Function at 0x100010b0
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x1b4
mov eax, dword [ebp + 8]
mov eax, dword [0x10093000]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x11c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.1000cfe0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x19c], 0x57a5edf8
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], eax
sub eax, 0x803cc33a
je 0x100016b1
jmp 0x10001123
mov eax, dword [ebp - 0x1a0]
sub eax, 0x89cfbc9a
je 0x10001587
jmp 0x10001139
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8a6fcaa8
je 0x10001855
jmp 0x1000114f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8ce03c2c
je 0x10001559
jmp 0x10001165
mov eax, dword [ebp - 0x1a0]
sub eax, 0x8e85456b
je 0x10001bfd
jmp 0x1000117b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x9acf9d7e
je 0x10001e27
jmp 0x10001191
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa23be60d
je 0x100018ad
jmp 0x100011a7
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa2ff3aee
je 0x10001e6d
jmp 0x100011bd
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa52817af
je 0x10001ca3
jmp 0x100011d3
mov eax, dword [ebp - 0x1a0]
sub eax, 0xb511c9e2
je 0x10001b5c
jmp 0x100011e9
mov eax, dword [ebp - 0x1a0]
sub eax, 0xbfb58cd5
je 0x10001f99
jmp 0x100011ff
mov eax, dword [ebp - 0x1a0]
sub eax, 0xc0462375
je 0x10001578
jmp 0x10001215
mov eax, dword [ebp - 0x1a0]
sub eax, 0xca9acd6a
je 0x10001687
jmp 0x1000122b
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcb2a55dd
je 0x10001db1
jmp 0x10001241
mov eax, dword [ebp - 0x1a0]
sub eax, 0xcfdfee44
je 0x10001ecd
jmp 0x10001257
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd27e2044
je 0x100015ae
jmp 0x1000126d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xd4f55598
je 0x10001696
jmp 0x10001283
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdadfc1ff
je 0x10001fea
jmp 0x10001299
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdb67c58e
je 0x10001f76
jmp 0x100012af
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdf924851
je 0x100019ce
jmp 0x100012c5
mov eax, dword [ebp - 0x1a0]
sub eax, 0xdfbf8068
je 0x10001923
jmp 0x100012db
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe3c8cafb
je 0x10001afd
jmp 0x100012f1
mov eax, dword [ebp - 0x1a0]
sub eax, 0xe9a81994
je 0x100017a3
jmp 0x10001307
mov eax, dword [ebp - 0x1a0]
sub eax, 0xf374d406
je 0x10001b1e
jmp 0x1000131d
mov eax, dword [ebp - 0x1a0]
sub eax, 0xfb5d9dfc
je 0x1000172d
jmp 0x10001333
mov eax, dword [ebp - 0x1a0]
sub eax, 0x22d20bb
je 0x10001cc4
jmp 0x10001349
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3ac83ec
je 0x10001e18
jmp 0x1000135f
mov eax, dword [ebp - 0x1a0]
sub eax, 0xa7184f2
je 0x10001f43
jmp 0x10001375
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1952d116
je 0x1000201b
jmp 0x1000138b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1959af26
je 0x1000199b
jmp 0x100013a1
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1ae20060
je 0x10001a6a
jmp 0x100013b7
mov eax, dword [ebp - 0x1a0]
sub eax, 0x1d4febab
je 0x100019eb
jmp 0x100013cd
mov eax, dword [ebp - 0x1a0]
sub eax, 0x2910a439
je 0x100015ea
jmp 0x100013e3
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3d6bf435
je 0x10001825
jmp 0x100013f9
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4048447e
je 0x10001e44
jmp 0x1000140f
mov eax, dword [ebp - 0x1a0]
sub eax, 0x41c34b19
je 0x10001864
jmp 0x10001425
mov eax, dword [ebp - 0x1a0]
sub eax, 0x48827108
je 0x10001fa8
jmp 0x1000143b
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4903391d
je 0x10001834
jmp 0x10001451
mov eax, dword [ebp - 0x1a0]
sub eax, 0x4edc2e32
je 0x10001fcf
jmp 0x10001467
mov eax, dword [ebp - 0x1a0]
sub eax, 0x57a5edf8
je 0x10001532
jmp 0x1000147d
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5acc253f
je 0x10001702
jmp 0x10001493
mov eax, dword [ebp - 0x1a0]
sub eax, 0x5c8f0f48
je 0x10001a19
jmp 0x100014a9
mov eax, dword [ebp - 0x1a0]
sub eax, 0x63397620
je 0x10001b87
jmp 0x100014bf
mov eax, dword [ebp - 0x1a0]
sub eax, 0x6ca15d15
je 0x10001f34
jmp 0x100014d5
mov eax, dword [ebp - 0x1a0]
sub eax, 0x71ccbc40
je 0x10001f85
jmp 0x100014eb
mov eax, dword [ebp - 0x1a0]
sub eax, 0x738a5cff
je 0x1000198c
jmp 0x10001501
mov eax, dword [ebp - 0x1a0]
sub eax, 0x76be3a5a
je 0x10001e7c
jmp 0x10001517
mov eax, dword [ebp - 0x1a0]
sub eax, 0x7a3d1dd7
je 0x10001d3f
jmp 0x1000152d
jmp 0x10002037
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x19c], 0x8ce03c2c
jmp 0x10002037
mov eax, 0xc0462375
mov ecx, 0x89cfbc9a
cmp dword [ebp - 0x174], 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dword [ebp - 0x19c], 0x71ccbc40
jmp 0x10002037
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x19c], 0xd27e2044
jmp 0x10002037
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x164]
lea eax, [ebp - 0x11c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
sub esp, 0x10
mov dword [ebp - 0x19c], 0x2910a439
jmp 0x10002037
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x178], eax
lea eax, [ebp - 0x110]
mov ecx, dword [ebp - 0x174]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
lea eax, [ebp - 0x110]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov dword [ebp - 0x17c], eax
mov edx, 0xffffffff
mov eax, 0xd4f55598
mov ecx, 0xca9acd6a
cmp dword [ebp - 0x17c], edx
cmove eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dword [ebp - 0x19c], 0x71ccbc40
jmp 0x10002037
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x19c], 0x803cc33a
jmp 0x10002037
mov eax, dword [ebp - 0x160]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub esp, 0x18
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x19c], 0x5acc253f
jmp 0x10002037
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x180], eax
mov eax, 0xfb5d9dfc
mov ecx, 0x41c34b19
cmp dword [ebp - 0x180], 0
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov ecx, dword [0x10094338]
mov eax, dword [0x10094334]
mov edx, ecx
sub edx, 0x4320c745
sub edx, 1
add edx, 0x4320c745
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xbfb58cd5
mov ecx, 0xe9a81994
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x158], eax
mov ecx, dword [0x10094338]
mov eax, dword [0x10094334]
mov edx, ecx
add edx, 0x24e1c106
sub edx, 1
sub edx, 0x24e1c106
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbfb58cd5
mov ecx, 0x3d6bf435
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dword [ebp - 0x19c], 0x4903391d
jmp 0x10002037
mov eax, dword [ebp - 0x158]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0x8a6fcaa8
jmp 0x10002037
mov dword [ebp - 0x19c], 0x71ccbc40
jmp 0x10002037
mov eax, dword [ebp - 0x180]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub esp, 0x14
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x19c], 0xa23be60d
jmp 0x10002037
mov ecx, dword [0x10094338]
mov eax, dword [0x10094334]
mov edx, ecx
add edx, 0x19772d6c
sub edx, 1
sub edx, 0x19772d6c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x48827108
mov ecx, 0xdfbf8068
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov eax, dword [0x10094338]
mov ecx, dword [0x10094334]
mov edx, eax
sub edx, 0x88183a2
sub edx, 1
add edx, 0x88183a2
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x48827108
mov ecx, 0x738a5cff
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dword [ebp - 0x19c], 0x1959af26
jmp 0x10002037
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x188]
mov edx, dword [ecx + 0x3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x18c], eax
mov word [ebp - 0x18e], 0
mov dword [ebp - 0x19c], 0xdf924851
jmp 0x10002037
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x14e], ax
mov dword [ebp - 0x19c], 0x1d4febab
jmp 0x10002037
mov ax, word [ebp - 0x14e]
movzx eax, ax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x18c]
add eax, 4
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x19c], 0x5c8f0f48
jmp 0x10002037
mov eax, dword [0x10094338]
mov ecx, dword [0x10094334]
mov edx, eax
add edx, 0x7947ae40
sub edx, 1
sub edx, 0x7947ae40
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x4edc2e32
mov ecx, 0x1ae20060
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov eax, dword [ebp - 0x148]
movzx ecx, word [eax + 2]
mov eax, dword [ebp - 0x14c]
cmp eax, ecx
setl al
and al, 1
mov byte [ebp - 0x141], al
mov ecx, dword [0x10094338]
mov eax, dword [0x10094334]
mov edx, ecx
add edx, 0x5c655ee9
sub edx, 1
sub edx, 0x5c655ee9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x4edc2e32
mov ecx, 0xe3c8cafb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dl, byte [ebp - 0x141]
mov eax, 0x76be3a5a
mov ecx, 0xf374d406
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov eax, dword [ebp - 0x18c]
sub eax, 0x16c398ad
add eax, 0x18
add eax, 0x16c398ad
mov ecx, dword [ebp - 0x18c]
movzx ecx, word [ecx + 0x14]
add eax, 0x90778879
add eax, ecx
sub eax, 0x90778879
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x19c], 0xb511c9e2
jmp 0x10002037
mov eax, dword [ebp - 0x140]
movzx ecx, word [ebp - 0x18e]
imul edx, ecx, 0x28
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x19c], 0x63397620
jmp 0x10002037
mov ecx, dword [0x10094338]
mov eax, dword [0x10094334]
mov edx, ecx
add edx, 0xd446e1b1
sub edx, 1
sub edx, 0xd446e1b1
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xdadfc1ff
mov ecx, 0x8e85456b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000f350
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x135], al
mov ecx, dword [0x10094338]
mov eax, dword [0x10094334]
mov edx, ecx
add edx, 0x8e707f79
sub edx, 1
sub edx, 0x8e707f79
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdadfc1ff
mov ecx, 0xa52817af
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dl, byte [ebp - 0x135]
mov eax, 0x22d20bb
mov ecx, 0x3ac83ec
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x194]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
lea eax, [ebp - 0x120]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x195], al
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x19c], 0x7a3d1dd7
jmp 0x10002037
mov eax, dword [ebp - 0x194]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x134]
xor eax, eax
sub eax, ecx
sub edx, eax
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x194]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0x194]
mov eax, dword [eax + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1000d140
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x19c], 0xcb2a55dd
jmp 0x10002037
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x178]
mov eax, dword [ebp - 0x194]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, esi
add eax, ecx
xor esi, esi
sub esi, eax
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x120]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 0x195], al
mov dword [ebp - 0x19c], 0x3ac83ec
jmp 0x10002037
mov dword [ebp - 0x19c], 0x9acf9d7e
jmp 0x10002037
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x126], ax
mov dword [ebp - 0x19c], 0x4048447e
jmp 0x10002037
mov ax, word [ebp - 0x126]
sub ax, 0xc0cd
add ax, 1
add ax, 0xc0cd
mov word [ebp - 0x18e], ax
mov dword [ebp - 0x19c], 0xa2ff3aee
jmp 0x10002037
mov dword [ebp - 0x19c], 0xdf924851
jmp 0x10002037
mov eax, dword [0x10094338]
mov ecx, dword [0x10094334]
mov edx, eax
sub edx, 0x130ec30d
sub edx, 1
add edx, 0x130ec30d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1952d116
mov ecx, 0xcfdfee44
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x124], eax
mov eax, dword [0x10094338]
mov ecx, dword [0x10094334]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1952d116
mov ecx, 0x6ca15d15
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x10002037
mov dword [ebp - 0x19c], 0xa7184f2
jmp 0x10002037
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0xdb67c58e
jmp 0x10002037
mov dword [ebp - 0x19c], 0x71ccbc40
jmp 0x10002037
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000c3e0
add esp, 0x1b4
pop esi
pop ebx
pop ebp
ret
mov dword [ebp - 0x19c], 0xe9a81994
jmp 0x10002037
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x19c], 0xdfbf8068
jmp 0x10002037
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x19c], 0x1ae20060
jmp 0x10002037
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x194]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x100193b0
call fcn.1000f350
mov dword [ebp - 0x19c], 0x8e85456b
jmp 0x10002037
mov eax, dword [ebp - 0x17c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x19c], 0xcfdfee44
jmp 0x10001107