Function at 0x10001950
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x1006f004]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xb0], 0xc8ed8b62
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
sub eax, 0x83445728
je 0x10002a7e
jmp 0x10001994
mov eax, dword [ebp - 0xb8]
sub eax, 0x847473fa
je 0x1000333b
jmp 0x100019aa
mov eax, dword [ebp - 0xb8]
sub eax, 0x8875323a
je 0x100033a9
jmp 0x100019c0
mov eax, dword [ebp - 0xb8]
sub eax, 0x8992b7af
je 0x10004087
jmp 0x100019d6
mov eax, dword [ebp - 0xb8]
sub eax, 0x8c673fb8
je 0x1000481a
jmp 0x100019ec
mov eax, dword [ebp - 0xb8]
sub eax, 0x8cc174ce
je 0x10002d67
jmp 0x10001a02
mov eax, dword [ebp - 0xb8]
sub eax, 0x8eb17fea
je 0x10002c11
jmp 0x10001a18
mov eax, dword [ebp - 0xb8]
sub eax, 0x8f09d875
je 0x10004121
jmp 0x10001a2e
mov eax, dword [ebp - 0xb8]
sub eax, 0x94f7f6e8
je 0x100048bb
jmp 0x10001a44
mov eax, dword [ebp - 0xb8]
sub eax, 0x97f5eed9
je 0x100032c5
jmp 0x10001a5a
mov eax, dword [ebp - 0xb8]
sub eax, 0x98cd5358
je 0x1000484c
jmp 0x10001a70
mov eax, dword [ebp - 0xb8]
sub eax, 0x9d324e30
je 0x10003a6e
jmp 0x10001a86
mov eax, dword [ebp - 0xb8]
sub eax, 0x9d794f6c
je 0x100048f7
jmp 0x10001a9c
mov eax, dword [ebp - 0xb8]
sub eax, 0x9f085163
je 0x100042b0
jmp 0x10001ab2
mov eax, dword [ebp - 0xb8]
sub eax, 0xa018e359
je 0x100030b1
jmp 0x10001ac8
mov eax, dword [ebp - 0xb8]
sub eax, 0xa17f9048
je 0x1000398f
jmp 0x10001ade
mov eax, dword [ebp - 0xb8]
sub eax, 0xa3479f86
je 0x100048e8
jmp 0x10001af4
mov eax, dword [ebp - 0xb8]
sub eax, 0xa41a487f
je 0x1000477c
jmp 0x10001b0a
mov eax, dword [ebp - 0xb8]
sub eax, 0xa4ca2bab
je 0x10004394
jmp 0x10001b20
mov eax, dword [ebp - 0xb8]
sub eax, 0xa579eefc
je 0x100033f2
jmp 0x10001b36
mov eax, dword [ebp - 0xb8]
sub eax, 0xaa40b8ea
je 0x10002bc0
jmp 0x10001b4c
mov eax, dword [ebp - 0xb8]
sub eax, 0xad6aa716
je 0x100044d4
jmp 0x10001b62
mov eax, dword [ebp - 0xb8]
sub eax, 0xb055f796
je 0x10003c82
jmp 0x10001b78
mov eax, dword [ebp - 0xb8]
sub eax, 0xb1291245
je 0x10002882
jmp 0x10001b8e
mov eax, dword [ebp - 0xb8]
sub eax, 0xb2cf037a
je 0x100046fc
jmp 0x10001ba4
mov eax, dword [ebp - 0xb8]
sub eax, 0xb7e792b9
je 0x10002714
jmp 0x10001bba
mov eax, dword [ebp - 0xb8]
sub eax, 0xb82f8e4f
je 0x10003edd
jmp 0x10001bd0
mov eax, dword [ebp - 0xb8]
sub eax, 0xb949275b
je 0x100029a7
jmp 0x10001be6
mov eax, dword [ebp - 0xb8]
sub eax, 0xb9c0c571
je 0x10003592
jmp 0x10001bfc
mov eax, dword [ebp - 0xb8]
sub eax, 0xbc17bccc
je 0x10003aef
jmp 0x10001c12
mov eax, dword [ebp - 0xb8]
sub eax, 0xbd21870a
je 0x10002ddd
jmp 0x10001c28
mov eax, dword [ebp - 0xb8]
sub eax, 0xc5f3ea0f
je 0x10004256
jmp 0x10001c3e
mov eax, dword [ebp - 0xb8]
sub eax, 0xc6421258
je 0x10004332
jmp 0x10001c54
mov eax, dword [ebp - 0xb8]
sub eax, 0xc8e49321
je 0x10003a5f
jmp 0x10001c6a
mov eax, dword [ebp - 0xb8]
sub eax, 0xc8ed8b62
je 0x1000255f
jmp 0x10001c80
mov eax, dword [ebp - 0xb8]
sub eax, 0xcc2b64bb
je 0x10003522
jmp 0x10001c96
mov eax, dword [ebp - 0xb8]
sub eax, 0xcd976201
je 0x10003616
jmp 0x10001cac
mov eax, dword [ebp - 0xb8]
sub eax, 0xceabfa3e
je 0x100047c9
jmp 0x10001cc2
mov eax, dword [ebp - 0xb8]
sub eax, 0xd23f871a
je 0x10002ffa
jmp 0x10001cd8
mov eax, dword [ebp - 0xb8]
sub eax, 0xd28b5731
je 0x100037b5
jmp 0x10001cee
mov eax, dword [ebp - 0xb8]
sub eax, 0xd4ad213b
je 0x10003583
jmp 0x10001d04
mov eax, dword [ebp - 0xb8]
sub eax, 0xd75ded8c
je 0x10003dc6
jmp 0x10001d1a
mov eax, dword [ebp - 0xb8]
sub eax, 0xd7d5b608
je 0x10004471
jmp 0x10001d30
mov eax, dword [ebp - 0xb8]
sub eax, 0xd8f383f4
je 0x10002e62
jmp 0x10001d46
mov eax, dword [ebp - 0xb8]
sub eax, 0xd9f17332
je 0x100044ef
jmp 0x10001d5c
mov eax, dword [ebp - 0xb8]
sub eax, 0xdb30fe0f
je 0x1000365f
jmp 0x10001d72
mov eax, dword [ebp - 0xb8]
sub eax, 0xe1c0f5c3
je 0x10002f9e
jmp 0x10001d88
mov eax, dword [ebp - 0xb8]
sub eax, 0xe4708100
je 0x1000296e
jmp 0x10001d9e
mov eax, dword [ebp - 0xb8]
sub eax, 0xe5c719c8
je 0x100030da
jmp 0x10001db4
mov eax, dword [ebp - 0xb8]
sub eax, 0xe91d84f3
je 0x10004006
jmp 0x10001dca
mov eax, dword [ebp - 0xb8]
sub eax, 0xec16ca21
je 0x10003f81
jmp 0x10001de0
mov eax, dword [ebp - 0xb8]
sub eax, 0xee8f8d59
je 0x10002f4d
jmp 0x10001df6
mov eax, dword [ebp - 0xb8]
sub eax, 0xf0fa02a2
je 0x100041e8
jmp 0x10001e0c
mov eax, dword [ebp - 0xb8]
sub eax, 0xf1bc252f
je 0x100045ce
jmp 0x10001e22
mov eax, dword [ebp - 0xb8]
sub eax, 0xf29d92eb
je 0x100030c0
jmp 0x10001e38
mov eax, dword [ebp - 0xb8]
sub eax, 0xf3255c00
je 0x10002ba2
jmp 0x10001e4e
mov eax, dword [ebp - 0xb8]
sub eax, 0xf37c2bf6
je 0x10003ccb
jmp 0x10001e64
mov eax, dword [ebp - 0xb8]
sub eax, 0xf4f6a2d0
je 0x10004617
jmp 0x10001e7a
mov eax, dword [ebp - 0xb8]
sub eax, 0xf6ec37e8
je 0x100035f6
jmp 0x10001e90
mov eax, dword [ebp - 0xb8]
sub eax, 0xf6ec43e8
je 0x10003f0b
jmp 0x10001ea6
mov eax, dword [ebp - 0xb8]
sub eax, 0xf866d7b0
je 0x100029e3
jmp 0x10001ebc
mov eax, dword [ebp - 0xb8]
sub eax, 0xf8fea41d
je 0x100027e8
jmp 0x10001ed2
mov eax, dword [ebp - 0xb8]
sub eax, 0xfeba0fc2
je 0x10004558
jmp 0x10001ee8
mov eax, dword [ebp - 0xb8]
sub eax, 0x24a7bf7
je 0x100047e7
jmp 0x10001efe
mov eax, dword [ebp - 0xb8]
sub eax, 0x2772395
je 0x100048ac
push eax
sub esp, 0x100
mov eax, esp
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xb0], 0x2dbb7a1a
jmp 0x10004901
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, esp
mov dword [ebp - 0x80], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x7c], ecx
push eax
mov ecx, esp
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0xa0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
call fcn.10011dc0
add esp, 0xc
mov eax, dword [ebp - 0xa0]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
setne al
and al, 1
mov byte [ebp - 0x71], al
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0xf0275cae
sub edx, 1
sub edx, 0xf0275cae
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x30744029
mov ecx, 0x497784cb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41effc0a
mov ecx, 0x2e82657c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dl, byte [ebp - 0x71]
mov eax, 0x55dff9b5
mov ecx, 0xe4708100
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa4]
lea eax, [ebp - 0x18]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
call sub.KERNEL32.dll_K32GetModuleInformation
mov dword [ebp - 0xb0], 0xb949275b
jmp 0x10004901
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa8]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0xb0], 0xf866d7b0
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6255076f
mov ecx, 0x4c7c417c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0x5705ffff
jmp 0x10004901
mov dl, byte [ebp - 0x65]
mov eax, 0x71cbdb57
mov ecx, 0xaa40b8ea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x57c2257f
sub edx, 1
add edx, 0x57c2257f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x21a70c9a
mov ecx, 0x8eb17fea
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x21a70c9a
mov ecx, 0x4838ae4d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x187d0b0e
sub edx, 1
sub edx, 0x187d0b0e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc6421258
mov ecx, 0xbd21870a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x64]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x60], eax
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc6421258
mov ecx, 0xd8f383f4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0x872e2ff
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0xf561334d
sub edx, 1
sub edx, 0xf561334d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41725634
mov ecx, 0xe1c0f5c3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x965a2e72
sub edx, 1
add edx, 0x965a2e72
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x41725634
mov ecx, 0xd23f871a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x51ae309d
mov ecx, 0x74e6cd0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0xf29d92eb
jmp 0x10004901
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0xb0], 0xe5c719c8
jmp 0x10004901
mov edx, dword [ebp - 0x5c]
mov eax, 0x447b23c3
mov ecx, 0x97f5eed9
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x89ce10d6
sub edx, 1
sub edx, 0x89ce10d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3c49dcf2
mov ecx, 0x847473fa
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3c49dcf2
mov ecx, 0x8875323a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7d5b608
mov ecx, 0xa579eefc
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0xe046033a
sub edx, 1
add edx, 0xe046033a
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd7d5b608
mov ecx, 0x33ae3a88
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x54]
sub eax, 0xc3758e50
add eax, ecx
add eax, 0xc3758e50
mov dword [ebp - 0x4c], eax
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x24a7bf7
mov ecx, 0xd4ad213b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0xb9c0c571
jmp 0x10004901
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x88]
mov dword [eax], ecx
mov eax, dword [ebp - 0x84]
mov word [eax], 0
mov dword [ebp - 0xb0], 0x6b8c5f5f
jmp 0x10004901
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x40]
mov eax, 0xb82f8e4f
mov ecx, 0xcd976201
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xad6aa716
mov ecx, 0xdb30fe0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x68114361
mov ecx, 0x26eecaad
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0x201b92ce
jmp 0x10004901
mov eax, dword [ebp - 0x7c]
mov dword [eax], 0
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x7c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x78]
mov byte [eax], cl
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x7feda1bb
sub edx, 1
sub edx, 0x7feda1bb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xd9f17332
mov ecx, 0xc8e49321
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0x9d324e30
jmp 0x10004901
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
xor eax, eax
sub eax, ecx
sub edx, eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov eax, dword [eax + 8]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10011f20
add esp, 0xc
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
mov edx, dword [ecx + 0xc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xb0], 0xbc17bccc
jmp 0x10004901
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x78]
mov byte [eax], cl
mov dword [ebp - 0xb0], 0x52cb362f
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3ed44721
mov ecx, 0xf37c2bf6
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x3f360c0a
sub edx, 1
sub edx, 0x3f360c0a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x3ed44721
mov ecx, 0x5a988179
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0x59fa9e25
sub edx, 1
add edx, 0x59fa9e25
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x3d86428a
mov ecx, 0x3b225174
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xb0], 0xf6ec43e8
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x4dad0c8b
sub edx, 1
sub edx, 0x4dad0c8b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x182d9fb4
mov ecx, 0xec16ca21
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
add edx, 0x2efba248
sub edx, 1
sub edx, 0x2efba248
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x182d9fb4
mov ecx, 0xe91d84f3
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0x26344678
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
sub edx, 0x4f41f449
sub edx, 1
add edx, 0x4f41f449
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb9d945c
mov ecx, 0x8ff1a50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
mov edx, eax
add edx, 0x41a196b1
sub edx, 1
sub edx, 0x41a196b1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7497b636
mov ecx, 0x918914c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x2772395
mov ecx, 0xc5f3ea0f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10011190
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x94f7f6e8
mov ecx, 0x5581892
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x64]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xb0], 0xbd21870a
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0x4713ca7a
sub edx, 1
add edx, 0x4713ca7a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x599be265
mov ecx, 0x6773e457
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [ebp - 0x94]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xb0], 0xa579eefc
jmp 0x10004901
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xb0], 0xdb30fe0f
jmp 0x10004901
mov eax, dword [ebp - 0x7c]
mov dword [eax], 0
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
xor eax, eax
sub eax, edx
xor edx, edx
sub edx, esi
add eax, edx
xor edx, edx
sub edx, eax
mov eax, dword [ebp - 0x7c]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0
setne cl
and cl, 1
mov eax, dword [ebp - 0x78]
mov byte [eax], cl
mov dword [ebp - 0xb0], 0xa17f9048
jmp 0x10004901
mov ecx, dword [0x100702a8]
mov eax, dword [0x100702a4]
mov edx, ecx
sub edx, 0xb4c52bfe
sub edx, 1
add edx, 0xb4c52bfe
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xa3479f86
mov ecx, 0xf1bc252f
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov eax, dword [0x100702a8]
mov ecx, dword [0x100702a4]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xa3479f86
mov ecx, 0xf4f6a2d0
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x10004901
mov dword [ebp - 0xb0], 0xb055f796
jmp 0x10004901
mov dword [ebp - 0xb0], 0x5fb0deda
jmp 0x10004901
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb0], 0x43272fe4
jmp 0x10004901
mov dword [ebp - 0xb0], 0x2bad565a
jmp 0x10004901
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xb0], 0xcc2b64bb
jmp 0x10004901
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x1001c190
call fcn.10012d50
add esp, 8
mov dword [ebp - 0xb0], 0x322bb49d
jmp 0x10004901
mov dword [ebp - 0xb0], 0x670a47f6
jmp 0x10004901
mov dword [ebp - 0xb0], 0x9f085163
jmp 0x10004901
mov dword [ebp - 0xb0], 0xf1bc252f
jmp 0x10004901
mov dword [ebp - 0xb0], 0x421c9d88
jmp 0x10001978