Function at 0x10009000
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1008b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
sub edx, 0xdd33bc9d
sub edx, 1
add edx, 0xdd33bc9d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x8e], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x8d], al
mov dword [ebp - 0x94], 0xee72ad0d
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x9c], eax
sub eax, 0x84d15a65
je 0x1000ad38
jmp 0x10009084
mov eax, dword [ebp - 0x9c]
sub eax, 0x859ac809
je 0x1000a732
jmp 0x1000909a
mov eax, dword [ebp - 0x9c]
sub eax, 0x89c8e389
je 0x1000a306
jmp 0x100090b0
mov eax, dword [ebp - 0x9c]
sub eax, 0x8b95ec6b
je 0x1000a9f1
jmp 0x100090c6
mov eax, dword [ebp - 0x9c]
sub eax, 0x8d7c571d
je 0x1000a92a
jmp 0x100090dc
mov eax, dword [ebp - 0x9c]
sub eax, 0x908a469c
je 0x10009d58
jmp 0x100090f2
mov eax, dword [ebp - 0x9c]
sub eax, 0x91c0bfba
je 0x1000a5fb
jmp 0x10009108
mov eax, dword [ebp - 0x9c]
sub eax, 0x93aa4741
je 0x1000af2a
jmp 0x1000911e
mov eax, dword [ebp - 0x9c]
sub eax, 0x979ba693
je 0x10009c6c
jmp 0x10009134
mov eax, dword [ebp - 0x9c]
sub eax, 0x97d78d97
je 0x1000afdd
jmp 0x1000914a
mov eax, dword [ebp - 0x9c]
sub eax, 0x99f56ac1
je 0x10009a1c
jmp 0x10009160
mov eax, dword [ebp - 0x9c]
sub eax, 0x9c1732cf
je 0x1000a116
jmp 0x10009176
mov eax, dword [ebp - 0x9c]
sub eax, 0x9c73ade6
je 0x1000a7a8
jmp 0x1000918c
mov eax, dword [ebp - 0x9c]
sub eax, 0x9e8b2e85
je 0x1000a05f
jmp 0x100091a2
mov eax, dword [ebp - 0x9c]
sub eax, 0xa4943fed
je 0x1000a552
jmp 0x100091b8
mov eax, dword [ebp - 0x9c]
sub eax, 0xa61bc10a
je 0x10009fb5
jmp 0x100091ce
mov eax, dword [ebp - 0x9c]
sub eax, 0xa81ddf4a
je 0x1000aaec
jmp 0x100091e4
mov eax, dword [ebp - 0x9c]
sub eax, 0xa8acb822
je 0x1000a827
jmp 0x100091fa
mov eax, dword [ebp - 0x9c]
sub eax, 0xb06a095f
je 0x1000aed0
jmp 0x10009210
mov eax, dword [ebp - 0x9c]
sub eax, 0xb46fcc56
je 0x10009ce2
jmp 0x10009226
mov eax, dword [ebp - 0x9c]
sub eax, 0xb5915114
je 0x10009a92
jmp 0x1000923c
mov eax, dword [ebp - 0x9c]
sub eax, 0xbba1df5f
je 0x1000a2a6
jmp 0x10009252
mov eax, dword [ebp - 0x9c]
sub eax, 0xbd118eac
je 0x1000ada6
jmp 0x10009268
mov eax, dword [ebp - 0x9c]
sub eax, 0xbe413158
je 0x1000b004
jmp 0x1000927e
mov eax, dword [ebp - 0x9c]
sub eax, 0xcf6f8867
je 0x10009874
jmp 0x10009294
mov eax, dword [ebp - 0x9c]
sub eax, 0xd5e0cfdc
je 0x10009948
jmp 0x100092aa
mov eax, dword [ebp - 0x9c]
sub eax, 0xd73e1a80
je 0x1000ae44
jmp 0x100092c0
mov eax, dword [ebp - 0x9c]
sub eax, 0xdb123bac
je 0x1000a06e
jmp 0x100092d6
mov eax, dword [ebp - 0x9c]
sub eax, 0xddce1514
je 0x1000a228
jmp 0x100092ec
mov eax, dword [ebp - 0x9c]
sub eax, 0xde201f96
je 0x1000a58b
jmp 0x10009302
mov eax, dword [ebp - 0x9c]
sub eax, 0xe30caa9b
je 0x1000a572
jmp 0x10009318
mov eax, dword [ebp - 0x9c]
sub eax, 0xe364d083
je 0x100098d7
jmp 0x1000932e
mov eax, dword [ebp - 0x9c]
sub eax, 0xe51bc486
je 0x1000aeb2
jmp 0x10009344
mov eax, dword [ebp - 0x9c]
sub eax, 0xe652c596
je 0x1000a9a0
jmp 0x1000935a
mov eax, dword [ebp - 0x9c]
sub eax, 0xe6c03cae
je 0x1000aa00
jmp 0x10009370
mov eax, dword [ebp - 0x9c]
sub eax, 0xee72ad0d
je 0x10009845
jmp 0x10009386
mov eax, dword [ebp - 0x9c]
sub eax, 0xf037f695
je 0x10009bd6
jmp 0x1000939c
mov eax, dword [ebp - 0x9c]
sub eax, 0xf1daebf5
je 0x1000af65
jmp 0x100093b2
mov eax, dword [ebp - 0x9c]
sub eax, 0xf52e095e
je 0x1000a428
jmp 0x100093c8
mov eax, dword [ebp - 0x9c]
sub eax, 0xf65f00f3
je 0x10009aa1
jmp 0x100093de
mov eax, dword [ebp - 0x9c]
sub eax, 0xf8edea8b
je 0x10009f30
jmp 0x100093f4
mov eax, dword [ebp - 0x9c]
sub eax, 0xfc057d29
je 0x1000ae62
jmp 0x1000940a
mov eax, dword [ebp - 0x9c]
sub eax, 0xfc54752e
je 0x10009dec
jmp 0x10009420
mov eax, dword [ebp - 0x9c]
sub eax, 0x2a9768a
je 0x1000a4bd
jmp 0x10009436
mov eax, dword [ebp - 0x9c]
sub eax, 0x54c41fb
je 0x10009b17
jmp 0x1000944c
mov eax, dword [ebp - 0x9c]
sub eax, 0x5c8712b
je 0x1000a2f7
jmp 0x10009462
mov eax, dword [ebp - 0x9c]
sub eax, 0x6aaf161
je 0x1000ab82
jmp 0x10009478
mov eax, dword [ebp - 0x9c]
sub eax, 0xd753b6d
je 0x1000b013
jmp 0x1000948e
mov eax, dword [ebp - 0x9c]
sub eax, 0x100f3a07
je 0x1000aafb
jmp 0x100094a4
mov eax, dword [ebp - 0x9c]
sub eax, 0x1101d1e4
je 0x10009edf
jmp 0x100094ba
mov eax, dword [ebp - 0x9c]
sub eax, 0x12d56a5d
je 0x1000af44
jmp 0x100094d0
mov eax, dword [ebp - 0x9c]
sub eax, 0x1bd22b01
je 0x1000a419
jmp 0x100094e6
mov eax, dword [ebp - 0x9c]
sub eax, 0x289da072
je 0x1000a0b7
jmp 0x100094fc
mov eax, dword [ebp - 0x9c]
sub eax, 0x2a2e9cfe
je 0x1000ab14
jmp 0x10009512
mov eax, dword [ebp - 0x9c]
sub eax, 0x2d99ef23
je 0x10009d76
jmp 0x10009528
mov eax, dword [ebp - 0x9c]
sub eax, 0x2ee97a28
je 0x1000a6a6
jmp 0x1000953e
mov eax, dword [ebp - 0x9c]
sub eax, 0x2ff8d25c
je 0x1000a255
jmp 0x10009554
mov eax, dword [ebp - 0x9c]
sub eax, 0x338b513f
je 0x1000a237
jmp 0x1000956a
mov eax, dword [ebp - 0x9c]
sub eax, 0x348be6bc
je 0x1000abe3
jmp 0x10009580
mov eax, dword [ebp - 0x9c]
sub eax, 0x353df718
je 0x1000b04c
jmp 0x10009596
mov eax, dword [ebp - 0x9c]
sub eax, 0x36444de0
je 0x1000afbe
jmp 0x100095ac
mov eax, dword [ebp - 0x9c]
sub eax, 0x374bcc4e
je 0x1000ac01
jmp 0x100095c2
mov eax, dword [ebp - 0x9c]
sub eax, 0x37cb1597
je 0x1000afec
jmp 0x100095d8
mov eax, dword [ebp - 0x9c]
sub eax, 0x38d2cd52
je 0x100099cb
jmp 0x100095ee
mov eax, dword [ebp - 0x9c]
sub eax, 0x3bbe3651
je 0x1000a543
mov al, byte [ebp - 0x8e]
mov cl, byte [ebp - 0x8d]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd73e1a80
mov ecx, 0xcf6f8867
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
mov edx, eax
sub edx, 0x786cbddc
sub edx, 1
add edx, 0x786cbddc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd73e1a80
mov ecx, 0xe364d083
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x3cfc0eff
jmp 0x1000b08b
mov ecx, dword [ebp - 0x98]
push eax
mov eax, esp
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1001e860
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov edx, dword [ebp - 0x80]
mov eax, 0x38d2cd52
mov ecx, 0xf65f00f3
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
mov edx, eax
add edx, 0xd197174c
sub edx, 1
sub edx, 0xd197174c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6e621972
mov ecx, 0x99f56ac1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
sub edx, 0x565e6207
sub edx, 1
add edx, 0x565e6207
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x6e621972
mov ecx, 0xb5915114
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x5aa2acc9
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
add edx, 0xa35ec251
sub edx, 1
sub edx, 0xa35ec251
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc057d29
mov ecx, 0x54c41fb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
sub edx, 0x54e81471
sub edx, 1
add edx, 0x54e81471
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfc057d29
mov ecx, 0xf037f695
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x77769597
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
sub edx, 0x67a4a99b
sub edx, 1
add edx, 0x67a4a99b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe51bc486
mov ecx, 0xb46fcc56
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
add edx, 0xcba94d4c
sub edx, 1
sub edx, 0xcba94d4c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xe51bc486
mov ecx, 0x908a469c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dl, byte [ebp - 0x45]
mov eax, 0x6e574a39
mov ecx, 0x2d99ef23
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
add edx, 0xabf88ee5
sub edx, 1
sub edx, 0xabf88ee5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7b50cbb4
mov ecx, 0xfc54752e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x7b50cbb4
mov ecx, 0x7ed03c5e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb06a095f
mov ecx, 0xf8edea8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x455190e5
jmp 0x1000b08b
mov eax, dword [ebp - 0x44]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5ac7223d
mov ecx, 0x9e8b2e85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0xdb123bac
jmp 0x1000b08b
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93aa4741
mov ecx, 0x289da072
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x39], al
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x93aa4741
mov ecx, 0x9c1732cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dl, byte [ebp - 0x39]
mov eax, 0x79d124ce
mov ecx, 0x89c8e389
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x338b513f
jmp 0x1000b08b
mov eax, dword [ebp - 0x38]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x2ff8d25c
jmp 0x1000b08b
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
mov edx, eax
add edx, 0x9067e68c
sub edx, 1
sub edx, 0x9067e68c
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7288b040
mov ecx, 0xbba1df5f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
mov edx, eax
add edx, 0x122ba016
sub edx, 1
sub edx, 0x122ba016
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7288b040
mov ecx, 0x5c8712b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x5aa2acc9
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf1daebf5
mov ecx, 0x7b98cdeb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0xf52e095e
jmp 0x1000b08b
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x34]
add eax, 0xbfef53ed
add eax, ecx
sub eax, 0xbfef53ed
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x94], 0x44cb52d9
jmp 0x1000b08b
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
sub edx, 0xc003bdbb
sub edx, 1
add edx, 0xc003bdbb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x36444de0
mov ecx, 0x3bbe3651
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x94], 0xe30caa9b
jmp 0x1000b08b
mov eax, dword [ebp - 0x24]
movzx eax, word [eax + 6]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x94], 0xde201f96
jmp 0x1000b08b
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
mov eax, 0x374bcc4e
mov ecx, 0x51f06536
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1002c73f
call fcn.100221c0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x17], al
mov dword [ebp - 0x94], 0x4a6ad891
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x97d78d97
mov ecx, 0x491590e3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
sub edx, 0x52df6706
sub edx, 1
add edx, 0x52df6706
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37cb1597
mov ecx, 0x9c73ade6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
add edx, 0x69c7496a
sub edx, 1
sub edx, 0x69c7496a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x37cb1597
mov ecx, 0xa8acb822
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x641282bc
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
add edx, 0x610cbbab
sub edx, 1
sub edx, 0x610cbbab
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbe413158
mov ecx, 0xe652c596
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
mov edx, eax
add edx, 0xb7ad6d36
sub edx, 1
sub edx, 0xb7ad6d36
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbe413158
mov ecx, 0x8b95ec6b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0xe6c03cae
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
mov edx, ecx
add edx, 0x6f5fd973
sub edx, 1
sub edx, 0x6f5fd973
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd753b6d
mov ecx, 0x66e8f261
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x100f3a07
jmp 0x1000b08b
mov eax, dword [ebp - 0x60]
mov ax, word [eax]
mov word [ebp - 0x16], ax
mov dword [ebp - 0x94], 0x2a2e9cfe
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x65b08dde
mov ecx, 0x6aaf161
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov cx, word [ebp - 0x16]
sub cx, 0xb7a4
add cx, 1
add cx, 0xb7a4
mov eax, dword [ebp - 0x60]
mov word [eax], cx
mov eax, dword [0x1008c564]
mov ecx, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x65b08dde
mov ecx, 0x348be6bc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x56e04db2
jmp 0x1000b08b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], 0x46cf6790
jmp 0x1000b08b
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a0d8c42
mov ecx, 0xbd118eac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1008c564]
mov eax, dword [0x1008c560]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4a0d8c42
mov ecx, 0x67a2497a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x94], eax
jmp 0x1000b08b
mov dword [ebp - 0x94], 0xcf6f8867
jmp 0x1000b08b
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x88]
mov edx, dword [eax]
mov eax, dword [ebp - 0x84]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x94], 0x54c41fb
jmp 0x1000b08b
mov dword [ebp - 0x94], 0xb46fcc56
jmp 0x1000b08b
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x1101d1e4
jmp 0x1000b08b
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], 0x289da072
jmp 0x1000b08b
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x94], 0x46749bd1
jmp 0x1000b08b
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x94], 0x7b98cdeb
jmp 0x1000b08b
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov word [eax], 0
mov dword [ebp - 0x94], 0x2a9768a
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x2ee97a28
jmp 0x1000b08b
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
mov dword [ebp - 0x94], 0x9c73ade6
jmp 0x1000b08b
mov dword [ebp - 0x94], 0xe652c596
jmp 0x1000b08b
mov dword [ebp - 0x94], 0x66e8f261
jmp 0x1000b08b
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x94], 0x6f98999e
jmp 0x1000b08b
jmp 0x10009068