Function at 0x100012e0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x194
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
mov eax, dword [0x10068800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x194], 0x891f294b
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x19c], eax
sub eax, 0x84f12312
je 0x10002414
jmp 0x10001324
mov eax, dword [ebp - 0x19c]
sub eax, 0x891f294b
je 0x100018bf
jmp 0x1000133a
mov eax, dword [ebp - 0x19c]
sub eax, 0x89d275bb
je 0x10002132
jmp 0x10001350
mov eax, dword [ebp - 0x19c]
sub eax, 0x8f4f54cc
je 0x100023e4
jmp 0x10001366
mov eax, dword [ebp - 0x19c]
sub eax, 0x94a881dd
je 0x100028d7
jmp 0x1000137c
mov eax, dword [ebp - 0x19c]
sub eax, 0x99293321
je 0x10001a31
jmp 0x10001392
mov eax, dword [ebp - 0x19c]
sub eax, 0x99b41967
je 0x100027bc
jmp 0x100013a8
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a4faf01
je 0x100020b3
jmp 0x100013be
mov eax, dword [ebp - 0x19c]
sub eax, 0x9a77e650
je 0x10001db9
jmp 0x100013d4
mov eax, dword [ebp - 0x19c]
sub eax, 0x9c6f091d
je 0x100026bc
jmp 0x100013ea
mov eax, dword [ebp - 0x19c]
sub eax, 0x9e86f232
je 0x10001e25
jmp 0x10001400
mov eax, dword [ebp - 0x19c]
sub eax, 0xa4848a8e
je 0x10002275
jmp 0x10001416
mov eax, dword [ebp - 0x19c]
sub eax, 0xa49709c7
je 0x1000204f
jmp 0x1000142c
mov eax, dword [ebp - 0x19c]
sub eax, 0xa67cafb5
je 0x10001d47
jmp 0x10001442
mov eax, dword [ebp - 0x19c]
sub eax, 0xa7153cf7
je 0x10001c15
jmp 0x10001458
mov eax, dword [ebp - 0x19c]
sub eax, 0xaa080eb0
je 0x100020d2
jmp 0x1000146e
mov eax, dword [ebp - 0x19c]
sub eax, 0xaec18c8b
je 0x10001e16
jmp 0x10001484
mov eax, dword [ebp - 0x19c]
sub eax, 0xaf0702e5
je 0x1000200d
jmp 0x1000149a
mov eax, dword [ebp - 0x19c]
sub eax, 0xafb13b9b
je 0x10001b4e
jmp 0x100014b0
mov eax, dword [ebp - 0x19c]
sub eax, 0xb160755b
je 0x1000280d
jmp 0x100014c6
mov eax, dword [ebp - 0x19c]
sub eax, 0xb457e684
je 0x10002205
jmp 0x100014dc
mov eax, dword [ebp - 0x19c]
sub eax, 0xb4d2078d
je 0x100023d5
jmp 0x100014f2
mov eax, dword [ebp - 0x19c]
sub eax, 0xbcfc1f45
je 0x1000262a
jmp 0x10001508
mov eax, dword [ebp - 0x19c]
sub eax, 0xbfa054e6
je 0x100024cb
jmp 0x1000151e
mov eax, dword [ebp - 0x19c]
sub eax, 0xc49e30a6
je 0x10001ef6
jmp 0x10001534
mov eax, dword [ebp - 0x19c]
sub eax, 0xca1c2c0b
je 0x100025d9
jmp 0x1000154a
mov eax, dword [ebp - 0x19c]
sub eax, 0xd1cb22f6
je 0x100027d1
jmp 0x10001560
mov eax, dword [ebp - 0x19c]
sub eax, 0xdb718e80
je 0x1000285e
jmp 0x10001576
mov eax, dword [ebp - 0x19c]
sub eax, 0xdcf95f71
je 0x100025ca
jmp 0x1000158c
mov eax, dword [ebp - 0x19c]
sub eax, 0xdda6bed5
je 0x100024da
jmp 0x100015a2
mov eax, dword [ebp - 0x19c]
sub eax, 0xe0ca98cd
je 0x1000231f
jmp 0x100015b8
mov eax, dword [ebp - 0x19c]
sub eax, 0xe7772386
je 0x100020f8
jmp 0x100015ce
mov eax, dword [ebp - 0x19c]
sub eax, 0xe8dd4a6e
je 0x1000288e
jmp 0x100015e4
mov eax, dword [ebp - 0x19c]
sub eax, 0xf462b2f7
je 0x10002550
jmp 0x100015fa
mov eax, dword [ebp - 0x19c]
sub eax, 0xf5b2572d
je 0x1000279c
jmp 0x10001610
mov eax, dword [ebp - 0x19c]
sub eax, 0xf681c50d
je 0x1000294b
jmp 0x10001626
mov eax, dword [ebp - 0x19c]
sub eax, 0xd68fb1
je 0x10001b84
jmp 0x1000163c
mov eax, dword [ebp - 0x19c]
sub eax, 0x12efc1d
je 0x1000199c
jmp 0x10001652
mov eax, dword [ebp - 0x19c]
sub eax, 0x2b2199b
je 0x100024bc
jmp 0x10001668
mov eax, dword [ebp - 0x19c]
sub eax, 0x7213533
je 0x10001d68
jmp 0x1000167e
mov eax, dword [ebp - 0x19c]
sub eax, 0x7a7583f
je 0x10001f05
jmp 0x10001694
mov eax, dword [ebp - 0x19c]
sub eax, 0x14a36411
je 0x10002183
jmp 0x100016aa
mov eax, dword [ebp - 0x19c]
sub eax, 0x14a82c0c
je 0x1000194b
jmp 0x100016c0
mov eax, dword [ebp - 0x19c]
sub eax, 0x15464b8c
je 0x10002088
jmp 0x100016d6
mov eax, dword [ebp - 0x19c]
sub eax, 0x1561ec8d
je 0x10002465
jmp 0x100016ec
mov eax, dword [ebp - 0x19c]
sub eax, 0x1614d5b8
je 0x100028ec
jmp 0x10001702
mov eax, dword [ebp - 0x19c]
sub eax, 0x2ab1b1cf
je 0x10002909
jmp 0x10001718
mov eax, dword [ebp - 0x19c]
sub eax, 0x2b24c95e
je 0x10002714
jmp 0x1000172e
mov eax, dword [ebp - 0x19c]
sub eax, 0x2c4968f1
je 0x10001f14
jmp 0x10001744
mov eax, dword [ebp - 0x19c]
sub eax, 0x2f33a5be
je 0x1000201c
jmp 0x1000175a
mov eax, dword [ebp - 0x19c]
sub eax, 0x39206cc8
je 0x100027ab
jmp 0x10001770
mov eax, dword [ebp - 0x19c]
sub eax, 0x3afc069f
je 0x100026cb
jmp 0x10001786
mov eax, dword [ebp - 0x19c]
sub eax, 0x3ba5dac0
je 0x10001a22
jmp 0x1000179c
mov eax, dword [ebp - 0x19c]
sub eax, 0x3e4772b2
je 0x10001c24
jmp 0x100017b2
mov eax, dword [ebp - 0x19c]
sub eax, 0x43306f9e
je 0x10001f5d
jmp 0x100017c8
mov eax, dword [ebp - 0x19c]
sub eax, 0x44e59e9a
je 0x10002214
jmp 0x100017de
mov eax, dword [ebp - 0x19c]
sub eax, 0x474ad6b4
je 0x10002918
jmp 0x100017f4
mov eax, dword [ebp - 0x19c]
sub eax, 0x48caf891
je 0x10001a01
jmp 0x1000180a
mov eax, dword [ebp - 0x19c]
sub eax, 0x4d470cd9
je 0x10001d2c
jmp 0x10001820
mov eax, dword [ebp - 0x19c]
sub eax, 0x6077525c
je 0x10001c92
jmp 0x10001836
mov eax, dword [ebp - 0x19c]
sub eax, 0x6bf86336
je 0x10001b5d
jmp 0x1000184c
mov eax, dword [ebp - 0x19c]
sub eax, 0x6f50bb9a
je 0x10001aa7
jmp 0x10001862
mov eax, dword [ebp - 0x19c]
sub eax, 0x74026a3b
je 0x100022ed
jmp 0x10001878
mov eax, dword [ebp - 0x19c]
sub eax, 0x761ae479
je 0x10001e76
jmp 0x1000188e
mov eax, dword [ebp - 0x19c]
sub eax, 0x7c3bbe87
je 0x10001d1d
mov eax, dword [ebp - 0x198]
push eax
mov ecx, esp
mov dword [ebp - 0x168], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x164], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x16c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000b6d0
add esp, 0xc
mov eax, dword [ebp - 0x16c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x194], 0x14a82c0c
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0xa32ea49
sub edx, 1
sub edx, 0xa32ea49
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99b41967
mov ecx, 0x12efc1d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x15c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x155], al
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0x6b19aec9
sub edx, 1
sub edx, 0x6b19aec9
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x99b41967
mov ecx, 0x48caf891
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dl, byte [ebp - 0x155]
mov eax, 0x3ba5dac0
mov ecx, 0x99293321
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x39206cc8
jmp 0x10002967
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
add edx, 0xbc328f07
sub edx, 1
sub edx, 0xbc328f07
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd1cb22f6
mov ecx, 0x6f50bb9a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x154], eax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd1cb22f6
mov ecx, 0xafb13b9b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x6bf86336
jmp 0x10002967
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x194], 0xd68fb1
jmp 0x10002967
mov ecx, dword [ebp - 0x174]
mov eax, dword [ebp - 0x150]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x17c], eax
mov edx, 0xffffffff
mov eax, 0x3e4772b2
mov ecx, 0xa7153cf7
cmp dword [ebp - 0x17c], edx
cmove eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x39206cc8
jmp 0x10002967
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb160755b
mov ecx, 0x6077525c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x180], eax
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb160755b
mov ecx, 0x7c3bbe87
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x194], 0xa67cafb5
jmp 0x10002967
mov edx, dword [ebp - 0x14c]
mov eax, 0x7213533
mov ecx, 0x2c4968f1
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0x95e1f838
sub edx, 1
add edx, 0x95e1f838
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb718e80
mov ecx, 0x9a77e650
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x148], eax
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0x286de094
sub edx, 1
sub edx, 0x286de094
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xdb718e80
mov ecx, 0xaec18c8b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x9e86f232
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0xad0a8914
sub edx, 1
add edx, 0xad0a8914
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7e234d3a
mov ecx, 0x761ae479
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x148]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7e234d3a
mov ecx, 0xc49e30a6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x7a7583f
jmp 0x10002967
mov dword [ebp - 0x194], 0x39206cc8
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe8dd4a6e
mov ecx, 0x43306f9e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x184], eax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
add edx, 0x869e6a0a
sub edx, 1
sub edx, 0x869e6a0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe8dd4a6e
mov ecx, 0xaf0702e5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x2f33a5be
jmp 0x10002967
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x194], 0xa49709c7
jmp 0x10002967
mov eax, dword [ebp - 0x140]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x144]
add eax, 0x847527f2
add eax, ecx
sub eax, 0x847527f2
mov dword [ebp - 0x18c], eax
mov word [ebp - 0x18e], 0
mov dword [ebp - 0x194], 0x15464b8c
jmp 0x10002967
movzx eax, word [ebp - 0x18e]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x18c]
add eax, 4
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x194], 0x9a4faf01
jmp 0x10002967
mov eax, dword [ebp - 0x138]
movzx eax, word [eax + 2]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x194], 0xaa080eb0
jmp 0x10002967
mov edx, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x134]
mov eax, 0xdda6bed5
mov ecx, 0xe7772386
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x18c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, dword [ebp - 0x18c]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x194], 0x89d275bb
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
add edx, 0x2234b47f
sub edx, 1
sub edx, 0x2234b47f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94a881dd
mov ecx, 0x14a36411
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], eax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x4ece2e47
sub edx, 1
add edx, 0x4ece2e47
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x94a881dd
mov ecx, 0xb457e684
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x44e59e9a
jmp 0x10002967
mov ecx, dword [ebp - 0x12c]
movzx eax, word [ebp - 0x18e]
imul eax, eax, 0x28
sub ecx, 0xc47163e1
add ecx, eax
add ecx, 0xc47163e1
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100173b0
call fcn.1000da40
add esp, 8
mov edx, eax
mov eax, 0xa4848a8e
mov ecx, 0xb4d2078d
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x164]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov dword [ebp - 0x194], 0x74026a3b
jmp 0x10002967
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x168]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
add eax, 0x347a2e3
add eax, ecx
sub eax, 0x347a2e3
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x194], 0xe0ca98cd
jmp 0x10002967
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x128]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000b830
add esp, 0xc
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x178]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xef2a0445
add esi, eax
add esi, 0xef2a0445
mov eax, dword [ebp - 0x164]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov dword [ebp - 0x194], 0xb4d2078d
jmp 0x10002967
mov dword [ebp - 0x194], 0x8f4f54cc
jmp 0x10002967
mov ax, word [ebp - 0x18e]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x122], ax
mov dword [ebp - 0x194], 0x84f12312
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0x72b09146
sub edx, 1
add edx, 0x72b09146
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1614d5b8
mov ecx, 0x1561ec8d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov ax, word [ebp - 0x122]
mov word [ebp - 0x18e], ax
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1614d5b8
mov ecx, 0x2b2199b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0xbfa054e6
jmp 0x10002967
mov dword [ebp - 0x194], 0x15464b8c
jmp 0x10002967
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
sub edx, 0x11b543f4
sub edx, 1
add edx, 0x11b543f4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2ab1b1cf
mov ecx, 0xf462b2f7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2ab1b1cf
mov ecx, 0xdcf95f71
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0xca1c2c0b
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
mov edx, eax
sub edx, 0xf4b21743
sub edx, 1
add edx, 0xf4b21743
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x474ad6b4
mov ecx, 0xbcfc1f45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x474ad6b4
mov ecx, 0x9c6f091d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x3afc069f
jmp 0x10002967
mov eax, dword [0x10069b38]
mov ecx, dword [0x10069b34]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf681c50d
mov ecx, 0x2b24c95e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x10069b38]
mov eax, dword [0x10069b34]
mov edx, ecx
add edx, 0xb3a68e69
sub edx, 1
sub edx, 0xb3a68e69
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf681c50d
mov ecx, 0xf5b2572d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002967
mov dword [ebp - 0x194], 0x39206cc8
jmp 0x10002967
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000aad0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x194], 0x12efc1d
jmp 0x10002967
mov ecx, dword [ebp - 0x174]
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0x194], 0x6f50bb9a
jmp 0x10002967
mov eax, dword [ebp - 0x17c]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x194], 0x6077525c
jmp 0x10002967
mov dword [ebp - 0x194], 0x9a77e650
jmp 0x10002967
mov eax, dword [ebp - 0x180]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x194], 0x43306f9e
jmp 0x10002967
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x194], 0x14a36411
jmp 0x10002967
mov ax, word [ebp - 0x122]
mov word [ebp - 0x18e], ax
mov dword [ebp - 0x194], 0x1561ec8d
jmp 0x10002967
mov dword [ebp - 0x194], 0xf462b2f7
jmp 0x10002967
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0xbcfc1f45
jmp 0x10002967
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x2b24c95e
jmp 0x10001308