1000a373
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x98], 0x268090cd
jmp 0x1000a373
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x98], 0xbbcedf63
jmp 0x1000a373
mov eax, dword [ebp - 0x34]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x38]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x68]
mov word [eax], 0
mov dword [ebp - 0x98], 0xd67b3d77
jmp 0x1000a373
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov ax, word [eax + 6]
mov word [ebp - 0x2a], ax
mov dword [ebp - 0x98], 0x604668f6
jmp 0x1000a373
mov ax, word [ebp - 0x2a]
movzx eax, ax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x98], 0x6fad3778
jmp 0x1000a373
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
mov eax, 0x7f2ea7cb
mov ecx, 0x68fb9244
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x98], 0xc784ab0d
jmp 0x1000a373
mov eax, dword [ebp - 0x24]
add eax, 0x21e144d6
add eax, 0x18
sub eax, 0x21e144d6
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
add eax, 4
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x98], 0x2ca9945a
jmp 0x1000a373
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x20]
add ecx, 0xf9af9870
add ecx, eax
sub ecx, 0xf9af9870
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x50aa9e22
add ecx, eax
sub ecx, 0x50aa9e22
mov eax, dword [ebp - 0x64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x10031930
call fcn.10028130
add esp, 8
mov edx, eax
mov eax, 0xb55d5c84
mov ecx, 0x87f54003
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
sub edx, 0x5ba4c9a8
sub edx, 1
add edx, 0x5ba4c9a8
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c64b2d1
mov ecx, 0x265aa97
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov eax, dword [ebp - 0x60]
mov dword [eax], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov edx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x93eba97c
add eax, ecx
sub eax, 0x93eba97c
mov dword [ebp - 0x18], eax
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
sub edx, 0x8ae6cee5
sub edx, 1
add edx, 0x8ae6cee5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7c64b2d1
mov ecx, 0x93f1cdb4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0x80997b88
jmp 0x1000a373
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0xf859f502
add ecx, eax
add ecx, 0xf859f502
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10024930
add esp, 0xc
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x84]
mov esi, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x60]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x5c]
mov byte [eax], cl
mov dword [ebp - 0x98], 0x584e38b7
jmp 0x1000a373
mov dword [ebp - 0x98], 0x87f54003
jmp 0x1000a373
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
sub edx, 0x35aee4a3
sub edx, 1
add edx, 0x35aee4a3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xda9332f7
mov ecx, 0xc5a9661a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xda9332f7
mov ecx, 0x1d4ce169
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0xca0c5e5a
jmp 0x1000a373
mov eax, dword [ebp - 0x68]
mov ax, word [eax]
mov word [ebp - 0x14], ax
mov dword [ebp - 0x98], 0x6d6bc494
jmp 0x1000a373
mov ax, word [ebp - 0x14]
sub ax, 0x9bf
add ax, 1
add ax, 0x9bf
mov word [ebp - 0x12], ax
mov dword [ebp - 0x98], 0x2bd0cd1f
jmp 0x1000a373
mov eax, dword [ebp - 0x68]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0x98], 0xd67b3d77
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1008476c]
mov ecx, dword [0x10084768]
mov edx, eax
sub edx, 0xd7c90869
sub edx, 1
add edx, 0xd7c90869
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x84e1ff97
mov ecx, 0xd8ffcd9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov dword [ebp - 0x98], 0x28b40315
jmp 0x1000a373
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x1c363f0d
jmp 0x1000a373
mov dword [ebp - 0x98], 0xc692263c
jmp 0x1000a373
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
mov edx, ecx
add edx, 0xdb3392a7
sub edx, 1
sub edx, 0xdb3392a7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xda7e53fc
mov ecx, 0xdda72e4c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov ecx, dword [0x1008476c]
mov eax, dword [0x10084768]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xda7e53fc
mov ecx, 0x3545ef19
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x1000a373
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10023a30
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x9c]
push eax
mov eax, esp
mov dword [ebp - 0xac], eax
push eax
mov edx, esp
mov dword [ebp - 0xb4], edx
sub esp, 0xc
mov edx, esp
mov dword [ebp - 0xb0], edx
push eax
mov edx, esp
mov dword [ebp - 0xa8], edx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0xb4]
mov edx, eax
mov eax, dword [ebp - 0xb0]
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.100247d0
mov eax, dword [ebp - 0xac]
add esp, 0xc
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0x14c498ee
jmp 0x1000a373
mov dword [ebp - 0x98], 0x54e3befa
jmp 0x1000a373
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov edx, dword [eax]
mov eax, dword [ebp - 0x8c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x98], 0x9487bfd9
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x98], 0xa113c5bd
jmp 0x1000a373
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x98], 0xae7c161d
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x98], 0xfebdbdf0
jmp 0x1000a373
mov dword [ebp - 0x98], 0x7b30213f
jmp 0x1000a373
mov dword [ebp - 0x98], 0xc5a9661a
jmp 0x1000a373
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x4ca11efb
jmp 0x1000a373
mov dword [ebp - 0x98], 0xdda72e4c
jmp 0x10008cb8