Function at 0x100010c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x94
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x100f4000]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
mov edx, ecx
add edx, 0xac3874e6
sub edx, 1
sub edx, 0xac3874e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0x92], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0x91], al
mov dword [ebp - 0x98], 0x3d4d3f72
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa0], eax
sub eax, 0x81305240
je 0x10001d4a
jmp 0x10001144
mov eax, dword [ebp - 0xa0]
sub eax, 0x8183ffa0
je 0x10002100
jmp 0x1000115a
mov eax, dword [ebp - 0xa0]
sub eax, 0x820c11e0
je 0x10001baf
jmp 0x10001170
mov eax, dword [ebp - 0xa0]
sub eax, 0x85ab298e
je 0x10001ef6
jmp 0x10001186
mov eax, dword [ebp - 0xa0]
sub eax, 0x96125d95
je 0x10002344
jmp 0x1000119c
mov eax, dword [ebp - 0xa0]
sub eax, 0x98412d8b
je 0x10001724
jmp 0x100011b2
mov eax, dword [ebp - 0xa0]
sub eax, 0x9d54d2ff
je 0x1000195f
jmp 0x100011c8
mov eax, dword [ebp - 0xa0]
sub eax, 0xa4f135e7
je 0x10002708
jmp 0x100011de
mov eax, dword [ebp - 0xa0]
sub eax, 0xa50c4fa1
je 0x1000241a
jmp 0x100011f4
mov eax, dword [ebp - 0xa0]
sub eax, 0xa61b8d10
je 0x10001932
jmp 0x1000120a
mov eax, dword [ebp - 0xa0]
sub eax, 0xa8d01221
je 0x100017a1
jmp 0x10001220
mov eax, dword [ebp - 0xa0]
sub eax, 0xa962d00b
je 0x10001950
jmp 0x10001236
mov eax, dword [ebp - 0xa0]
sub eax, 0xaa2192af
je 0x10001792
jmp 0x1000124c
mov eax, dword [ebp - 0xa0]
sub eax, 0xabd7fa12
je 0x10002565
jmp 0x10001262
mov eax, dword [ebp - 0xa0]
sub eax, 0xb03ce669
je 0x100017e2
jmp 0x10001278
mov eax, dword [ebp - 0xa0]
sub eax, 0xb383d078
je 0x10001e7f
jmp 0x1000128e
mov eax, dword [ebp - 0xa0]
sub eax, 0xb3a71e04
je 0x10001cc3
jmp 0x100012a4
mov eax, dword [ebp - 0xa0]
sub eax, 0xb72989b3
je 0x10002752
jmp 0x100012ba
mov eax, dword [ebp - 0xa0]
sub eax, 0xc49a585f
je 0x1000268e
jmp 0x100012d0
mov eax, dword [ebp - 0xa0]
sub eax, 0xc93b6250
je 0x100028e6
jmp 0x100012e6
mov eax, dword [ebp - 0xa0]
sub eax, 0xced975c1
je 0x10001a54
jmp 0x100012fc
mov eax, dword [ebp - 0xa0]
sub eax, 0xd0a84121
je 0x100025a6
jmp 0x10001312
mov eax, dword [ebp - 0xa0]
sub eax, 0xd0f12d86
je 0x10001ac2
jmp 0x10001328
mov eax, dword [ebp - 0xa0]
sub eax, 0xd50aa366
je 0x1000279e
jmp 0x1000133e
mov eax, dword [ebp - 0xa0]
sub eax, 0xd510f0b3
je 0x100021ee
jmp 0x10001354
mov eax, dword [ebp - 0xa0]
sub eax, 0xd522d33c
je 0x1000219d
jmp 0x1000136a
mov eax, dword [ebp - 0xa0]
sub eax, 0xe8776341
je 0x10001dc7
jmp 0x10001380
mov eax, dword [ebp - 0xa0]
sub eax, 0xeeeb1596
je 0x10001d15
jmp 0x10001396
mov eax, dword [ebp - 0xa0]
sub eax, 0xf53776d3
je 0x10001a45
jmp 0x100013ac
mov eax, dword [ebp - 0xa0]
sub eax, 0xf9446918
je 0x10001c34
jmp 0x100013c2
mov eax, dword [ebp - 0xa0]
sub eax, 0xfcd6703b
je 0x10002442
jmp 0x100013d8
mov eax, dword [ebp - 0xa0]
sub eax, 0xfe6fcf24
je 0x100027ff
jmp 0x100013ee
mov eax, dword [ebp - 0xa0]
sub eax, 0x49c913e
je 0x10001f94
jmp 0x10001404
mov eax, dword [ebp - 0xa0]
sub eax, 0x7019b27
je 0x10001fe1
jmp 0x1000141a
mov eax, dword [ebp - 0xa0]
sub eax, 0x7619504
je 0x10001d59
jmp 0x10001430
mov eax, dword [ebp - 0xa0]
sub eax, 0x8e787b9
je 0x1000247e
jmp 0x10001446
mov eax, dword [ebp - 0xa0]
sub eax, 0xf0d71ef
je 0x10001fbc
jmp 0x1000145c
mov eax, dword [ebp - 0xa0]
sub eax, 0xff330d7
je 0x10001cf7
jmp 0x10001472
mov eax, dword [ebp - 0xa0]
sub eax, 0x1638fa22
je 0x10001b7e
jmp 0x10001488
mov eax, dword [ebp - 0xa0]
sub eax, 0x24ca191a
je 0x100027d5
jmp 0x1000149e
mov eax, dword [ebp - 0xa0]
sub eax, 0x29e7ca50
je 0x10002353
jmp 0x100014b4
mov eax, dword [ebp - 0xa0]
sub eax, 0x2a73dee2
je 0x10001bbe
jmp 0x100014ca
mov eax, dword [ebp - 0xa0]
sub eax, 0x2d681e22
je 0x10002095
jmp 0x100014e0
mov eax, dword [ebp - 0xa0]
sub eax, 0x2db93d0e
je 0x10002186
jmp 0x100014f6
mov eax, dword [ebp - 0xa0]
sub eax, 0x306cb646
je 0x10001ea5
jmp 0x1000150c
mov eax, dword [ebp - 0xa0]
sub eax, 0x33163e3a
je 0x10002027
jmp 0x10001522
mov eax, dword [ebp - 0xa0]
sub eax, 0x35f25ef1
je 0x100024ef
jmp 0x10001538
mov eax, dword [ebp - 0xa0]
sub eax, 0x38eeeb07
je 0x10001e8e
jmp 0x1000154e
mov eax, dword [ebp - 0xa0]
sub eax, 0x3b082182
je 0x10001b8d
jmp 0x10001564
mov eax, dword [ebp - 0xa0]
sub eax, 0x3be6fb32
je 0x10002465
jmp 0x1000157a
mov eax, dword [ebp - 0xa0]
sub eax, 0x3c085e57
je 0x10002429
jmp 0x10001590
mov eax, dword [ebp - 0xa0]
sub eax, 0x3d4d3f72
je 0x100016f5
jmp 0x100015a6
mov eax, dword [ebp - 0xa0]
sub eax, 0x41d13a54
je 0x10001833
jmp 0x100015bc
mov eax, dword [ebp - 0xa0]
sub eax, 0x42ade5a7
je 0x10002163
jmp 0x100015d2
mov eax, dword [ebp - 0xa0]
sub eax, 0x44fa130e
je 0x1000210f
jmp 0x100015e8
mov eax, dword [ebp - 0xa0]
sub eax, 0x4f95b960
je 0x1000249e
jmp 0x100015fe
mov eax, dword [ebp - 0xa0]
sub eax, 0x53451d0a
je 0x10001d2c
jmp 0x10001614
mov eax, dword [ebp - 0xa0]
sub eax, 0x578abf83
je 0x100028f5
jmp 0x1000162a
mov eax, dword [ebp - 0xa0]
sub eax, 0x59607fb2
je 0x100023a4
jmp 0x10001640
mov eax, dword [ebp - 0xa0]
sub eax, 0x617b3ce0
je 0x10002574
jmp 0x10001656
mov eax, dword [ebp - 0xa0]
sub eax, 0x6908f9d7
je 0x10001cd2
jmp 0x1000166c
mov eax, dword [ebp - 0xa0]
sub eax, 0x70572e5f
je 0x1000263e
jmp 0x10001682
mov eax, dword [ebp - 0xa0]
sub eax, 0x7138ac7e
je 0x10002001
jmp 0x10001698
mov eax, dword [ebp - 0xa0]
sub eax, 0x7746abce
je 0x100019b0
jmp 0x100016ae
mov eax, dword [ebp - 0xa0]
sub eax, 0x7b0f3630
je 0x100025b8
mov al, byte [ebp - 0x92]
mov cl, byte [ebp - 0x91]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b0f3630
mov ecx, 0x98412d8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x88], eax
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
add edx, 0x5707f3d2
sub edx, 1
sub edx, 0x5707f3d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7b0f3630
mov ecx, 0xaa2192af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0xa8d01221
jmp 0x10002902
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x98], 0xb03ce669
jmp 0x10002902
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
add edx, 0xf52f15d3
sub edx, 1
sub edx, 0xf52f15d3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7dbdbbcd
mov ecx, 0x41d13a54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov ecx, dword [ebp - 0x9c]
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
push eax
mov eax, esp
mov dword [ebp - 0x64], eax
push eax
mov eax, esp
mov dword [ebp - 0x60], eax
push eax
mov eax, esp
mov dword [ebp - 0x5c], eax
push eax
mov eax, esp
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10008560
add esp, 0xc
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x51], al
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7dbdbbcd
mov ecx, 0xa61b8d10
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dl, byte [ebp - 0x51]
mov eax, 0xa962d00b
mov ecx, 0x9d54d2ff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0xd0a84121
jmp 0x10002902
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
add edx, 0xbc193d88
sub edx, 1
sub edx, 0xbc193d88
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70572e5f
mov ecx, 0x7746abce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x50], eax
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
add edx, 0x898da6e3
sub edx, 1
sub edx, 0x898da6e3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x70572e5f
mov ecx, 0xf53776d3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0xced975c1
jmp 0x10002902
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc49a585f
mov ecx, 0xd0f12d86
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
add edx, 0x54424883
sub edx, 1
sub edx, 0x54424883
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc49a585f
mov ecx, 0x1638fa22
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x3b082182
jmp 0x10002902
mov edx, dword [ebp - 0x78]
mov esi, 0xffffffff
mov eax, 0x2a73dee2
mov ecx, 0x820c11e0
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0xd0a84121
jmp 0x10002902
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
mov edx, ecx
add edx, 0xc8714556
sub edx, 1
sub edx, 0xc8714556
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa4f135e7
mov ecx, 0xf9446918
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
sub edx, 0x1c20d8db
sub edx, 1
add edx, 0x1c20d8db
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa4f135e7
mov ecx, 0xb3a71e04
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x6908f9d7
jmp 0x10002902
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x45], al
mov dword [ebp - 0x98], 0xff330d7
jmp 0x10002902
mov dl, byte [ebp - 0x45]
mov eax, 0xeeeb1596
mov ecx, 0x7619504
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x98], 0x53451d0a
jmp 0x10002902
mov eax, dword [ebp - 0x44]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x81305240
jmp 0x10002902
mov dword [ebp - 0x98], 0xd0a84121
jmp 0x10002902
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb72989b3
mov ecx, 0xe8776341
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
mov edx, ecx
sub edx, 0x1e9514fc
sub edx, 1
add edx, 0x1e9514fc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb72989b3
mov ecx, 0xb383d078
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x38eeeb07
jmp 0x10002902
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0x306cb646
jmp 0x10002902
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
add edx, 0x90455abc
sub edx, 1
sub edx, 0x90455abc
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd50aa366
mov ecx, 0x85ab298e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
mov edx, ecx
sub edx, 0x6feab4d4
sub edx, 1
add edx, 0x6feab4d4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd50aa366
mov ecx, 0x49c913e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x7bd61dc9
jmp 0x10002902
mov ax, word [ebp - 0x3a]
movzx eax, ax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x98], 0x7019b27
jmp 0x10002902
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, 0x8e787b9
mov ecx, 0x7138ac7e
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, 0x18
sub eax, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x98], 0x33163e3a
jmp 0x10002902
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x24ca191a
mov ecx, 0x2d681e22
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax + 0x14]
mov eax, dword [ebp - 0x30]
add eax, 0xb9410762
add eax, ecx
sub eax, 0xb9410762
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x64]
movzx eax, word [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24ca191a
mov ecx, 0x8183ffa0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x44fa130e
jmp 0x10002902
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x28]
sub ecx, 0xe1638276
add ecx, eax
add ecx, 0xe1638276
mov eax, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100141a0
call fcn.1000a8d0
add esp, 8
mov edx, eax
mov eax, 0x42ade5a7
mov ecx, 0x29e7ca50
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x98], 0x2db93d0e
jmp 0x10002902
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x98], 0xd522d33c
jmp 0x10002902
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
sub edx, 0x43b1ff70
sub edx, 1
add edx, 0x43b1ff70
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfe6fcf24
mov ecx, 0xd510f0b3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0xa9483df0
add edx, eax
sub edx, 0xa9483df0
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.100086c0
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add esi, 0x30320f52
add esi, eax
sub esi, 0x30320f52
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
mov edx, ecx
add edx, 0xa24d40ac
sub edx, 1
sub edx, 0xa24d40ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfe6fcf24
mov ecx, 0x96125d95
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x29e7ca50
jmp 0x10002902
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
sub edx, 0x7a3969af
sub edx, 1
add edx, 0x7a3969af
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc93b6250
mov ecx, 0x59607fb2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
mov edx, ecx
add edx, 0x7b214f8c
sub edx, 1
sub edx, 0x7b214f8c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc93b6250
mov ecx, 0xa50c4fa1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x3c085e57
jmp 0x10002902
mov eax, dword [ebp - 0x64]
mov ax, word [eax]
mov word [ebp - 0x18], ax
mov dword [ebp - 0x98], 0xfcd6703b
jmp 0x10002902
mov ax, word [ebp - 0x18]
add ax, 0x910e
add ax, 1
sub ax, 0x910e
mov word [ebp - 0x16], ax
mov dword [ebp - 0x98], 0x3be6fb32
jmp 0x10002902
mov eax, dword [ebp - 0x64]
mov cx, word [ebp - 0x16]
mov word [eax], cx
mov dword [ebp - 0x98], 0x7bd61dc9
jmp 0x10002902
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0x4f95b960
jmp 0x10002902
mov eax, dword [0x100f5358]
mov ecx, dword [0x100f5354]
mov edx, eax
sub edx, 0x780c8ea9
sub edx, 1
add edx, 0x780c8ea9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x578abf83
mov ecx, 0x35f25ef1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x100f5358]
mov eax, dword [0x100f5354]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x578abf83
mov ecx, 0xabd7fa12
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x98], eax
jmp 0x10002902
mov dword [ebp - 0x98], 0x617b3ce0
jmp 0x10002902
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x98], 0xd0a84121
jmp 0x10002902
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007940
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x88]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x98], 0x7746abce
jmp 0x10002902
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x50]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x7c]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x78]
mov dword [eax], ecx
mov dword [ebp - 0x98], 0xd0f12d86
jmp 0x10002902
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x98], 0xf9446918
jmp 0x10002902
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x98], 0xe8776341
jmp 0x10002902
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov word [eax], 0
mov dword [ebp - 0x98], 0x85ab298e
jmp 0x10002902
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x98], 0x2d681e22
jmp 0x10002902
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov eax, dword [ebp - 0x80]
mov edx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.100086c0
add esp, 0xc
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x80]
mov esi, dword [eax]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
xor esi, esi
sub esi, edi
add eax, esi
xor esi, esi
sub esi, eax
mov eax, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x58]
mov byte [eax], cl
mov dword [ebp - 0x98], 0xd510f0b3
jmp 0x10002902
mov dword [ebp - 0x98], 0x59607fb2
jmp 0x10002902
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x98], 0x35f25ef1
jmp 0x10001128