Function at 0x1000dfe0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [0x10067400]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
add edx, 0x569129bf
sub edx, 1
sub edx, 0x569129bf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [ebp - 0xa2], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [ebp - 0xa1], al
mov dword [ebp - 0xa8], 0x8311cd2f
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
sub eax, 0x81d52557
je 0x1000f62c
jmp 0x1000e064
mov eax, dword [ebp - 0xb0]
sub eax, 0x8311cd2f
je 0x1000e699
jmp 0x1000e07a
mov eax, dword [ebp - 0xb0]
sub eax, 0x8982537a
je 0x1000e926
jmp 0x1000e090
mov eax, dword [ebp - 0xb0]
sub eax, 0x8a7f0d4e
je 0x1000f459
jmp 0x1000e0a6
mov eax, dword [ebp - 0xb0]
sub eax, 0x8a8a8bd5
je 0x1000f44a
jmp 0x1000e0bc
mov eax, dword [ebp - 0xb0]
sub eax, 0xacc7533e
je 0x1000f3b5
jmp 0x1000e0d2
mov eax, dword [ebp - 0xb0]
sub eax, 0xad491ce3
je 0x1000e833
jmp 0x1000e0e8
mov eax, dword [ebp - 0xb0]
sub eax, 0xb24a6eab
je 0x1000eb64
jmp 0x1000e0fe
mov eax, dword [ebp - 0xb0]
sub eax, 0xb5dc1571
je 0x1000f893
jmp 0x1000e114
mov eax, dword [ebp - 0xb0]
sub eax, 0xb8c3a019
je 0x1000f54d
jmp 0x1000e12a
mov eax, dword [ebp - 0xb0]
sub eax, 0xb9755298
je 0x1000f733
jmp 0x1000e140
mov eax, dword [ebp - 0xb0]
sub eax, 0xc08cf82c
je 0x1000ef73
jmp 0x1000e156
mov eax, dword [ebp - 0xb0]
sub eax, 0xc3d5247f
je 0x1000eaf3
jmp 0x1000e16c
mov eax, dword [ebp - 0xb0]
sub eax, 0xc49dfbec
je 0x1000f742
jmp 0x1000e182
mov eax, dword [ebp - 0xb0]
sub eax, 0xc5bc1c85
je 0x1000e765
jmp 0x1000e198
mov eax, dword [ebp - 0xb0]
sub eax, 0xc7d0f7de
je 0x1000f4e8
jmp 0x1000e1ae
mov eax, dword [ebp - 0xb0]
sub eax, 0xd8a68af4
je 0x1000f790
jmp 0x1000e1c4
mov eax, dword [ebp - 0xb0]
sub eax, 0xda937054
je 0x1000edbd
jmp 0x1000e1da
mov eax, dword [ebp - 0xb0]
sub eax, 0xdb0cff30
je 0x1000f61d
jmp 0x1000e1f0
mov eax, dword [ebp - 0xb0]
sub eax, 0xdeff548e
je 0x1000f341
jmp 0x1000e206
mov eax, dword [ebp - 0xb0]
sub eax, 0xe5bbf19d
je 0x1000efa5
jmp 0x1000e21c
mov eax, dword [ebp - 0xb0]
sub eax, 0xec7911fe
je 0x1000e77d
jmp 0x1000e232
mov eax, dword [ebp - 0xb0]
sub eax, 0xedbd3347
je 0x1000f8ba
jmp 0x1000e248
mov eax, dword [ebp - 0xb0]
sub eax, 0xf621b43b
je 0x1000f01b
jmp 0x1000e25e
mov eax, dword [ebp - 0xb0]
sub eax, 0xf694e883
je 0x1000f646
jmp 0x1000e274
mov eax, dword [ebp - 0xb0]
sub eax, 0xf6c7a54e
je 0x1000f116
jmp 0x1000e28a
mov eax, dword [ebp - 0xb0]
sub eax, 0xf8c54ff1
je 0x1000f68f
jmp 0x1000e2a0
mov eax, dword [ebp - 0xb0]
sub eax, 0xf9eedea5
je 0x1000ea6c
jmp 0x1000e2b6
mov eax, dword [ebp - 0xb0]
sub eax, 0xfbaac508
je 0x1000ec69
jmp 0x1000e2cc
mov eax, dword [ebp - 0xb0]
sub eax, 0x478cbbd
je 0x1000f82a
jmp 0x1000e2e2
mov eax, dword [ebp - 0xb0]
sub eax, 0x4cec62b
je 0x1000eb81
jmp 0x1000e2f8
mov eax, dword [ebp - 0xb0]
sub eax, 0x8e33574
je 0x1000e756
jmp 0x1000e30e
mov eax, dword [ebp - 0xb0]
sub eax, 0xafc5382
je 0x1000f194
jmp 0x1000e324
mov eax, dword [ebp - 0xb0]
sub eax, 0xc5cc82b
je 0x1000f926
jmp 0x1000e33a
mov eax, dword [ebp - 0xb0]
sub eax, 0xd060bb1
je 0x1000ed64
jmp 0x1000e350
mov eax, dword [ebp - 0xb0]
sub eax, 0xd6e5d0d
je 0x1000f2ea
jmp 0x1000e366
mov eax, dword [ebp - 0xb0]
sub eax, 0xf65abbc
je 0x1000eb9f
jmp 0x1000e37c
mov eax, dword [ebp - 0xb0]
sub eax, 0x13489fc4
je 0x1000e977
jmp 0x1000e392
mov eax, dword [ebp - 0xb0]
sub eax, 0x13b0ef9b
je 0x1000f1a3
jmp 0x1000e3a8
mov eax, dword [ebp - 0xb0]
sub eax, 0x13de1748
je 0x1000ee6d
jmp 0x1000e3be
mov eax, dword [ebp - 0xb0]
sub eax, 0x18119b11
je 0x1000f80c
jmp 0x1000e3d4
mov eax, dword [ebp - 0xb0]
sub eax, 0x1e36cbc8
je 0x1000f5ca
jmp 0x1000e3ea
mov eax, dword [ebp - 0xb0]
sub eax, 0x1ed1cda7
je 0x1000f55c
jmp 0x1000e400
mov eax, dword [ebp - 0xb0]
sub eax, 0x2309da11
je 0x1000f472
jmp 0x1000e416
mov eax, dword [ebp - 0xb0]
sub eax, 0x232baf26
je 0x1000f772
jmp 0x1000e42c
mov eax, dword [ebp - 0xb0]
sub eax, 0x28a4304b
je 0x1000f90d
jmp 0x1000e442
mov eax, dword [ebp - 0xb0]
sub eax, 0x29a80f8c
je 0x1000f8e2
jmp 0x1000e458
mov eax, dword [ebp - 0xb0]
sub eax, 0x2c88d50c
je 0x1000ebb9
jmp 0x1000e46e
mov eax, dword [ebp - 0xb0]
sub eax, 0x3343a848
je 0x1000ee0e
jmp 0x1000e484
mov eax, dword [ebp - 0xb0]
sub eax, 0x3514acf3
je 0x1000e6c8
jmp 0x1000e49a
mov eax, dword [ebp - 0xb0]
sub eax, 0x394f1cad
je 0x1000e917
jmp 0x1000e4b0
mov eax, dword [ebp - 0xb0]
sub eax, 0x3c1351dd
je 0x1000f781
jmp 0x1000e4c6
mov eax, dword [ebp - 0xb0]
sub eax, 0x47a7d50a
je 0x1000eb02
jmp 0x1000e4dc
mov eax, dword [ebp - 0xb0]
sub eax, 0x4c3735b1
je 0x1000ea5d
jmp 0x1000e4f2
mov eax, dword [ebp - 0xb0]
sub eax, 0x4fd97cd0
je 0x1000f8a8
jmp 0x1000e508
mov eax, dword [ebp - 0xb0]
sub eax, 0x51dad37f
je 0x1000f0c5
jmp 0x1000e51e
mov eax, dword [ebp - 0xb0]
sub eax, 0x529cbf2c
je 0x1000f308
jmp 0x1000e534
mov eax, dword [ebp - 0xb0]
sub eax, 0x551998cf
je 0x1000f0a7
jmp 0x1000e54a
mov eax, dword [ebp - 0xb0]
sub eax, 0x57002f2c
je 0x1000ead1
jmp 0x1000e560
mov eax, dword [ebp - 0xb0]
sub eax, 0x5de1711d
je 0x1000e8a1
jmp 0x1000e576
mov eax, dword [ebp - 0xb0]
sub eax, 0x5fe50685
je 0x1000ec5a
jmp 0x1000e58c
mov eax, dword [ebp - 0xb0]
sub eax, 0x613aa3ee
je 0x1000f839
jmp 0x1000e5a2
mov eax, dword [ebp - 0xb0]
sub eax, 0x68ff5a74
je 0x1000f1ff
jmp 0x1000e5b8
mov eax, dword [ebp - 0xb0]
sub eax, 0x6a4f3c94
je 0x1000ef64
jmp 0x1000e5ce
mov eax, dword [ebp - 0xb0]
sub eax, 0x6a4fc56b
je 0x1000ec02
mov al, byte [ebp - 0xa2]
mov cl, byte [ebp - 0xa1]
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x232baf26
mov ecx, 0x3514acf3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
push eax
mov eax, esp
mov dword [ebp - 0xa0], eax
push eax
mov eax, esp
mov dword [ebp - 0x9c], eax
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x98], eax
push eax
mov eax, esp
mov dword [ebp - 0x94], eax
push eax
mov eax, esp
mov dword [ebp - 0x90], eax
sub esp, 0x104
mov eax, esp
mov dword [ebp - 0x8c], eax
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
mov edx, eax
sub edx, 0x2a639195
sub edx, 1
add edx, 0x2a639195
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x232baf26
mov ecx, 0x8e33574
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0xc5bc1c85
jmp 0x1000f959
push eax
mov eax, esp
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xa8], 0xec7911fe
jmp 0x1000f959
mov ecx, dword [ebp - 0xac]
push eax
mov eax, esp
mov dword [ebp - 0x84], eax
push eax
mov eax, esp
mov dword [ebp - 0x80], eax
push eax
mov eax, esp
mov dword [ebp - 0x7c], eax
push eax
mov eax, esp
mov dword [ebp - 0x78], eax
push eax
mov eax, esp
mov dword [ebp - 0x74], eax
push eax
mov eax, esp
mov dword [ebp - 0x70], eax
push eax
mov eax, esp
mov dword [ebp - 0x6c], eax
push eax
mov eax, esp
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xa0]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1002ba30
add esp, 0xc
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov edx, dword [ebp - 0x94]
mov eax, 0xad491ce3
mov ecx, 0x8982537a
cmp dword [edx], 0
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c1351dd
mov ecx, 0x5de1711d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
add edx, 0xecca46e6
sub edx, 1
sub edx, 0xecca46e6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c1351dd
mov ecx, 0x394f1cad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x7e573d54
jmp 0x1000f959
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
mov edx, eax
add edx, 0x3d83cfeb
sub edx, 1
sub edx, 0x3d83cfeb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd8a68af4
mov ecx, 0x13489fc4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x64], eax
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
sub edx, 0xb66e312d
sub edx, 1
add edx, 0xb66e312d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xd8a68af4
mov ecx, 0x4c3735b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0xf9eedea5
jmp 0x1000f959
mov eax, dword [ebp - 0x64]
xor ecx, ecx
sub esp, 0x1c
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xa8], 0x57002f2c
jmp 0x1000f959
mov edx, dword [ebp - 0x60]
mov esi, 0xffffffff
mov eax, 0x47a7d50a
mov ecx, 0xc3d5247f
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x7e573d54
jmp 0x1000f959
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov eax, dword [ebp - 0x84]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xa8], 0xb24a6eab
jmp 0x1000f959
mov eax, dword [ebp - 0x5c]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x55], al
mov dword [ebp - 0xa8], 0x4cec62b
jmp 0x1000f959
mov dl, byte [ebp - 0x55]
mov eax, 0xf65abbc
mov ecx, 0xd060bb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0xa8], 0x2c88d50c
jmp 0x1000f959
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x18119b11
mov ecx, 0x6a4fc56b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0xfbaac508
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
sub edx, 0x1eb41e65
sub edx, 1
add edx, 0x1eb41e65
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x478cbbd
mov ecx, 0x73031786
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x80]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov dword [ebp - 0xa8], 0xda937054
jmp 0x1000f959
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
mov edx, eax
sub edx, 0x3d52ac7
sub edx, 1
add edx, 0x3d52ac7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x613aa3ee
mov ecx, 0x3343a848
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x613aa3ee
mov ecx, 0x13de1748
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x6c0dc976
jmp 0x1000f959
mov dword [ebp - 0xa8], 0xc08cf82c
jmp 0x1000f959
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
mov word [ebp - 0x46], ax
mov dword [ebp - 0xa8], 0x6fc5a482
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
add edx, 0x657b5ebd
sub edx, 1
sub edx, 0x657b5ebd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xb5dc1571
mov ecx, 0xf621b43b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
movzx ecx, word [eax + 6]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x3d], al
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
sub edx, 0x36ad86a6
sub edx, 1
add edx, 0x36ad86a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xb5dc1571
mov ecx, 0x551998cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dl, byte [ebp - 0x3d]
mov eax, 0x81d52557
mov ecx, 0x51dad37f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
mov edx, eax
sub edx, 0x3ca1ad2b
sub edx, 1
add edx, 0x3ca1ad2b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4fd97cd0
mov ecx, 0xf6c7a54e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
add edx, 0xb274f845
sub edx, 1
sub edx, 0xb274f845
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x4fd97cd0
mov ecx, 0xafc5382
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x13b0ef9b
jmp 0x1000f959
mov ecx, dword [ebp - 0x3c]
add ecx, 0x2f9e6d82
add ecx, 0x18
sub ecx, 0x2f9e6d82
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
movzx edx, word [eax + 0x14]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x74]
movzx eax, word [eax]
imul eax, eax, 0x28
add ecx, 0x53edd82c
add ecx, eax
sub ecx, 0x53edd82c
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa8], 0x68ff5a74
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
sub edx, 0x249c6a25
sub edx, 1
add edx, 0x249c6a25
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xedbd3347
mov ecx, 0x7ab61d74
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dl, byte [ebp - 0x31]
mov eax, 0x529cbf2c
mov ecx, 0x8a8a8bd5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x6c]
mov dword [eax], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xa8], 0xdeff548e
jmp 0x1000f959
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
sub edx, 0x7ce774d2
add edx, eax
add edx, 0x7ce774d2
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x30]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa8], 0xacc7533e
jmp 0x1000f959
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x20]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x24]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1002bb90
add esp, 0xc
mov eax, dword [ebp - 0x6c]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x90]
mov esi, dword [eax]
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
xor eax, eax
sub eax, edi
sub esi, eax
mov eax, dword [ebp - 0x6c]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x68]
mov byte [eax], cl
mov dword [ebp - 0xa8], 0x8a8a8bd5
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x8a7f0d4e
jmp 0x1000f959
mov eax, dword [ebp - 0x74]
mov ax, word [eax]
mov word [ebp - 0x1c], ax
mov dword [ebp - 0xa8], 0x2309da11
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
add edx, 0x7bf434c1
sub edx, 1
sub edx, 0x7bf434c1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x29a80f8c
mov ecx, 0xc7d0f7de
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov ax, word [ebp - 0x1c]
add ax, 0xdd0b
add ax, 1
sub ax, 0xdd0b
mov word [ebp - 0x1a], ax
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
mov edx, eax
sub edx, 0x4a9670e5
sub edx, 1
add edx, 0x4a9670e5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x29a80f8c
mov ecx, 0xb8c3a019
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x1ed1cda7
jmp 0x1000f959
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x28a4304b
mov ecx, 0x1e36cbc8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x74]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x28a4304b
mov ecx, 0xdb0cff30
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0xc08cf82c
jmp 0x1000f959
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa8], 0xf694e883
jmp 0x1000f959
mov eax, dword [0x100688cc]
mov ecx, dword [0x100688c8]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc5cc82b
mov ecx, 0xf8c54ff1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x100688cc]
mov eax, dword [0x100688c8]
mov edx, ecx
add edx, 0x6b591d81
sub edx, 1
sub edx, 0x6b591d81
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc5cc82b
mov ecx, 0xb9755298
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xa8], eax
jmp 0x1000f959
mov dword [ebp - 0xa8], 0xc49dfbec
jmp 0x1000f959
mov eax, dword [ebp - 0x14]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0x7e573d54
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x3514acf3
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x5de1711d
jmp 0x1000f959
mov eax, dword [ebp - 0x94]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x9c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x98]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa8], 0x13489fc4
jmp 0x1000f959
mov eax, dword [ebp - 0x54]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa8], 0x6a4fc56b
jmp 0x1000f959
mov dword [ebp - 0xa8], 0x73031786
jmp 0x1000f959
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xa8], 0x3343a848
jmp 0x1000f959
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xa8], 0xf621b43b
jmp 0x1000f959
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xa8], 0xf6c7a54e
jmp 0x1000f959
mov ecx, dword [ebp - 0x38]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100398e6
call fcn.1002f390
add esp, 8
mov dword [ebp - 0xa8], 0x7ab61d74
jmp 0x1000f959
mov ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1c]
mov ax, word [ebp - 0x1c]
mov dword [ebp - 0xa8], 0xc7d0f7de
jmp 0x1000f959
mov eax, dword [ebp - 0x74]
mov cx, word [ebp - 0x1a]
mov word [eax], cx
mov dword [ebp - 0xa8], 0x1e36cbc8
jmp 0x1000f959
mov eax, dword [ebp - 0x18]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa8], 0xf8c54ff1
jmp 0x1000e048