Function at 0x100012f0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
mov eax, dword [0x1006d000]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa6], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa5], al
mov dword [ebp - 0xac], 0x7740e297
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
sub eax, 0x80717f1b
je 0x10002357
jmp 0x1000136b
mov eax, dword [ebp - 0xb4]
sub eax, 0x81102eae
je 0x10002118
jmp 0x10001381
mov eax, dword [ebp - 0xb4]
sub eax, 0x83514bb1
je 0x100023ef
jmp 0x10001397
mov eax, dword [ebp - 0xb4]
sub eax, 0x8a6baff9
je 0x100026ac
jmp 0x100013ad
mov eax, dword [ebp - 0xb4]
sub eax, 0x8b3446ad
je 0x10001cfe
jmp 0x100013c3
mov eax, dword [ebp - 0xb4]
sub eax, 0x8ce788ea
je 0x1000204c
jmp 0x100013d9
mov eax, dword [ebp - 0xb4]
sub eax, 0x8d75f02b
je 0x10001f54
jmp 0x100013ef
mov eax, dword [ebp - 0xb4]
sub eax, 0x8e53b90b
je 0x10001b32
jmp 0x10001405
mov eax, dword [ebp - 0xb4]
sub eax, 0x8fb45437
je 0x100026db
jmp 0x1000141b
mov eax, dword [ebp - 0xb4]
sub eax, 0x9610344f
je 0x10001977
jmp 0x10001431
mov eax, dword [ebp - 0xb4]
sub eax, 0x9bb8c513
je 0x10001b50
jmp 0x10001447
mov eax, dword [ebp - 0xb4]
sub eax, 0x9eaa7724
je 0x1000277e
jmp 0x1000145d
mov eax, dword [ebp - 0xb4]
sub eax, 0x9f9e9518
je 0x1000200d
jmp 0x10001473
mov eax, dword [ebp - 0xb4]
sub eax, 0xa1f9c7ce
je 0x10001c3c
jmp 0x10001489
mov eax, dword [ebp - 0xb4]
sub eax, 0xa37c3642
je 0x100020aa
jmp 0x1000149f
mov eax, dword [ebp - 0xb4]
sub eax, 0xa63573ea
je 0x10001eb7
jmp 0x100014b5
mov eax, dword [ebp - 0xb4]
sub eax, 0xa671b5d7
je 0x1000263d
jmp 0x100014cb
mov eax, dword [ebp - 0xb4]
sub eax, 0xafedd65a
je 0x10002818
jmp 0x100014e1
mov eax, dword [ebp - 0xb4]
sub eax, 0xb8c447f4
je 0x10002197
jmp 0x100014f7
mov eax, dword [ebp - 0xb4]
sub eax, 0xba5719d6
je 0x10001d2e
jmp 0x1000150d
mov eax, dword [ebp - 0xb4]
sub eax, 0xbf5f7c49
je 0x1000264c
jmp 0x10001523
mov eax, dword [ebp - 0xb4]
sub eax, 0xc9df708b
je 0x1000206c
jmp 0x10001539
mov eax, dword [ebp - 0xb4]
sub eax, 0xd3a7e059
je 0x10002087
jmp 0x1000154f
mov eax, dword [ebp - 0xb4]
sub eax, 0xd86eb2af
je 0x10001f36
jmp 0x10001565
mov eax, dword [ebp - 0xb4]
sub eax, 0xdb7e8203
je 0x10001a81
jmp 0x1000157b
mov eax, dword [ebp - 0xb4]
sub eax, 0xde42b894
je 0x10001dd0
jmp 0x10001591
mov eax, dword [ebp - 0xb4]
sub eax, 0xde7d4c45
je 0x100026bb
jmp 0x100015a7
mov eax, dword [ebp - 0xb4]
sub eax, 0xdede47d8
je 0x10001f6e
jmp 0x100015bd
mov eax, dword [ebp - 0xb4]
sub eax, 0xe395ce69
je 0x10001f8c
jmp 0x100015d3
mov eax, dword [ebp - 0xb4]
sub eax, 0xe8cbd437
je 0x100018ec
jmp 0x100015e9
mov eax, dword [ebp - 0xb4]
sub eax, 0xeb8e7740
je 0x100022e1
jmp 0x100015ff
mov eax, dword [ebp - 0xb4]
sub eax, 0xf2b866db
je 0x10001e49
jmp 0x10001615
mov eax, dword [ebp - 0xb4]
sub eax, 0xf6403cfb
je 0x10001c4b
jmp 0x1000162b
mov eax, dword [ebp - 0xb4]
sub eax, 0xfa1d94f4
je 0x10002624
jmp 0x10001641
mov eax, dword [ebp - 0xb4]
sub eax, 0xff0696d7
je 0x10002564
jmp 0x10001657
mov eax, dword [ebp - 0xb4]
sub eax, 0x330ca12
je 0x10001ddf
jmp 0x1000166d
mov eax, dword [ebp - 0xb4]
sub eax, 0x469b31f
je 0x100025da
jmp 0x10001683
mov eax, dword [ebp - 0xb4]
sub eax, 0x52a009b
je 0x1000267a
jmp 0x10001699
mov eax, dword [ebp - 0xb4]
sub eax, 0x57bf132
je 0x1000273f
jmp 0x100016af
mov eax, dword [ebp - 0xb4]
sub eax, 0x70f5641
je 0x100025f8
jmp 0x100016c5
mov eax, dword [ebp - 0xb4]
sub eax, 0xd381971
je 0x10001bb0
jmp 0x100016db
mov eax, dword [ebp - 0xb4]
sub eax, 0x112443c4
je 0x10001986
jmp 0x100016f1
mov eax, dword [ebp - 0xb4]
sub eax, 0x115e7efb
je 0x10002793
jmp 0x10001707
mov eax, dword [ebp - 0xb4]
sub eax, 0x1865bba6
je 0x10001d7f
jmp 0x1000171d
mov eax, dword [ebp - 0xb4]
sub eax, 0x200410d5
je 0x1000275a
jmp 0x10001733
mov eax, dword [ebp - 0xb4]
sub eax, 0x20b5b0b3
je 0x100026cc
jmp 0x10001749
mov eax, dword [ebp - 0xb4]
sub eax, 0x2a448477
je 0x100027f4
jmp 0x1000175f
mov eax, dword [ebp - 0xb4]
sub eax, 0x2a751a7f
je 0x100021ca
jmp 0x10001775
mov eax, dword [ebp - 0xb4]
sub eax, 0x3c3e26d8
je 0x10001f9b
jmp 0x1000178b
mov eax, dword [ebp - 0xb4]
sub eax, 0x3e4941ed
je 0x10002238
jmp 0x100017a1
mov eax, dword [ebp - 0xb4]
sub eax, 0x3f4916d8
je 0x10001b5f
jmp 0x100017b7
mov eax, dword [ebp - 0xb4]
sub eax, 0x437b8eed
je 0x10002769
jmp 0x100017cd
mov eax, dword [ebp - 0xb4]
sub eax, 0x4d0f5364
je 0x10001e2f
jmp 0x100017e3
mov eax, dword [ebp - 0xb4]
sub eax, 0x5562f401
je 0x100024f6
jmp 0x100017f9
mov eax, dword [ebp - 0xb4]
sub eax, 0x56113453
je 0x100022c3
jmp 0x1000180f
mov eax, dword [ebp - 0xb4]
sub eax, 0x70551a04
je 0x100023fe
jmp 0x10001825
mov eax, dword [ebp - 0xb4]
sub eax, 0x7363dc04
je 0x1000203d
jmp 0x1000183b
mov eax, dword [ebp - 0xb4]
sub eax, 0x7740e297
je 0x10001898
jmp 0x10001851
mov eax, dword [ebp - 0xb4]
sub eax, 0x7e27a397
je 0x10002188
jmp 0x10001867
mov eax, dword [ebp - 0xb4]
sub eax, 0x7e4329de
je 0x10001a0b
jmp 0x1000187d
mov eax, dword [ebp - 0xb4]
sub eax, 0x7f917195
je 0x100025e9
jmp 0x10001893
jmp 0x1000282a
mov bl, byte [ebp - 0xa6]
mov dh, byte [ebp - 0xa5]
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x20b5b0b3
mov ecx, 0xe8cbd437
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
push eax
mov eax, esp
mov dword [ebp - 0xa4], eax
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x9c], eax
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x20b5b0b3
mov ecx, 0x9610344f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0x112443c4
jmp 0x1000282a
mov ecx, dword [ebp - 0xb0]
push eax
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x90], eax
push eax
mov eax, esp
mov dword [ebp - 0x8c], eax
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xac], 0x7e4329de
jmp 0x1000282a
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
mov edx, ecx
add edx, 0xcdff539c
sub edx, 1
sub edx, 0xcdff539c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x8fb45437
mov ecx, 0xdb7e8203
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10010030
add esp, 0xc
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x61], al
mov eax, dword [0x1006e348]
mov ecx, dword [0x1006e344]
mov edx, eax
add edx, 0x8eabb03d
sub edx, 1
sub edx, 0x8eabb03d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x8fb45437
mov ecx, 0x8e53b90b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dl, byte [ebp - 0x61]
mov eax, 0x9bb8c513
mov ecx, 0x3f4916d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0xde7d4c45
jmp 0x1000282a
mov eax, dword [0x1006e348]
mov ecx, dword [0x1006e344]
mov edx, eax
sub edx, 0x7af9a9d2
sub edx, 1
add edx, 0x7af9a9d2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x57bf132
mov ecx, 0xd381971
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
mov edx, ecx
sub edx, 0x448b9d79
sub edx, 1
add edx, 0x448b9d79
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x57bf132
mov ecx, 0xa1f9c7ce
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0xf6403cfb
jmp 0x1000282a
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x90]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xac], 0x8b3446ad
jmp 0x1000282a
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x58]
mov dword [eax], ecx
mov edx, dword [ebp - 0x8c]
mov esi, 0xffffffff
mov eax, 0x330ca12
mov ecx, 0xba5719d6
cmp dword [edx], esi
cmove eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [0x1006e348]
mov ecx, dword [0x1006e344]
mov edx, eax
sub edx, 0x59e6b46d
sub edx, 1
add edx, 0x59e6b46d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x200410d5
mov ecx, 0x1865bba6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [0x1006e348]
mov ecx, dword [0x1006e344]
mov edx, eax
sub edx, 0x50116947
sub edx, 1
add edx, 0x50116947
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x200410d5
mov ecx, 0xde42b894
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0xde7d4c45
jmp 0x1000282a
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xac], 0x4d0f5364
jmp 0x1000282a
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
mov dword [ebp - 0xac], 0xf2b866db
jmp 0x1000282a
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x437b8eed
mov ecx, 0xa63573ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x88]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x4d], al
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x437b8eed
mov ecx, 0xd86eb2af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dl, byte [ebp - 0x4d]
mov eax, 0x8d75f02b
mov ecx, 0x3c3e26d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0xac], 0xdede47d8
jmp 0x1000282a
mov eax, dword [ebp - 0x4c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0xe395ce69
jmp 0x1000282a
mov dword [ebp - 0xac], 0xde7d4c45
jmp 0x1000282a
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xac], 0x9f9e9518
jmp 0x1000282a
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
sub ecx, 0xac5ce6fb
add ecx, eax
add ecx, 0xac5ce6fb
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
mov word [eax], 0
mov dword [ebp - 0xac], 0x7363dc04
jmp 0x1000282a
mov dword [ebp - 0xac], 0x8ce788ea
jmp 0x1000282a
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xac], 0xc9df708b
jmp 0x1000282a
mov eax, dword [ebp - 0x3c]
add eax, 4
add eax, 2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xac], 0xd3a7e059
jmp 0x1000282a
mov eax, dword [ebp - 0x38]
movzx esi, word [eax]
mov edx, dword [ebp - 0x40]
mov eax, 0xbf5f7c49
mov ecx, 0xa37c3642
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9eaa7724
mov ecx, 0x81102eae
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x18
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [0x1006e348]
mov ecx, dword [0x1006e344]
mov edx, eax
add edx, 0xc8a0dbd2
sub edx, 1
sub edx, 0xc8a0dbd2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9eaa7724
mov ecx, 0x7e27a397
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0xb8c447f4
jmp 0x1000282a
mov eax, dword [ebp - 0x30]
movzx edx, word [eax + 0x14]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x78]
movzx eax, word [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xac], 0x2a751a7f
jmp 0x1000282a
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x115e7efb
mov ecx, 0x3e4941ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x28]
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x2c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001c3b0
call fcn.100123a0
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x21], al
mov eax, dword [0x1006e348]
mov ecx, dword [0x1006e344]
mov edx, eax
add edx, 0xf2e1b82e
sub edx, 1
sub edx, 0xf2e1b82e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x115e7efb
mov ecx, 0x56113453
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dl, byte [ebp - 0x21]
mov eax, 0xeb8e7740
mov ecx, 0x7f917195
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
mov edx, ecx
sub edx, 0x5a4d1b6
sub edx, 1
add edx, 0x5a4d1b6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2a448477
mov ecx, 0x80717f1b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x2a448477
mov ecx, 0x83514bb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0x70551a04
jmp 0x1000282a
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
sub edx, 0xf7030e07
add edx, eax
add edx, 0xf7030e07
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x20]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x6c]
mov byte [eax], cl
mov eax, dword [ebp - 0x94]
mov edx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub edx, 0x9bfa9bb8
add edx, eax
add edx, 0x9bfa9bb8
mov eax, dword [ebp - 0x84]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10010190
add esp, 0xc
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x94]
mov esi, dword [eax]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0xd5ed51c1
add esi, eax
add esi, 0xd5ed51c1
mov eax, dword [ebp - 0x70]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x13], al
mov dword [ebp - 0xac], 0x5562f401
jmp 0x1000282a
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xafedd65a
mov ecx, 0xff0696d7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov eax, dword [ebp - 0x6c]
mov cl, byte [ebp - 0x13]
mov byte [eax], cl
mov ecx, dword [0x1006e348]
mov eax, dword [0x1006e344]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xafedd65a
mov ecx, 0x469b31f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xac], eax
jmp 0x1000282a
mov dword [ebp - 0xac], 0x7f917195
jmp 0x1000282a
mov dword [ebp - 0xac], 0x70f5641
jmp 0x1000282a
mov eax, dword [ebp - 0x78]
mov ax, word [eax]
xor ecx, ecx
sub cx, ax
xor eax, eax
sub ax, 1
add cx, ax
xor eax, eax
sub ax, cx
mov word [ebp - 0x12], ax
mov dword [ebp - 0xac], 0xfa1d94f4
jmp 0x1000282a
mov eax, dword [ebp - 0x78]
mov cx, word [ebp - 0x12]
mov word [eax], cx
mov dword [ebp - 0xac], 0xa671b5d7
jmp 0x1000282a
mov dword [ebp - 0xac], 0x8ce788ea
jmp 0x1000282a
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xac], 0x52a009b
jmp 0x1000282a
mov eax, dword [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xac], 0x8a6baff9
jmp 0x1000282a
mov dword [ebp - 0xac], 0xde7d4c45
jmp 0x1000282a
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000f430
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0xac], 0xe8cbd437
jmp 0x1000282a
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10010030
add esp, 0xc
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x98]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xac], 0xdb7e8203
jmp 0x1000282a
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xac], 0xd381971
jmp 0x1000282a
mov dword [ebp - 0xac], 0x1865bba6
jmp 0x1000282a
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xac], 0xa63573ea
jmp 0x1000282a
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xac], 0x81102eae
jmp 0x1000282a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1d4c6fac
add ecx, eax
add ecx, 0x1d4c6fac
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001c3b0
call fcn.100123a0
add esp, 8
mov dword [ebp - 0xac], 0x3e4941ed
jmp 0x1000282a
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xac], 0x80717f1b
jmp 0x1000282a
mov eax, dword [ebp - 0x6c]
mov cl, byte [ebp - 0x13]
mov byte [eax], cl
mov dword [ebp - 0xac], 0xff0696d7
jmp 0x1000134f