Function at 0x100010c0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x194
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
mov eax, dword [0x10033600]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x194], 0x16f5d757
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x19c], eax
sub eax, 0x81001640
je 0x1000261e
jmp 0x10001104
mov eax, dword [ebp - 0x19c]
sub eax, 0x83471fea
je 0x10001c69
jmp 0x1000111a
mov eax, dword [ebp - 0x19c]
sub eax, 0x8d14ef27
je 0x10001ead
jmp 0x10001130
mov eax, dword [ebp - 0x19c]
sub eax, 0x8ec4e111
je 0x10001b89
jmp 0x10001146
mov eax, dword [ebp - 0x19c]
sub eax, 0x9683f308
je 0x10002553
jmp 0x1000115c
mov eax, dword [ebp - 0x19c]
sub eax, 0x974802c6
je 0x10001ad5
jmp 0x10001172
mov eax, dword [ebp - 0x19c]
sub eax, 0x985fa651
je 0x10001fe8
jmp 0x10001188
mov eax, dword [ebp - 0x19c]
sub eax, 0x9b03f012
je 0x10001dbf
jmp 0x1000119e
mov eax, dword [ebp - 0x19c]
sub eax, 0xa8c5aa41
je 0x100017d2
jmp 0x100011b4
mov eax, dword [ebp - 0x19c]
sub eax, 0xacfd65ba
je 0x10002319
jmp 0x100011ca
mov eax, dword [ebp - 0x19c]
sub eax, 0xb15adac3
je 0x1000247f
jmp 0x100011e0
mov eax, dword [ebp - 0x19c]
sub eax, 0xb61de589
je 0x10002143
jmp 0x100011f6
mov eax, dword [ebp - 0x19c]
sub eax, 0xb8982959
je 0x10001f7a
jmp 0x1000120c
mov eax, dword [ebp - 0x19c]
sub eax, 0xb9b0fead
je 0x10001d17
jmp 0x10001222
mov eax, dword [ebp - 0x19c]
sub eax, 0xbb07c0df
je 0x1000188c
jmp 0x10001238
mov eax, dword [ebp - 0x19c]
sub eax, 0xbd8868d2
je 0x10001e25
jmp 0x1000124e
mov eax, dword [ebp - 0x19c]
sub eax, 0xc08592fa
je 0x100017c3
jmp 0x10001264
mov eax, dword [ebp - 0x19c]
sub eax, 0xc320a41c
je 0x100022fa
jmp 0x1000127a
mov eax, dword [ebp - 0x19c]
sub eax, 0xc5a1d4f4
je 0x10001efe
jmp 0x10001290
mov eax, dword [ebp - 0x19c]
sub eax, 0xc6e84647
je 0x100018e4
jmp 0x100012a6
mov eax, dword [ebp - 0x19c]
sub eax, 0xc8eab44c
je 0x1000248e
jmp 0x100012bc
mov eax, dword [ebp - 0x19c]
sub eax, 0xcb76b30d
je 0x10001bf7
jmp 0x100012d2
mov eax, dword [ebp - 0x19c]
sub eax, 0xcd9157ed
je 0x100016a6
jmp 0x100012e8
mov eax, dword [ebp - 0x19c]
sub eax, 0xcfc10ed6
je 0x1000209f
jmp 0x100012fe
mov eax, dword [ebp - 0x19c]
sub eax, 0xd62d8a42
je 0x10002387
jmp 0x10001314
mov eax, dword [ebp - 0x19c]
sub eax, 0xdef84516
je 0x10002439
jmp 0x1000132a
mov eax, dword [ebp - 0x19c]
sub eax, 0xe5efe866
je 0x1000207e
jmp 0x10001340
mov eax, dword [ebp - 0x19c]
sub eax, 0xeae30362
je 0x10001af6
jmp 0x10001356
mov eax, dword [ebp - 0x19c]
sub eax, 0xee1c07c7
je 0x100022b2
jmp 0x1000136c
mov eax, dword [ebp - 0x19c]
sub eax, 0xf0a4aeed
je 0x10001d56
jmp 0x10001382
mov eax, dword [ebp - 0x19c]
sub eax, 0xf3359561
je 0x10002562
jmp 0x10001398
mov eax, dword [ebp - 0x19c]
sub eax, 0xfa2fe02b
je 0x10001d26
jmp 0x100013ae
mov eax, dword [ebp - 0x19c]
sub eax, 0x506a8c9
je 0x1000249d
jmp 0x100013c4
mov eax, dword [ebp - 0x19c]
sub eax, 0x580d99d
je 0x10001a08
jmp 0x100013da
mov eax, dword [ebp - 0x19c]
sub eax, 0x968613c
je 0x10001b05
jmp 0x100013f0
mov eax, dword [ebp - 0x19c]
sub eax, 0xdc35a16
je 0x100020ba
jmp 0x10001406
mov eax, dword [ebp - 0x19c]
sub eax, 0x101d442f
je 0x10002409
jmp 0x1000141c
mov eax, dword [ebp - 0x19c]
sub eax, 0x109cfd88
je 0x10001a76
jmp 0x10001432
mov eax, dword [ebp - 0x19c]
sub eax, 0x14c13f90
je 0x100022d1
jmp 0x10001448
mov eax, dword [ebp - 0x19c]
sub eax, 0x1603bbc1
je 0x10002418
jmp 0x1000145e
mov eax, dword [ebp - 0x19c]
sub eax, 0x16f5d757
je 0x1000165d
jmp 0x10001474
mov eax, dword [ebp - 0x19c]
sub eax, 0x1aa242c2
je 0x10001823
jmp 0x1000148a
mov eax, dword [ebp - 0x19c]
sub eax, 0x1ec4405f
je 0x10002211
jmp 0x100014a0
mov eax, dword [ebp - 0x19c]
sub eax, 0x1ee754bf
je 0x10002580
jmp 0x100014b6
mov eax, dword [ebp - 0x19c]
sub eax, 0x2537eb54
je 0x100019f9
jmp 0x100014cc
mov eax, dword [ebp - 0x19c]
sub eax, 0x37adde0c
je 0x1000189b
jmp 0x100014e2
mov eax, dword [ebp - 0x19c]
sub eax, 0x391254fb
je 0x1000174e
jmp 0x100014f8
mov eax, dword [ebp - 0x19c]
sub eax, 0x3ec074c1
je 0x1000260f
jmp 0x1000150e
mov eax, dword [ebp - 0x19c]
sub eax, 0x472627eb
je 0x1000225a
jmp 0x10001524
mov eax, dword [ebp - 0x19c]
sub eax, 0x4e854296
je 0x10001ded
jmp 0x1000153a
mov eax, dword [ebp - 0x19c]
sub eax, 0x51dfab8d
je 0x1000246e
jmp 0x10001550
mov eax, dword [ebp - 0x19c]
sub eax, 0x5526e875
je 0x10001cba
jmp 0x10001566
mov eax, dword [ebp - 0x19c]
sub eax, 0x567c5b4b
je 0x10001f6b
jmp 0x1000157c
mov eax, dword [ebp - 0x19c]
sub eax, 0x5e0ae1c9
je 0x10001d47
jmp 0x10001592
mov eax, dword [ebp - 0x19c]
sub eax, 0x5f9fe296
je 0x1000173f
jmp 0x100015a8
mov eax, dword [ebp - 0x19c]
sub eax, 0x5fcf8489
je 0x10001e48
jmp 0x100015be
mov eax, dword [ebp - 0x19c]
sub eax, 0x627f2685
je 0x10002571
jmp 0x100015d4
mov eax, dword [ebp - 0x19c]
sub eax, 0x635ead64
je 0x100022a3
jmp 0x100015ea
mov eax, dword [ebp - 0x19c]
sub eax, 0x63fc1dcb
je 0x10001e07
jmp 0x10001600
mov eax, dword [ebp - 0x19c]
sub eax, 0x6da02c85
je 0x10001e71
jmp 0x10001616
mov eax, dword [ebp - 0x19c]
sub eax, 0x6f15044e
je 0x10001c48
jmp 0x1000162c
mov eax, dword [ebp - 0x19c]
sub eax, 0x72ea2607
je 0x1000259b
jmp 0x10001642
mov eax, dword [ebp - 0x19c]
sub eax, 0x765222e8
je 0x10001b20
jmp 0x10001658
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb15adac3
mov ecx, 0xcd9157ed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
push eax
mov eax, esp
mov dword [ebp - 0x17c], eax
push eax
mov eax, esp
mov dword [ebp - 0x178], eax
push eax
mov eax, esp
mov dword [ebp - 0x174], eax
push eax
mov eax, esp
mov dword [ebp - 0x170], eax
push eax
mov eax, esp
mov dword [ebp - 0x16c], eax
push eax
mov eax, esp
mov dword [ebp - 0x168], eax
push eax
mov eax, esp
mov dword [ebp - 0x164], eax
push eax
mov eax, esp
mov dword [ebp - 0x160], eax
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
sub edx, 0xb587b0b1
sub edx, 1
add edx, 0xb587b0b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb15adac3
mov ecx, 0x5f9fe296
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0x391254fb
jmp 0x10002628
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x180], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000ced0
add esp, 0xc
mov eax, dword [ebp - 0x180]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x188], eax
mov eax, 0xc08592fa
mov ecx, 0xa8c5aa41
cmp dword [ebp - 0x188], 0
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0x51dfab8d
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
add edx, 0xfb0f47c5
sub edx, 1
sub edx, 0xfb0f47c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8eab44c
mov ecx, 0x1aa242c2
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x158], eax
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
add edx, 0x1e0472fd
sub edx, 1
sub edx, 0x1e0472fd
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc8eab44c
mov ecx, 0xbb07c0df
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0x37adde0c
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x506a8c9
mov ecx, 0xc6e84647
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x188]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x190], eax
mov ecx, dword [0x10034940]
mov eax, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x506a8c9
mov ecx, 0x2537eb54
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0x580d99d
jmp 0x10002628
mov ecx, dword [0x10034940]
mov eax, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9683f308
mov ecx, 0x109cfd88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, 0xffffffff
cmp dword [ebp - 0x190], eax
sete al
and al, 1
mov byte [ebp - 0x151], al
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9683f308
mov ecx, 0x974802c6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dl, byte [ebp - 0x151]
mov eax, 0x968613c
mov ecx, 0xeae30362
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0x51dfab8d
jmp 0x10002628
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x194], 0x765222e8
jmp 0x10002628
mov eax, dword [ebp - 0x150]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x17c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
cmp dword [eax], 0
setne al
and al, 1
mov byte [ebp - 0x149], al
mov dword [ebp - 0x194], 0x8ec4e111
jmp 0x10002628
mov ecx, dword [0x10034940]
mov eax, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xf3359561
mov ecx, 0xcb76b30d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
add edx, 0xce5e928a
sub edx, 1
sub edx, 0xce5e928a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf3359561
mov ecx, 0x6f15044e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dl, byte [ebp - 0x149]
mov eax, 0x83471fea
mov ecx, 0xf0a4aeed
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
add edx, 0xcf6539b7
sub edx, 1
sub edx, 0xcf6539b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x627f2685
mov ecx, 0x5526e875
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x148], eax
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
sub edx, 0x5df01fdf
sub edx, 1
add edx, 0x5df01fdf
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x627f2685
mov ecx, 0xb9b0fead
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0xfa2fe02b
jmp 0x10002628
mov eax, dword [ebp - 0x148]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x5e0ae1c9
jmp 0x10002628
mov dword [ebp - 0x194], 0x51dfab8d
jmp 0x10002628
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x174]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x194], 0x9b03f012
jmp 0x10002628
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x144]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x170]
mov dword [eax], ecx
mov dword [ebp - 0x194], 0x4e854296
jmp 0x10002628
mov eax, dword [ebp - 0x16c]
mov word [eax], 0
mov dword [ebp - 0x194], 0x63fc1dcb
jmp 0x10002628
mov eax, dword [ebp - 0x16c]
movzx eax, word [eax]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x194], 0xbd8868d2
jmp 0x10002628
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
add eax, 4
add eax, 2
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x194], 0x5fcf8489
jmp 0x10002628
mov eax, dword [ebp - 0x13c]
movzx esi, word [eax]
mov edx, dword [ebp - 0x140]
mov eax, 0xacfd65ba
mov ecx, 0x6da02c85
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
sub eax, 0xe0e94f5b
add eax, 0x18
add eax, 0xe0e94f5b
mov ecx, dword [ebp - 0x170]
mov ecx, dword [ecx]
movzx edx, word [ecx + 0x14]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x194], 0x8d14ef27
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
add edx, 0x4a782017
sub edx, 1
sub edx, 0x4a782017
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1ee754bf
mov ecx, 0xc5a1d4f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x16c]
mov ax, word [eax]
mov word [ebp - 0x130], ax
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
mov edx, eax
sub edx, 0xfda6cc9b
sub edx, 1
add edx, 0xfda6cc9b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1ee754bf
mov ecx, 0x567c5b4b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0xb8982959
jmp 0x10002628
mov ecx, dword [0x10034940]
mov eax, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x72ea2607
mov ecx, 0x985fa651
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov ax, word [ebp - 0x130]
movzx eax, ax
imul edx, eax, 0x28
mov ecx, dword [ebp - 0x134]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000f240
add esp, 8
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x12d], al
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x72ea2607
mov ecx, 0xe5efe866
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dl, byte [ebp - 0x12d]
mov eax, 0xcfc10ed6
mov ecx, 0x1ec4405f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [ebp - 0x164]
mov dword [eax], 0
mov dword [ebp - 0x194], 0xdc35a16
jmp 0x10002628
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
add edx, 0x2bc637a5
add edx, eax
sub edx, 0x2bc637a5
mov eax, dword [ebp - 0x164]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
add eax, 0xc
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x194], 0xb61de589
jmp 0x10002628
mov eax, dword [ebp - 0x128]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x12c]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x178]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub ecx, 0x153e708b
add ecx, eax
add ecx, 0x153e708b
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d030
add esp, 0xc
mov eax, dword [ebp - 0x164]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov esi, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x168]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
sub esi, 0x32fb968e
add esi, eax
add esi, 0x32fb968e
mov eax, dword [ebp - 0x164]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x160]
mov byte [eax], cl
mov dword [ebp - 0x194], 0x1ec4405f
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ec074c1
mov ecx, 0x472627eb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [0x10034940]
mov ecx, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ec074c1
mov ecx, 0x635ead64
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0xee1c07c7
jmp 0x10002628
mov eax, dword [ebp - 0x16c]
mov ax, word [eax]
mov word [ebp - 0x124], ax
mov dword [ebp - 0x194], 0x14c13f90
jmp 0x10002628
mov ax, word [ebp - 0x124]
add ax, 0x2911
add ax, 1
sub ax, 0x2911
mov word [ebp - 0x122], ax
mov dword [ebp - 0x194], 0xc320a41c
jmp 0x10002628
mov eax, dword [ebp - 0x16c]
mov cx, word [ebp - 0x122]
mov word [eax], cx
mov dword [ebp - 0x194], 0x63fc1dcb
jmp 0x10002628
mov ecx, dword [0x10034940]
mov eax, dword [0x1003493c]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x81001640
mov ecx, 0xd62d8a42
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x120], eax
mov ecx, dword [0x10034940]
mov eax, dword [0x1003493c]
mov edx, ecx
sub edx, 0xd96d6550
sub edx, 1
add edx, 0xd96d6550
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x81001640
mov ecx, 0x101d442f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x194], eax
jmp 0x10002628
mov dword [ebp - 0x194], 0x1603bbc1
jmp 0x10002628
mov eax, dword [ebp - 0x120]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0xdef84516
jmp 0x10002628
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x184]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x194], 0x51dfab8d
jmp 0x10002628
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000c2d0
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x194], 0xcd9157ed
jmp 0x10002628
mov dword [ebp - 0x194], 0x1aa242c2
jmp 0x10002628
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 0x11c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x188]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x194], 0xc6e84647
jmp 0x10002628
mov dword [ebp - 0x194], 0x109cfd88
jmp 0x10002628
mov dword [ebp - 0x194], 0xcb76b30d
jmp 0x10002628
mov dword [ebp - 0x194], 0x5526e875
jmp 0x10002628
mov eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x194], 0xc5a1d4f4
jmp 0x10002628
mov ax, word [ebp - 0x130]
movzx eax, ax
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
add ecx, 0x26e9a21a
add ecx, eax
sub ecx, 0x26e9a21a
mov eax, dword [ebp - 0x168]
mov dword [eax], ecx
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000f240
add esp, 8
mov dword [ebp - 0x194], 0x985fa651
jmp 0x10002628
mov dword [ebp - 0x194], 0x472627eb
jmp 0x10002628
mov dword [ebp - 0x194], 0xd62d8a42
jmp 0x100010e8